5 ms·

I mean they clearly want to pay the ransom, because they care about their data and/or the privacy of their data. Making it illegal for them to pay just means t

I mean they clearly want to pay the ransom, because they care about their data and/or the privacy of their data. Making it illegal for them to pay just means that they can't look after that interest. Why would that be a good thing to do?

cpncrunch 6y ago
They might take off-site backups a bit more seriously if it is made illegal to pay the ransom. I don't think it will have any effect on privacy. The hackers say they will delete the data, but how can you trust them?
- ryandrake 6y ago
  Right, today the logic is: If the risk-adjusted cost of a ransom is less than the cost of implementing proper backups, then it makes sense to just not do backups. If paying ransom was illegal, maybe they'd actually invest in those backups.
  - UncleEntity 6y ago
    > If the risk-adjusted cost of a ransom is less than the cost of implementing proper backups, then it makes sense to just not do backups. Then again you have people who do it just for the lulz (err...meows?) -> https://news.ycombinator.com/item?id=23957510 https://news.ycombinator.com/item?id=23957510
vlan0 6y ago
>because they care about their data and/or the privacy of their data. >Making it illegal for them to pay just means that they can't look after that interest. Why would that be a good thing to do? You only have the criminal's word to stand on when they claim to delete data. It's far too easy to simply hang on the to troves of collected data and wait for a rainy day.
MacsHeadroom 6y ago
It's a public institution. It's not "their" data. It's their shareholder's data-- the public. Whether or not trusting the judgement of administrators over the judgement of law enforcement is the best way to handle these situations is an open question. I'm not sure I trust public university administrators to do much beyond stimulate the local construction economy and wider investment banking industry.
whimsicalism 6y ago
Because it is an action with a huge negative externality? You're funding criminals. We've banned voluntary actions with externalities in the past.
- powersnail 6y ago
  By that line of reasoning, every blackmail and robbery victim funds criminals, thus subject to similar punishment.
landryraccoon 6y ago
Because the criminals won't hack them if they know there's no ransom to be paid.
- Beldin 6y ago
  That's the assumption. Alternatively, the ransom is changed to "change the law".
zucker42 6y ago
The point is that ramsomware is only written because hackers can get high payouts. If the penalty for paying a ransom is higher than the costs of not paying the ransom (and losing the associated data), then no one pays the ransom, and if no one pays the ransom, no one makes ransomware (or at least no one targets institutions who can't pay ransoms). I believe this is discussed in Schelling's book "Strategy of Conflict", which I've never read but has been much discussed online[1]. Indeed the article I've linked specifically mentions this case. [1] https://www.lesswrong.com/posts/tJQsxD34maYw2g5E4/thomas-c-schelling-s-strategy-of-conflict https://www.lesswrong.com/posts/tJQsxD34maYw2g5E4/thomas-c-s...

cpncrunch 6y ago

They might take off-site backups a bit more seriously if it is made illegal to pay the ransom. I don't think it will have any effect on privacy. The hackers say they will delete the data, but how can you trust them?

ryandrake 6y ago
Right, today the logic is: If the risk-adjusted cost of a ransom is less than the cost of implementing proper backups, then it makes sense to just not do backups. If paying ransom was illegal, maybe they'd actually invest in those backups.
- UncleEntity 6y ago
  > If the risk-adjusted cost of a ransom is less than the cost of implementing proper backups, then it makes sense to just not do backups. Then again you have people who do it just for the lulz (err...meows?) -> https://news.ycombinator.com/item?id=23957510 https://news.ycombinator.com/item?id=23957510

vlan0 6y ago

>because they care about their data and/or the privacy of their data. >Making it illegal for them to pay just means that they can't look after that interest. Why would that be a good thing to do? You only have the criminal's word to stand on when they claim to delete data. It's far too easy to simply hang on the to troves of collected data and wait for a rainy day.

MacsHeadroom 6y ago

It's a public institution. It's not "their" data. It's their shareholder's data-- the public. Whether or not trusting the judgement of administrators over the judgement of law enforcement is the best way to handle these situations is an open question. I'm not sure I trust public university administrators to do much beyond stimulate the local construction economy and wider investment banking industry.

whimsicalism 6y ago

Because it is an action with a huge negative externality? You're funding criminals. We've banned voluntary actions with externalities in the past.

powersnail 6y ago
By that line of reasoning, every blackmail and robbery victim funds criminals, thus subject to similar punishment.

landryraccoon 6y ago

Because the criminals won't hack them if they know there's no ransom to be paid.

Beldin 6y ago
That's the assumption. Alternatively, the ransom is changed to "change the law".

zucker42 6y ago

The point is that ramsomware is only written because hackers can get high payouts. If the penalty for paying a ransom is higher than the costs of not paying the ransom (and losing the associated data), then no one pays the ransom, and if no one pays the ransom, no one makes ransomware (or at least no one targets institutions who can't pay ransoms). I believe this is discussed in Schelling's book "Strategy of Conflict", which I've never read but has been much discussed online[1]. Indeed the article I've linked specifically mentions this case. [1] https://www.lesswrong.com/posts/tJQsxD34maYw2g5E4/thomas-c-schelling-s-strategy-of-conflict https://www.lesswrong.com/posts/tJQsxD34maYw2g5E4/thomas-c-s...