3 ms·
1. It's possible for the advantages of restoring data to outweigh the societal cost of facilitating a criminal enterprise. For example, a patient has died in a
by dannyw 6y ago
1. It's possible for the advantages of restoring data to outweigh the societal cost of facilitating a criminal enterprise. For example, a patient has died in a hospital due to a ransomware attack. Would you prioritise saving human lives over sending some Bitcoin to some malware writer?
2. While there's no guarantee, it is exceedingly demonstrated that if you pay the ransom, you will get your data back. Ransomware writers have a collective reputation to uphold (strange, huh), and a typical negotiation involves requesting decryption of a few files to prove this capability exists.
3. Parties can legally comply with law enforcement AND pay a ransom (see #1 and #2). When paid with bitcoin, it leaves a strong and permanent evidence trail, especially with Bitcoin de-mixing techniques discovered all the time.
4. The solution to your problem is mandatory and visible disclosure of security breaches, you do not need to criminalise paying ransoms to get here; nor does it achieve as much as a broad "obligation to disclose".
5. By criminalising ransomware payments, the Justice Department has already made hundreds of corporations criminals. We know this Justice Department is known for selective prosecution: it is entirely plausible, if not likely, for companies against the current political party (e.g. donations to other candidates) to receive enhanced scrutiny and criminal charges.
Point 5 is not "conspiracy theory": we know the Qwest CEO was arrested on selectively enforced "insider trading" charges because he refused to spy on his customers for the NSA.
- cma 6y ago> Would you prioritise saving human lives over sending some Bitcoin to some malware writer? What if you end up incentivizing the deaths of many more patients as a result?
- ByteJockey 6y agoTrue, but "potential deaths" leads you down some pretty weird rabbit holes. Also, you have to answer the question what's the right timeline to optimize for then? For example, centralizing power makes the federal government a more tempting target for authoritarians in the long term (next 100 years). Given the death statistics of previous authoritarian (from both internal violence and wars), you're probably looking at millions of deaths. Centralizing power is also what makes the modern social safety net and regulatory regime possible. Are the thousands of lives saved by those systems every year worth a low chance at a much larger number of deaths? (rhetorical question, there probably isn't an objective answer to that)
- grapehut 6y ago> 1. It's possible for the advantages of restoring data to outweigh the societal cost of facilitating a criminal enterprise. For example, a patient has died in a hospital due to a ransomware attack. Would you prioritise saving human lives over sending some Bitcoin to some malware writer? There's already overriding exceptions to all laws that allow you to do otherwise illegal in emergency circumstances. That's why we can say "You are not to vandalize someones house" without needing to add all the contrived ways that it could be done in a way to save someone (or yourself) etc.