5 ms·

All the comments so far seem incredibly hostile to this idea so I will play devils advocate. * Paying a ransom is literally facilitating a criminal enterprise

All the comments so far seem incredibly hostile to this idea so I will play devils advocate. * Paying a ransom is literally facilitating a criminal enterprise which is already illegal in almost all other aspects in most of the world. * In a ransomware attack there is no guaranteed assurance the criminal enterprise will restore the data once paid, because this an unreported expenditure to a criminal party. * Legally compelling parties to cooperate with law enforcement provides addition investigative materials for future law enforcement investigations. * The more frequently reported a crime becomes the more investigative attention it receives with increased investigative budget. Federal investigators aren’t compelled to take this problem seriously so long as it is drastically under reported. * The Justice Department is compelled to criminalize ransomware payments as a consumer protection, because the loss of data ultimately hurts the impacted consumers most.

trhway 6y ago
>* Paying a ransom is literally facilitating a criminal enterprise which is already illegal in almost all other aspects in most of the world. giving your wallet when you're being robbed at the gun point falls into that category too. And if the robbery proceeds are used for buying drugs, how about charging you with drug financing?
- austincheney 6y ago
  The differentiator is immediacy of choice. Putting a gun to your head isn’t there for your benefit of choice. It’s there so that the criminal is liable for robbery instead of a capital crime, because they could more easily kill you and take the wallet off your body.
- rightbyte 6y ago
  A better analogy would be the police buying back the wallet from the robber over postorder.
dannyw 6y ago
1. It's possible for the advantages of restoring data to outweigh the societal cost of facilitating a criminal enterprise. For example, a patient has died in a hospital due to a ransomware attack. Would you prioritise saving human lives over sending some Bitcoin to some malware writer? 2. While there's no guarantee, it is exceedingly demonstrated that if you pay the ransom, you will get your data back. Ransomware writers have a collective reputation to uphold (strange, huh), and a typical negotiation involves requesting decryption of a few files to prove this capability exists. 3. Parties can legally comply with law enforcement AND pay a ransom (see #1 and #2). When paid with bitcoin, it leaves a strong and permanent evidence trail, especially with Bitcoin de-mixing techniques discovered all the time. 4. The solution to your problem is mandatory and visible disclosure of security breaches, you do not need to criminalise paying ransoms to get here; nor does it achieve as much as a broad "obligation to disclose". 5. By criminalising ransomware payments, the Justice Department has already made hundreds of corporations criminals. We know this Justice Department is known for selective prosecution: it is entirely plausible, if not likely, for companies against the current political party (e.g. donations to other candidates) to receive enhanced scrutiny and criminal charges. Point 5 is not "conspiracy theory": we know the Qwest CEO was arrested on selectively enforced "insider trading" charges because he refused to spy on his customers for the NSA.
- cma 6y ago
  > Would you prioritise saving human lives over sending some Bitcoin to some malware writer? What if you end up incentivizing the deaths of many more patients as a result?
  - ByteJockey 6y ago
    True, but "potential deaths" leads you down some pretty weird rabbit holes. Also, you have to answer the question what's the right timeline to optimize for then? For example, centralizing power makes the federal government a more tempting target for authoritarians in the long term (next 100 years). Given the death statistics of previous authoritarian (from both internal violence and wars), you're probably looking at millions of deaths. Centralizing power is also what makes the modern social safety net and regulatory regime possible. Are the thousands of lives saved by those systems every year worth a low chance at a much larger number of deaths? (rhetorical question, there probably isn't an objective answer to that)
hexbinencoded 6y ago
The "loss of data" is the company's choice not to safeguard their data with proper backups and their systems with proper security. It's a false situation because it's giving-in to external locus-of-control logic that somehow it's an uncontrollable "accident" that happened to them with no blame of their own when the company failed to take their duties seriously.
- austincheney 6y ago
  I imagine you could say the same thing regardless of outcome. The mere fact they allowed themselves to be vulnerable to such exploitation is the larger concern.
Teever 6y ago
If paying a ransom is literally facilitating a criminal enterprise is giving a mugger with a knife your wallet so he doesn't stab you also facilitating a criminal enterprise?
- austincheney 6y ago
  Duplicate. See https://news.ycombinator.com/item?id=24669228 https://news.ycombinator.com/item?id=24669228
miohtama 6y ago
I would also add that paying fake ransoms is easy way to steal from company treasury.

trhway 6y ago

>* Paying a ransom is literally facilitating a criminal enterprise which is already illegal in almost all other aspects in most of the world. giving your wallet when you're being robbed at the gun point falls into that category too. And if the robbery proceeds are used for buying drugs, how about charging you with drug financing?

austincheney 6y ago
The differentiator is immediacy of choice. Putting a gun to your head isn’t there for your benefit of choice. It’s there so that the criminal is liable for robbery instead of a capital crime, because they could more easily kill you and take the wallet off your body.
rightbyte 6y ago
A better analogy would be the police buying back the wallet from the robber over postorder.

dannyw 6y ago

1. It's possible for the advantages of restoring data to outweigh the societal cost of facilitating a criminal enterprise. For example, a patient has died in a hospital due to a ransomware attack. Would you prioritise saving human lives over sending some Bitcoin to some malware writer? 2. While there's no guarantee, it is exceedingly demonstrated that if you pay the ransom, you will get your data back. Ransomware writers have a collective reputation to uphold (strange, huh), and a typical negotiation involves requesting decryption of a few files to prove this capability exists. 3. Parties can legally comply with law enforcement AND pay a ransom (see #1 and #2). When paid with bitcoin, it leaves a strong and permanent evidence trail, especially with Bitcoin de-mixing techniques discovered all the time. 4. The solution to your problem is mandatory and visible disclosure of security breaches, you do not need to criminalise paying ransoms to get here; nor does it achieve as much as a broad "obligation to disclose". 5. By criminalising ransomware payments, the Justice Department has already made hundreds of corporations criminals. We know this Justice Department is known for selective prosecution: it is entirely plausible, if not likely, for companies against the current political party (e.g. donations to other candidates) to receive enhanced scrutiny and criminal charges. Point 5 is not "conspiracy theory": we know the Qwest CEO was arrested on selectively enforced "insider trading" charges because he refused to spy on his customers for the NSA.

cma 6y ago
> Would you prioritise saving human lives over sending some Bitcoin to some malware writer? What if you end up incentivizing the deaths of many more patients as a result?
- ByteJockey 6y ago
  True, but "potential deaths" leads you down some pretty weird rabbit holes. Also, you have to answer the question what's the right timeline to optimize for then? For example, centralizing power makes the federal government a more tempting target for authoritarians in the long term (next 100 years). Given the death statistics of previous authoritarian (from both internal violence and wars), you're probably looking at millions of deaths. Centralizing power is also what makes the modern social safety net and regulatory regime possible. Are the thousands of lives saved by those systems every year worth a low chance at a much larger number of deaths? (rhetorical question, there probably isn't an objective answer to that)

hexbinencoded 6y ago

The "loss of data" is the company's choice not to safeguard their data with proper backups and their systems with proper security. It's a false situation because it's giving-in to external locus-of-control logic that somehow it's an uncontrollable "accident" that happened to them with no blame of their own when the company failed to take their duties seriously.

austincheney 6y ago
I imagine you could say the same thing regardless of outcome. The mere fact they allowed themselves to be vulnerable to such exploitation is the larger concern.

Teever 6y ago

If paying a ransom is literally facilitating a criminal enterprise is giving a mugger with a knife your wallet so he doesn't stab you also facilitating a criminal enterprise?

austincheney 6y ago
Duplicate. See https://news.ycombinator.com/item?id=24669228 https://news.ycombinator.com/item?id=24669228

miohtama 6y ago

I would also add that paying fake ransoms is easy way to steal from company treasury.