3 ms·

Strange that it is legal currently in the first place. You are basically financing a criminal group. In normal cases that's clearly illegal. How do you even bo

Strange that it is legal currently in the first place. You are basically financing a criminal group. In normal cases that's clearly illegal. How do you even book it in your accounting and taxes? Do the criminals give you an invoice?

Closi 6y ago
By the same logic, shouldn’t it be illegal to hand over your wallet if you get mugged? Companies aren’t really paying this money by choice, they are paying it because losing systems/data can in some cases result in an inability to operate - otherwise it wouldn’t really be a ransom.
- k_sze 6y ago
  The difference is that if you get mugged, your physical safety is being threated. So giving your money to the mugger is reasonably considered defense against bodily harm. I believe that in most randomware cases, nobody's physical safety is in immediate danger (except cases that involve hospital systems or other remote-controlled/networked medical device). I'd say there should be an exception for ransomeware cases where physical safety is being threatened.
  - phpnode 6y ago
    > I'd say there should be an exception for ransomeware cases where physical safety is being threatened. doesn't that incentivise attacks on critical services/systems?
    - k_sze 6y ago
      I don't think so, because critical services/systems are targetted by ransomware operators regardless of the exception. And I don't think the victim should be burdened to decide between losing a life vs paying hefty fines.
fennecfoxen 6y ago
Is it clear that it’s illegal? Is the group clearly defined on a list somewhere or are those sending money supposed to use their judgment? If you’ve been defrauded is that also illegal, making you a criminal as well as a victim? Or is only ransom prohibited? If my local car dealership commits some environmental crime by pouring motor oil down the drain, does this make it illegal for me to pay them to service my car there? What about if your neighbor’s kid is in a gang, but you want to set him straight and give him opportunity, so you pay him to mow the lawn: is that illegal too? What if the whole gang mows your lawn? And if the mafia is shaking down your business for extortion payments, does it make you more or less likely to talk to the cops if that makes you a criminal too? There are answers to these, but it’s inherently a fuzzy area.
VLM 6y ago
> You are basically financing a criminal group. In normal cases that's clearly illegal. Clearly, not the case. That might be an interesting way to naturally limit the size of corporations and their influence; if everyone who fills up their car at a gas station becomes a felon by being a customer. Yet it seems to scale too low for some purposes. Its the rare restaurant that has never had a minor (or major?) health code violation. Certainly we shouldn't shut down all restaurants? Maybe the strategy to implement "sons inherit the sins of their fathers" as government policy would be customers inherit one step down from the sins of their corporate retail operator. So a step down from a minor regulatory issue at a local restaurant would be nothing, but a step down from a major felony committing megacorporation would be a misdemeanor ticket violation.

Closi 6y ago

By the same logic, shouldn’t it be illegal to hand over your wallet if you get mugged? Companies aren’t really paying this money by choice, they are paying it because losing systems/data can in some cases result in an inability to operate - otherwise it wouldn’t really be a ransom.

k_sze 6y ago
The difference is that if you get mugged, your physical safety is being threated. So giving your money to the mugger is reasonably considered defense against bodily harm. I believe that in most randomware cases, nobody's physical safety is in immediate danger (except cases that involve hospital systems or other remote-controlled/networked medical device). I'd say there should be an exception for ransomeware cases where physical safety is being threatened.
- phpnode 6y ago
  > I'd say there should be an exception for ransomeware cases where physical safety is being threatened. doesn't that incentivise attacks on critical services/systems?
  - k_sze 6y ago
    I don't think so, because critical services/systems are targetted by ransomware operators regardless of the exception. And I don't think the victim should be burdened to decide between losing a life vs paying hefty fines.

fennecfoxen 6y ago

Is it clear that it’s illegal? Is the group clearly defined on a list somewhere or are those sending money supposed to use their judgment? If you’ve been defrauded is that also illegal, making you a criminal as well as a victim? Or is only ransom prohibited? If my local car dealership commits some environmental crime by pouring motor oil down the drain, does this make it illegal for me to pay them to service my car there? What about if your neighbor’s kid is in a gang, but you want to set him straight and give him opportunity, so you pay him to mow the lawn: is that illegal too? What if the whole gang mows your lawn? And if the mafia is shaking down your business for extortion payments, does it make you more or less likely to talk to the cops if that makes you a criminal too? There are answers to these, but it’s inherently a fuzzy area.

VLM 6y ago

> You are basically financing a criminal group. In normal cases that's clearly illegal. Clearly, not the case. That might be an interesting way to naturally limit the size of corporations and their influence; if everyone who fills up their car at a gas station becomes a felon by being a customer. Yet it seems to scale too low for some purposes. Its the rare restaurant that has never had a minor (or major?) health code violation. Certainly we shouldn't shut down all restaurants? Maybe the strategy to implement "sons inherit the sins of their fathers" as government policy would be customers inherit one step down from the sins of their corporate retail operator. So a step down from a minor regulatory issue at a local restaurant would be nothing, but a step down from a major felony committing megacorporation would be a misdemeanor ticket violation.