6 ms·

Imagine for a moment that, despite all the precautions you yourself take, a clever crook manages to lock you out of some important files and demands a ransom.

by beloch 5y ago

Imagine for a moment that, despite all the precautions you yourself take, a clever crook manages to lock you out of some important files and demands a ransom. What do you do? It's easy to say cost is no object, but what if no amount of money, even far exceeding the cost of the ransom, can recover your files? The attitude that people who are hacked should have taken better precautions and should fend for themselves is a big part of what makes us soft targets to cybercrime. Imagine if we treated murder this way. "Oh, sure, he was killed, but he was walking down the wrong street at the wrong time of day. He should have known better! Let's start an educational initiative to make sure other people know what streets they shouldn't walk down at night!" We must expect the state to do a competent job of protecting citizens from cybercrime but, in most jurisdictions, governments do not devote adequate resources to this task. That needs to change. New technology and inadequate response from governments is what has created this bonanza for a new kind of criminal.

nradov 5y ago
Paying any sort of ransom should be illegal with severe criminal penalties. If that means that some businesses or people are ruined then so be it. That would be an acceptable cost to reduce similar attacks against others in the future.
- gambiting 5y ago
  Well, fortunately you don't get to decide that. Also imagine how well this would go - your child was kidnapped, but now you have to go to prison because you had the gall to make sure they go home safe. Like, I get your point, but it's one of those armchair social science ideas that can go into a cabinet full of really cool and really obvious ideas that won't ever be implemented in reality.
  - chrischen 5y ago
    If you pay the ransom you’ve doomed future children to be kidnapped as well.
    - lethoso 5y ago
      Future kids aren't your kid though. It is human to be self-interested.
      - chrischen 5y ago
        If we can agree the act is in self-interest, and we can agree that society has a role to play in disincentivizing certain self-interested actions that harm the greater good, then we can agree that society should apply those disincentives to ransoms.
    - gambiting 5y ago
      The problem with this logic is that not paying the ransom doesn't guarantee future children not being kidnapped, but it nearly guarantees your own child being killed. So if the choice is presented as "do I not pay the ransom to reduce the chance of further kidnappings by some completely undefined %, or have my child harmed with nearly 99% certainty", who could ever chose not to pay it? What sort of mind gymnastics would you go through to justify not paying it in that case?
      - chrischen 5y ago
        My logic is most people would put themselves first at the cost of the greater good. So if it is well established logically that the greater good is for everyone to cooperate and not pay ransoms then it needs to be enforced for everyone. It’s like pollution or recycling. Why spend the effort and cost to do it if the benefit is only to future generations or society as a whole (ignoring the few who do it for their own sense of self-satisfaction)? That’s why we have things like penalties for pollution and carbon credits. These people are externalizing the cost of their actions. At the very least we shouldn’t allow ransom payers to externalize the real cost of the ransoms to future generations and society as a whole.
        gambiting 5y ago
        Yes, but like I said right at the beginning it works fantastically well as a sort of armchair theory. Same way we can sit here and say that drugs should be super illegal and the penalty should be death, voila, no more drugs, right? We know this doesn't work. Making ransom payments super illegal wouldn't stop them from being made. People(parents in particular) would absolutely try to find a way to pay the ransom anyway to save their children, no matter the consequences. Like I said in another comment - what kind of punishment would stop the parent of a child in danger from paying the ransom? Years in prison? Most parents would gladly make that trade to make sure their kid goes home. There isn't a punishment here that you can establish to absolutely eliminate ransom payments, and as I'm sure you can see - as long as *any" are paid, criminals will keep using them as a tool. So imho, any effort(and therefore money) spent on fighting the ransom payers is completely wasted time and money. Not paying a ransom does not reduce the chance of further kidnappings significantly enough to make it worth it, and I'm nearly certain you can't come up with a punishment harsh enough to scare people away from making the payments.
  - freeone3000 5y ago
    The people who do have the power to decide that, the FBI in the case of live children and the Department of the Treasury in the case of ransomware, have in fact decided that these payments are illegal for precisely these reasons. Kidnap for ransom is effectively no more in the states, due to the FBI's high rate of solving these cases. If crimes using computers were taken seriously, we might have a chance at actually reducing their rate as well.
    - meowface 5y ago
      >If crimes using computers were taken seriously, we might have a chance at actually reducing their rate as well. They often are taken seriously. The problem is most of the ransomware gangs operate out of Russia, and Russian law enforcement permits the activity if Russian citizens aren't targeted. (There may be a short blacklist for citizens of some other countries allied with Russia, as well, but targeting and profiting from citizens and companies in America and Western Europe is explicitly allowed.) If you're the FBI, there's absolutely nothing you can do about that if the ransomware operators never leave the country. You can try to lure them out of the country - and this does happen sometimes - but if they're smart enough to never leave, they're basically immune to all repercussions. The Justice Department can publicly indict them, and they sometimes do, but they're just going to laugh at it; it simply increases their street cred and respect among their peers. "I'm on the FBI's Most Wanted lol." You can go after the infrastructure, but as long as the people involved are allowed to operate freely and continue to have lucrative incentivizes, it's only a minor annoyance at most.
      - ALittleLight 5y ago
        We could issue letters of marque and reprisal. Basically, if Russia won't prosecute their cybercriminals the US will permit cyber crime against Russian targets.
- meowface 5y ago
  If a cartel kidnaps your child and says they'll be killed if they don't receive a ransom payment within 72 hours, guess that's goodbye to them, then? This kind of punishing of victims is draconian, unethical, and, in my opinion, basically insane, in addition to being impractical and very difficult to enforce. In some cases the victim's negligence is largely to blame, but sometimes it isn't. And even when they are negligent, I think threatening to imprison them for paying a ransom in order to remedy something that may upturn their entire life and cost them far more (financially and otherwise) than not paying is just ridiculous. There should be some kind of accountability and regulation for negligence, and any company that's hit with a ransomware attack should be legally required to report the attack to authorities and disclose it to their customers, but I don't think you can or should punish people for paying ransoms. You should try to punish the ransomers, and the people who obstruct punishment and shield the ransomers (like countries whose law enforcement permits the attacks and extortion and whose financial industry permits the payment handling).
- helloworld11 5y ago
  That's very easy to say from a highly ordered country with effective law enforcement and a strong tradition of low violence. Other countries, much less so. There are many in the world (I live in one) where if you're "asked" for a ransom payment because a family member was kidnapped or as a threat against your business being burned to the ground, your only even partly decent chance of escaping the situation in a way that minimizes tragedy is to simply pay. Anything else, including going to the thoroughly useless, corrupt police, will mean that whoever you love enough to sell your house for will die, or something you spent years building is destroyed. Avoiding future incidents is something you'll think carefully about afterward, but paying is the first and usually only choice for saving a life or property. Ponder that in the context of how you would feel with your own family before giving flippant, simplistic absolutisms.
openfuture 5y ago
I almost got murdered in Africa, the general consensus is that this is expected behaviour for night time and I was at fault. For what it's worth I agree with that... Cybercrime isn't so much crime as a basic reality of these systems. The level of policing we'd need is a ridiculously high cost in comparison to improving the public infrastructure that is computer security.
- sizzle 5y ago
  Wow if you don’t mind me asking, what happened and how did you get out of that situation unscathed?
- XorNot 5y ago
  This is not a status quo people should accept. It is a problem and it should be fixed.
  - pessimizer 5y ago
    Is this a proposal that we should make no effort to mitigate crime until we can eliminate it altogether?
uyt 5y ago
We should avoid real world analogies. That's how we got into the culture of throwing people in jail for reporting a security bug (why were you snooping around on my property!) and stuff like "you wouldn't download a car". The specific problem with the murder analogy is that governments have effective ways to reduce local crime. You can't do anything similar for stuff happening on the internet. Criminals come from all over the world. Even if you can get every government to agree, not all of them have the resource to implement any effective form of deterrence. It also seems like the solution will be way worse than the problem. You either firewall yourself off from the world (what china does) or add so much spying that you can always catch the "bad guys". I can't think of any other solution. If we want a free internet, we just have to accept some are going to abuse their freedom to do bad things and deal with it.
- Closi 5y ago
  > The specific problem with the murder analogy is that governments have effective ways to reduce local crime. You can't do anything similar for stuff happening on the internet. Criminals come from all over the world. Extradition for murderers is incredibly common, as are cross-boarder fraud investigations (look at the case of Frank Abagnale) so tracking down people internationally isn't a new thing.
- dreen 5y ago
  IMHO there should be a separate, encrypted-only, ID-required network for "serious internet business". Keep the free and open part open and free (and semi anonymous), but have another area which is more controlled. I'm not saying this would solve all problems, but I think it would help.
  - saargrin 5y ago
    im sure chinese would agree
    - dreen 5y ago
      Not sure why you think the way China does it has to be the only way it can be done. It's exactly like shouting "COMMUNISM!!!!" at every social policy idea. Get a grip.
matheusmoreira 5y ago
> "Oh, sure, he was killed, but he was walking down the wrong street at the wrong time of day. He should have known better! Let's start an educational initiative to make sure other people know what streets they shouldn't walk down at night!" There's nothing inherently wrong with that. It is a fact that violence often can be avoided. This doesn't absolve the criminals of their guilt but it does mean people can learn to recognize danger signs and avoid many instances of violence. When faced with warning signs that a situation is developing, a lot of people feel like something is a bit off but they proceed anyway because they think they're just being paranoid. Punishing people after the fact does nearly nothing to help victims. It doesn't undo any trauma, it doesn't bring the dead back. Avoiding violence is always the best option if possible.
A4ET8a8uTh0 5y ago
"New technology and inadequate response from governments is what has created this bonanza for a new kind of criminal. " Just what government response would be appropriate here. From where I sit, government already meddles way too much in this area. "Oh, sure, he was killed, but he was walking down the wrong street at the wrong time of day." It is an odd comparison, but also very apt. You are at fault for walking South Side Chicago, while waving wads of hundred dollar bills looking like a mark. Just because it is illegal to take from you, does not mean it is not stupid to flaunt your idiocy around.

by beloch 5y ago

nradov 5y ago

Paying any sort of ransom should be illegal with severe criminal penalties. If that means that some businesses or people are ruined then so be it. That would be an acceptable cost to reduce similar attacks against others in the future.

gambiting 5y ago
Well, fortunately you don't get to decide that. Also imagine how well this would go - your child was kidnapped, but now you have to go to prison because you had the gall to make sure they go home safe. Like, I get your point, but it's one of those armchair social science ideas that can go into a cabinet full of really cool and really obvious ideas that won't ever be implemented in reality.
- chrischen 5y ago
  If you pay the ransom you’ve doomed future children to be kidnapped as well.
  - lethoso 5y ago
    Future kids aren't your kid though. It is human to be self-interested.
    - chrischen 5y ago
      If we can agree the act is in self-interest, and we can agree that society has a role to play in disincentivizing certain self-interested actions that harm the greater good, then we can agree that society should apply those disincentives to ransoms.
  - gambiting 5y ago
    The problem with this logic is that not paying the ransom doesn't guarantee future children not being kidnapped, but it nearly guarantees your own child being killed. So if the choice is presented as "do I not pay the ransom to reduce the chance of further kidnappings by some completely undefined %, or have my child harmed with nearly 99% certainty", who could ever chose not to pay it? What sort of mind gymnastics would you go through to justify not paying it in that case?
    - chrischen 5y ago
      My logic is most people would put themselves first at the cost of the greater good. So if it is well established logically that the greater good is for everyone to cooperate and not pay ransoms then it needs to be enforced for everyone. It’s like pollution or recycling. Why spend the effort and cost to do it if the benefit is only to future generations or society as a whole (ignoring the few who do it for their own sense of self-satisfaction)? That’s why we have things like penalties for pollution and carbon credits. These people are externalizing the cost of their actions. At the very least we shouldn’t allow ransom payers to externalize the real cost of the ransoms to future generations and society as a whole.
      - gambiting 5y ago
        Yes, but like I said right at the beginning it works fantastically well as a sort of armchair theory. Same way we can sit here and say that drugs should be super illegal and the penalty should be death, voila, no more drugs, right? We know this doesn't work. Making ransom payments super illegal wouldn't stop them from being made. People(parents in particular) would absolutely try to find a way to pay the ransom anyway to save their children, no matter the consequences. Like I said in another comment - what kind of punishment would stop the parent of a child in danger from paying the ransom? Years in prison? Most parents would gladly make that trade to make sure their kid goes home. There isn't a punishment here that you can establish to absolutely eliminate ransom payments, and as I'm sure you can see - as long as *any" are paid, criminals will keep using them as a tool. So imho, any effort(and therefore money) spent on fighting the ransom payers is completely wasted time and money. Not paying a ransom does not reduce the chance of further kidnappings significantly enough to make it worth it, and I'm nearly certain you can't come up with a punishment harsh enough to scare people away from making the payments.
- freeone3000 5y ago
  The people who do have the power to decide that, the FBI in the case of live children and the Department of the Treasury in the case of ransomware, have in fact decided that these payments are illegal for precisely these reasons. Kidnap for ransom is effectively no more in the states, due to the FBI's high rate of solving these cases. If crimes using computers were taken seriously, we might have a chance at actually reducing their rate as well.
  - meowface 5y ago
    >If crimes using computers were taken seriously, we might have a chance at actually reducing their rate as well. They often are taken seriously. The problem is most of the ransomware gangs operate out of Russia, and Russian law enforcement permits the activity if Russian citizens aren't targeted. (There may be a short blacklist for citizens of some other countries allied with Russia, as well, but targeting and profiting from citizens and companies in America and Western Europe is explicitly allowed.) If you're the FBI, there's absolutely nothing you can do about that if the ransomware operators never leave the country. You can try to lure them out of the country - and this does happen sometimes - but if they're smart enough to never leave, they're basically immune to all repercussions. The Justice Department can publicly indict them, and they sometimes do, but they're just going to laugh at it; it simply increases their street cred and respect among their peers. "I'm on the FBI's Most Wanted lol." You can go after the infrastructure, but as long as the people involved are allowed to operate freely and continue to have lucrative incentivizes, it's only a minor annoyance at most.
    - ALittleLight 5y ago
      We could issue letters of marque and reprisal. Basically, if Russia won't prosecute their cybercriminals the US will permit cyber crime against Russian targets.
meowface 5y ago
If a cartel kidnaps your child and says they'll be killed if they don't receive a ransom payment within 72 hours, guess that's goodbye to them, then? This kind of punishing of victims is draconian, unethical, and, in my opinion, basically insane, in addition to being impractical and very difficult to enforce. In some cases the victim's negligence is largely to blame, but sometimes it isn't. And even when they are negligent, I think threatening to imprison them for paying a ransom in order to remedy something that may upturn their entire life and cost them far more (financially and otherwise) than not paying is just ridiculous. There should be some kind of accountability and regulation for negligence, and any company that's hit with a ransomware attack should be legally required to report the attack to authorities and disclose it to their customers, but I don't think you can or should punish people for paying ransoms. You should try to punish the ransomers, and the people who obstruct punishment and shield the ransomers (like countries whose law enforcement permits the attacks and extortion and whose financial industry permits the payment handling).
helloworld11 5y ago
That's very easy to say from a highly ordered country with effective law enforcement and a strong tradition of low violence. Other countries, much less so. There are many in the world (I live in one) where if you're "asked" for a ransom payment because a family member was kidnapped or as a threat against your business being burned to the ground, your only even partly decent chance of escaping the situation in a way that minimizes tragedy is to simply pay. Anything else, including going to the thoroughly useless, corrupt police, will mean that whoever you love enough to sell your house for will die, or something you spent years building is destroyed. Avoiding future incidents is something you'll think carefully about afterward, but paying is the first and usually only choice for saving a life or property. Ponder that in the context of how you would feel with your own family before giving flippant, simplistic absolutisms.

openfuture 5y ago

I almost got murdered in Africa, the general consensus is that this is expected behaviour for night time and I was at fault. For what it's worth I agree with that... Cybercrime isn't so much crime as a basic reality of these systems. The level of policing we'd need is a ridiculously high cost in comparison to improving the public infrastructure that is computer security.

sizzle 5y ago
Wow if you don’t mind me asking, what happened and how did you get out of that situation unscathed?
XorNot 5y ago
This is not a status quo people should accept. It is a problem and it should be fixed.
- pessimizer 5y ago
  Is this a proposal that we should make no effort to mitigate crime until we can eliminate it altogether?

uyt 5y ago

We should avoid real world analogies. That's how we got into the culture of throwing people in jail for reporting a security bug (why were you snooping around on my property!) and stuff like "you wouldn't download a car". The specific problem with the murder analogy is that governments have effective ways to reduce local crime. You can't do anything similar for stuff happening on the internet. Criminals come from all over the world. Even if you can get every government to agree, not all of them have the resource to implement any effective form of deterrence. It also seems like the solution will be way worse than the problem. You either firewall yourself off from the world (what china does) or add so much spying that you can always catch the "bad guys". I can't think of any other solution. If we want a free internet, we just have to accept some are going to abuse their freedom to do bad things and deal with it.

Closi 5y ago
> The specific problem with the murder analogy is that governments have effective ways to reduce local crime. You can't do anything similar for stuff happening on the internet. Criminals come from all over the world. Extradition for murderers is incredibly common, as are cross-boarder fraud investigations (look at the case of Frank Abagnale) so tracking down people internationally isn't a new thing.
dreen 5y ago
IMHO there should be a separate, encrypted-only, ID-required network for "serious internet business". Keep the free and open part open and free (and semi anonymous), but have another area which is more controlled. I'm not saying this would solve all problems, but I think it would help.
- saargrin 5y ago
  im sure chinese would agree
  - dreen 5y ago
    Not sure why you think the way China does it has to be the only way it can be done. It's exactly like shouting "COMMUNISM!!!!" at every social policy idea. Get a grip.

matheusmoreira 5y ago

> "Oh, sure, he was killed, but he was walking down the wrong street at the wrong time of day. He should have known better! Let's start an educational initiative to make sure other people know what streets they shouldn't walk down at night!" There's nothing inherently wrong with that. It is a fact that violence often can be avoided. This doesn't absolve the criminals of their guilt but it does mean people can learn to recognize danger signs and avoid many instances of violence. When faced with warning signs that a situation is developing, a lot of people feel like something is a bit off but they proceed anyway because they think they're just being paranoid. Punishing people after the fact does nearly nothing to help victims. It doesn't undo any trauma, it doesn't bring the dead back. Avoiding violence is always the best option if possible.

A4ET8a8uTh0 5y ago

"New technology and inadequate response from governments is what has created this bonanza for a new kind of criminal. " Just what government response would be appropriate here. From where I sit, government already meddles way too much in this area. "Oh, sure, he was killed, but he was walking down the wrong street at the wrong time of day." It is an odd comparison, but also very apt. You are at fault for walking South Side Chicago, while waving wads of hundred dollar bills looking like a mark. Just because it is illegal to take from you, does not mean it is not stupid to flaunt your idiocy around.