4 ms·

This is a really good example of both a prisoner's dilemma (more precisely a collective action problem), and a common way to try to overcome the suboptimal equi

This is a really good example of both a prisoner's dilemma (more precisely a collective action problem), and a common way to try to overcome the suboptimal equilibrium that a prisoner's dilemma naturally ends up in. Society as a whole will be better off if no one pays the ransom. If truly no one paid, ransom attacks would end. However, if you are attacked by a ransom attack, your best individual course of action is likely to pay; your paying or not (as an individual) isn't going to be the deciding factor in the ransom industry continuing, and the ransom is likely cheaper than the cost of not paying. The rational response as an individual is to pay. You therefore end up with a suboptimal overall situation, even though everyone is making the rational choice. One way to break out of the prisoner's dilemma is to place an outside cost on 'defecting' from the socially optimal choice; in this case, the government announces loudly that they will fine companies more than their losses if they pay. The idea is to shift the equilibrium to not paying a ransom being the logical choice, which will, in the long run, will put an end to ransoms. Of course, it really sucks for the people caught by ransom attacks in the meantime, and requires consistent and predictable enforcement of the outside penalty.

longadeseo 6y ago
indeed. however the single biggest area is when lower it companies choose to skimp and get pwned.. paying 50k is better than filing chapter 13 even if the govt charges you another 25k pound of flesh.
ComodoHacker 6y ago
>the government announces loudly that they will fine companies more than their losses if they pay. No, they do it to enforce sanctions, not to break out of the prisoner's dilemma. Criminals not connected with sanctioned subjects will happily continue their ransom attacks, now that the government has crippled their most capable rivals.
- spurdoman77 6y ago
  Or the sanctioned individuals just set up a new identity.
jlawson 6y ago
This is better described as a tragedy of the commons, not a prisoner's dilemma.
- cortesoft 6y ago
  It isn't really a tragedy of the commons... what resource is being overused? It is a collective action problem, which is really a type of prisoner's dilemma. https://en.wikipedia.org/wiki/Collective_action_problem https://en.wikipedia.org/wiki/Collective_action_problem
  - rightbyte 6y ago
    It is not really a prisoners' dilemma. Who is the other prisoner?
    - thotsBgone 6y ago
      You and I are both prisoners.
    - cortesoft 6y ago
      A prisoner’s dilemma doesn’t require actual prisoners; it was the first example of this type of problem, which is why the name is used for all sorts of problems with the same characteristics; namely, that there is some optimal outcome for everyone that could be reached if everyone chose a particular decision, but their is always an individual incentive to ‘defect’ and choose the other option.
  - Kinrany 6y ago
    I too usually interpret "tragedy of the commons" as "everyone does the thing even though everyone would be better of if no one did the thing"
- hnracer 6y ago
  You are exactly right about that, not sure where the down votes are coming from.
occamrazor 6y ago
In the 80s Italy had a problem with kidnappings. An ingredient of the solution was freezing the assets of the relatives of kidnapping victims. The strategy worked.
- Scoundreller 6y ago
  In France, it’s illegal to pay ransoms too. So somebody impersonated a Minister, video-called a bunch of rich people saying somebody was kidnapped and asked them to pay the ransom since the government couldn’t. They bilked a bunch of rich people out of 55 mln EUR: https://www.bbc.com/news/world-europe-51842898 https://www.bbc.com/news/world-europe-51842898 https://www.washingtonpost.com/world/how-scammers-used-a-silicone-mask-and-skype-to-impersonate-a-french-minister-and-steal-90-million/2019/06/20/601ca6ac-9375-11e9-b72d-d56510fa753e_story.html https://www.washingtonpost.com/world/how-scammers-used-a-sil...
Avtomatk 6y ago
In practice, no one renounces their child or their intellectual property or important information (looking from the skin of companies), no matter how much you impose a thousand fines, only when the fines exceed the value of the person or information seized, you could be renounced to this, for example: to be fined a million dollars if you rescue your son. But this is a stupid solution... Instead of punishing yourself for something that isn't your fault (or something you overlooked like not creating a backup, or, in the case of children, not taking good care of your son), well this problem can be prevented and the irresponsible punished BEFORE the tragedy happens. I propose that companies that do not have a backup of their information be fined, or in the case of companies (financial, social networks that do not want the information to be disclosed), regulate the security of their company or otherwise be fined. With this, he punishes himself BEFORE the tragedy and not AFTER. If the fines come AFTER, the ransomware is not mitigated, the hijackers get what they want.
jnxx 6y ago
> One way to break out of the prisoner's dilemma is to place an outside cost on 'defecting' from the socially optimal choice; There might exist additional effective measures: 1. requiring by law that companies, hospitals and so on, do effective backups; controlling that this actually does happen and handing stiff fines to companies that do not. 2. the government acting as an insurance for damages in companies which fall prey to ransomware, covering their losses completely if they provide proof that they did not pay. Also, there is an additional problem with ransom payments: As you cannot prove who is the recipient, how can you refute the suspicion that the company is not victim to ransomware but one of the company's owners is extracting profits without paying taxes? I mean, if you work as a cashier in a supermarket, you cannot tell your boss that somehow the money in the cash register got lost or that it was taken away by an armed robber which is not visible on any security video picture. The counter-measure would be to put full regular taxes on profits on any kind of proclaimed ransom payment.

longadeseo 6y ago

indeed. however the single biggest area is when lower it companies choose to skimp and get pwned.. paying 50k is better than filing chapter 13 even if the govt charges you another 25k pound of flesh.

ComodoHacker 6y ago

>the government announces loudly that they will fine companies more than their losses if they pay. No, they do it to enforce sanctions, not to break out of the prisoner's dilemma. Criminals not connected with sanctioned subjects will happily continue their ransom attacks, now that the government has crippled their most capable rivals.

spurdoman77 6y ago
Or the sanctioned individuals just set up a new identity.

jlawson 6y ago

This is better described as a tragedy of the commons, not a prisoner's dilemma.

cortesoft 6y ago
It isn't really a tragedy of the commons... what resource is being overused? It is a collective action problem, which is really a type of prisoner's dilemma. https://en.wikipedia.org/wiki/Collective_action_problem https://en.wikipedia.org/wiki/Collective_action_problem
- rightbyte 6y ago
  It is not really a prisoners' dilemma. Who is the other prisoner?
  - thotsBgone 6y ago
    You and I are both prisoners.
  - cortesoft 6y ago
    A prisoner’s dilemma doesn’t require actual prisoners; it was the first example of this type of problem, which is why the name is used for all sorts of problems with the same characteristics; namely, that there is some optimal outcome for everyone that could be reached if everyone chose a particular decision, but their is always an individual incentive to ‘defect’ and choose the other option.
- Kinrany 6y ago
  I too usually interpret "tragedy of the commons" as "everyone does the thing even though everyone would be better of if no one did the thing"
hnracer 6y ago
You are exactly right about that, not sure where the down votes are coming from.

occamrazor 6y ago

In the 80s Italy had a problem with kidnappings. An ingredient of the solution was freezing the assets of the relatives of kidnapping victims. The strategy worked.

Scoundreller 6y ago
In France, it’s illegal to pay ransoms too. So somebody impersonated a Minister, video-called a bunch of rich people saying somebody was kidnapped and asked them to pay the ransom since the government couldn’t. They bilked a bunch of rich people out of 55 mln EUR: https://www.bbc.com/news/world-europe-51842898 https://www.bbc.com/news/world-europe-51842898 https://www.washingtonpost.com/world/how-scammers-used-a-silicone-mask-and-skype-to-impersonate-a-french-minister-and-steal-90-million/2019/06/20/601ca6ac-9375-11e9-b72d-d56510fa753e_story.html https://www.washingtonpost.com/world/how-scammers-used-a-sil...

Avtomatk 6y ago

In practice, no one renounces their child or their intellectual property or important information (looking from the skin of companies), no matter how much you impose a thousand fines, only when the fines exceed the value of the person or information seized, you could be renounced to this, for example: to be fined a million dollars if you rescue your son. But this is a stupid solution... Instead of punishing yourself for something that isn't your fault (or something you overlooked like not creating a backup, or, in the case of children, not taking good care of your son), well this problem can be prevented and the irresponsible punished BEFORE the tragedy happens. I propose that companies that do not have a backup of their information be fined, or in the case of companies (financial, social networks that do not want the information to be disclosed), regulate the security of their company or otherwise be fined. With this, he punishes himself BEFORE the tragedy and not AFTER. If the fines come AFTER, the ransomware is not mitigated, the hijackers get what they want.

jnxx 6y ago

> One way to break out of the prisoner's dilemma is to place an outside cost on 'defecting' from the socially optimal choice; There might exist additional effective measures: 1. requiring by law that companies, hospitals and so on, do effective backups; controlling that this actually does happen and handing stiff fines to companies that do not. 2. the government acting as an insurance for damages in companies which fall prey to ransomware, covering their losses completely if they provide proof that they did not pay. Also, there is an additional problem with ransom payments: As you cannot prove who is the recipient, how can you refute the suspicion that the company is not victim to ransomware but one of the company's owners is extracting profits without paying taxes? I mean, if you work as a cashier in a supermarket, you cannot tell your boss that somehow the money in the cash register got lost or that it was taken away by an armed robber which is not visible on any security video picture. The counter-measure would be to put full regular taxes on profits on any kind of proclaimed ransom payment.