21 ms·
Ransomware gang threatens release of Washington D.C. police records
- vmception 5y agodo eeeet accelerate inspiration for police reform
- loopz 5y agoNo, you may regret the unintended consequences. Paranoia only breeds bad decisions.
- TomGullen 5y agoWhy should they do it? What’s it got to do with police reform?
- vmception 5y agoBasically more American people will see more evidence that Officer Friendly on their side of town is Judge Dredd on the other side of town and that there is a chronic abuse of low accountability which can be corrected in more holistic ways
- boomboomsubban 5y agoIt's far too easy to drown out coverage of police misconduct with "third informant killed after police leak." Ideally, they'd release the information to a wikileaks like organization that could redact the potentially dangerous records.
- vmception 5y agoThen the agency should pay the ransom Its not that hard of an equation
- Thorrez 5y agoPaying the ransom creates a financial incentive to keep doing ransomware attacks which could hurt more people in the future.
- 1_person 5y agoThe proportion of the population that will pay a ransom with a positive expected valuation will never be 0 unless you can guarantee that it is impossible to make a ransom offer which yields a positive expected valuation to the victim. In effect this means that refusing to pay a ransom with a positive expected valuation subsidizes outcomes for those that do pay the ransom.
- 1_person 5y agoor, really, what I mean to say is, there is no way to stop everyone from paying ransoms when we assume they are rational or even pseudo-rational actors, except by making it impossible for them to be presented with the choice of paying a ransom which makes sense to them to pay from their perspective for example, if someone is going to die based on the information, then we would have to be ready to kill that person anyway to make a point, and apparently have perfect information about everything except how to stop this tragedy from happening, in any case the person being ransomed is essentially morally bound to pay the ransom, with the only difference in the vindictive justice case being the tangentially but not necessarily meaningfully involved party is guaranteed to die, and that doesn't seem like the outcome we're looking for here really
- Thorrez 5y ago>there is no way to stop everyone from paying ransoms when we assume they are rational or even pseudo-rational actors I guess it depends on what the definition of rational is. Is it rational to give money to charity? People do that all the time because they feel it's the morally right thing to do. >except by making it impossible for them to be presented with the choice of paying a ransom which makes sense to them to pay from their perspective Yep, making it illegal to pay the ransom is a good way to stop people from having that choice. If police themselves are paying a ransom, that might make it hard to make it illegal. >The proportion of the population that will pay a ransom with a positive expected valuation will never be 0 unless... You don't need to get the proportion to 0 to help people. Reducing the proportion is helpful. If you reduce the amount of people paying (say you convince half the population that it's immoral to pay), the ransomware gangs will be less profitable, and will invest less money in ransomware and thus less people will be attacked. Some fraction of every ransom paid is reinvested into making better ransomware and attacking more people.
- ALittleLight 5y agoIn the article they talk about leaking the identities of informants and the background files of police officers (possibly saying where they live). I think this would be less of a "police reform" thing and more of a "a few criminal informants getting killed" thing.
- vmception 5y agothat likely will happen, as a point of accuracy
- nanoshelter 5y agoSnitches get stitches
- piemadd 5y agodo it hehehe
- boomboomsubban 5y agoShowing that you were willing to pay but the price was too high seems like the worst way to handle ransomware. Comparatively, the hackers are running an excellent PR campaign, providing the police enough time to protect those at risk and providing early leaks of data likely to upset the public.
- vertis 5y agoI can't see how they're still protected really. If you're in organized crime in Washington DC then surely you get in contact with the ransomware gang and offer to pay for any relevant names. Even if they pay the ransom those people are not 'safe'.
- Griffinsauce 5y agoPaying for stolen data to be... returned? It's a real "you wouldn't download a car moment". The only valid approach in my eyes is: Have backups, never pay, assume this data to be public now and act accordingly. You could even argue that we should destroy the viability of the market for these scams by harshly fining anyone who pays ransom. Right now individual interests go against collective ones. (unlikely to happen because it looks like victim blaming if you squint... but something needs to be done at a system level)
- arsome 5y agoI'm not sure that's a good solution, likely you'd just see people paying ransoms but keeping it quiet and not making these attacks public. Arguably, even more harmful.
- boomboomsubban 5y ago>I can't see how they're still protected really. They have been provided ample warning that their cover is about to be blown. Leaking the hacked data immediately or privately conducting negotiations would put those at risk in far more danger.
- cout 5y ago
- trhway 5y agoreminds about the story when a hacker exposed the rape of an underage girl by the football players https://www.rollingstone.com/culture/culture-news/anonymous-vs-steubenville-57875/ https://www.rollingstone.com/culture/culture-news/anonymous-... "Online vigilante Deric Lostutter helped expose the cover-up in the Steubenville rape case. Now he’s facing more jail time than the convicted rapists." Yep, the rapists got 1 and 2 years for the rape, and the hacker got 2 years for that hack. Clearly shows what the society's priorities are.
- senectus1 5y agoNot that I'm defending it. but, a rapist hurt (in theory) 1 person. A "Hacker" can hurt hundreds or thousands or millions of people... I'm honestly not sure how to equate fair punishment in that space.
- JI00912 5y agoDid he though?
- nxpnsv 5y agoThat is a ridiculous sentiment. The rapist potentially could rape thousands of people. He should not be convicted for potential victims, but for actual victims.
- trhway 5y ago>I'm honestly not sure how to equate fair punishment in that space. Just imagine that you have to choose - either you're going to be raped or you computer is going to be hacked.
- gamblor956 5y agoThe football players were tried and convicted as juveniles (they were both 16[1]), and so the length of punishment was capped under state law. If they had been slightly older and could have been tried as adults, they could have been sentenced to up to 10 years in prison. (News article say that the two also probably would have to register as sex offenders once they turned 21, however, I didn't find any followup articles during my brief search.) However, Deric played no role in exposing the rape itself. The article you cited even points out that Deric learned about the Steubenville rape case reading the NYT article about it. None of the evidence that Deric and the other members of Anon hacked and released were used at the juvenile court proceedings due to evidentiary and due process issues (and for that reason would similarly have been excluded if the defendants had been tried as adults), and (per the linked article) a lot of what they posted wasn't even relevant to the rape or the coverup; it was simply intended to embarrass and harass. At least one of the (adult) hacking victims was not involved with the coverup; they simply had the misfortune to be mentioned in the news articles as being involved with the case, and if it satisfies your moral umbrage, that is why Deric was sentenced to 2 years. [1] https://corriganlawohio.com/felonies-in-juvenile-court https://corriganlawohio.com/felonies-in-juvenile-court. Generally, for a rape charge, in Ohio the youth defendant must have aggravating circumstances to be tried as an adult, such as a previous violent juvie commitment or the use of a firearm in the commission of the crime, which did not apply to this case. Note that these laws were passed as a response to juvenile defendants being treated as adults, on the premise that juvenile defendants are less in control of their actions and therefore should face less punishment than adults.
- tolbish 5y agoOne thing I am still confused about is how the blockchain is supposed to make such ransom payments easily traceable. That apparently must not be the case if organizations keep falling victim to these attacks.
- rawtxapp 5y ago> A Russian-speaking ransomware syndicate > The Babuk group said on its website late Monday I don't think they care about it being untraceable, they can dump it on a non-US exchange, they probably care about it being un-censorable. That said, the article doesn't mention if they want the payment in crypto (presumably they do).
- tolbish 5y agoThe linked article said Bitcoin.
- TheSpiceIsLife 5y agoI'm no expert, but isn't a public blockchain only pseudonymous? Bitcoin, for example, doesn't claim to be an anonymous payment system.
- chrisco255 5y agoThere are blockchains like Zcash and Monero that are anonymous.
- Stranger43 5y agoYes but there is no existing way to poison illegitimately gained bitcoins as not eligible for use with legitimate purchases even though it's totally possible to trace each and every bitcoin used to pay a ransom. In addition there is no 3rd party verification of the wallet owners so in practice there is plenty of ways to whitewash dirty bitcoin into clean currency, especially in economies with an large black/gray sector. Add to that that any international investigation into cyber crime becomes an instant political hot potato due to the prevalent political rhetoric around state sponsored actors and you have an environment where the treat of actual capture/punishment is extremely low.
- chrisco255 5y agoWhat are some thoughts about the government or corps posting a bounty on the blockchain for any tips or leads that lead to the identification of these perpetrators? Why not fight fire with fire?
- deleted 5y ago[deleted]
- spicybright 5y agoHow would you do that transaction though? Police won't pay for bogus tips, and if they already get a valid tip, what's the incentive to pay for it? What recourse would the tip giver have if they didn't pay?
- ALittleLight 5y agoAs far as fighting fire with fire, I'd advise the FSB (or whatever relevant law enforcement body) that if you do not ably deter cybercriminals in your jurisdiction we will not enforce cyber crime laws against criminals targeting Russian individuals and companies. Could American hacker groups cause sufficient problems for Russia that it would become worthwhile for Russia to enforce laws against its criminals?
- bsder 5y ago> Could American hacker groups cause sufficient problems for Russia that it would become worthwhile for Russia to enforce laws against its criminals? You don't need to do much to Russia. You just need to let some "hackers" empty the foreign bank accounts of some oligarchs a couple of times. Those are probably much easier to wipe out and it would send the appropriate message--clean up or stay home--indefinitely.
- Dah00n 5y agoAnd the US is better than Russia how then? Let's turn it around (with a real example): A US diplomats wife ran someone down in the UK while drunk driving and then ran home to the US. The US refuse to let justice run its course. Should everyone else then be just as dirty as the US and let every criminal do whatever they want and just laugh at the US when they want justice? It's a very steep and slippery slope. One cannot both be angry that Russia doesn't jump when we say jump and then not jump ourselves when it is the other way around.
- gadders 5y agoMaybe they can leak who killed Ashli Babbitt.
- wobblyasp 5y agoWhy would you want that?
- gadders 5y agoThe same reason all police misconduct should be investigated. It seems suspicious in this case the name of the officer involved is suppressed, but not in other high profile police shootings.
- wobblyasp 5y agoThis is the person that tried to jump through that window and enter an even more heavily fortified/restricted area yah? I just don't see how this situation is comparable to other cases.
- TheGigaChad 5y agoSnitches will go in ditches.
- liberty-bzmh 5y ago自分で演出や演技をしているような気がします
- TrackerFF 5y agoMaybe it's time to declare ransomware on important infrastructure as terrorism - if they haven't done that already.
- BariumBlue 5y agoLol no. Terrorism is "The calculated use of unlawful violence or threat of unlawful violence to inculcate fear; intended to coerce or to intimidate governments or societies in the pursuit of goals that are generally political, religious, or ideological" I don't think we should start calling everything we don't like terrorism. Nestle? Not terrorists. Dirty roommate that doesn't clean up? Most likely not a terrorist.
- bagacrap 5y agoReleasing data on informants really is a threat of unlawful violence (although indirect). The ideological/political angle comes in when you consider that Russia has no interest in fighting this threat because the victim is its main political rival.
- dmm 5y agoI think we should reserve the word terrorism for attacks on the public intended to influence a separate authority, or something close to that.
- NikolaNovak 5y agoUnderstanding the word is getting diluted recently, generally terrorism is meant to indicate violent acts intended to coerce behaviour for political / ideological purposes. It seems most ransom ware is used for fairly explicit and immediate commercial gain. We already have a word for "bad thing", "crime". If we start using terrorism for every bad thing it becomes meaningless. Mind you, irregardless is becoming a word and literally now has two opposing meanings, so it's likely based on current USA usage terrorism will become a catch all phrase as well if it hasn't already. I am curious however what use it then becomes calling something terrorism. Today there's implicit notion it is a higher threat demanding higher response but even that I think is diluted.
- lifeisstillgood 5y agoThis is just conjecture and blue sky thinking, but privacy and security look like they might travel hand in hand. The issue is we have valuable data - and it is not protected as well as it should be. Somewhere, somehow I think there is a data storage approach that encrypts data (lets say a pandas dataframe) and the authorisation is your ownership of relevant key. All data changes start to become eventually consistent, sharded and passed around as single atomic units.... I need to think about that somemore ...
- phkahler 5y ago>> the authorisation is your ownership of relevant key. I tend to agree and go a step further. We need to eliminate "anonymity by default" and switch to communications where it is a default to verify the identity of whom you're connected to. No more spam emails, or at least you'd have a verifiable origin. Better still would be verification increase sender costs. Proof of work would be useful, and people on our whitelist could be given less work or no work. Just an idea. If we have good identity verification, places like reddit or HN could strip that off to maintain anonymity but criminals attacking would have to offer up some identity. Once strong identity handing is possible your encrypted data access become much simpler too. I don't think this will happen because too many parties from ISPs to governments don't want it. Strong identity also makes end to end encryption easy.
- mindslight 5y ago> If we have good identity verification, places like reddit or HN could strip that off to maintain anonymity Lol, why would reddit strip off identity? They might not display it to preserve the illusion, but they would store it forever. The same with every other surveillance-loving company, who right now are constrained to making their best guess and harassing you with CAPTCHAs etc. And the results of such leaks with real world identities would be that much worse. Strong identity on a cross-jurisdictional network is a fallacy that would only bring increased corporate and government control over our lives. The problem is a lack of software security plus lackadaisical network administration, and adding mandatory identity to the "works as intended" path does nothing to address that.
- ben_w 5y agoI have a different take on this to most. We’ll never have perfect security. Secrets can always leak. Almost everyone’s one hack away from being blackmailable. We can minimise the opportunity for blackmail in two ways: better security, and a more liberty-focused society — for example, you can’t be blackmailed for doing weed if nobody cares you did weed. (Same applies to many non-drug laws, but all this will vary from jurisdiction to jurisdiction).
- thekaleb 5y agoYou used to not be able to get a security clearance if you were a homosexual because you could be blackmailed. That's stricture has been dropped and that specific thing is no longer an issue mostly.
- dhimes 5y agoIs it still an issue if you are married/carrying on like a heterosexual family and your homosexuality is a secret? That was the important part of your clearance eligibility before: that someone can get leverage on you. Likely the homosexuality has changed because society's view towards it has changed.
- mywittyname 5y agoIt can be an issue if the person's family is unaware of it and they are actively engaging in extramartial relations.
- phkahler 5y ago>> It can be an issue if the person's family is unaware of it and they are actively engaging in extramartial relations. That would be situational. It sounds like the old rule was that just being gay was a show stopper. What you describe has little to do with sexuality and everything to do with extramarital activity which could offer leverage to straight people too.
- throwaway0a5e 5y agoIt's been a week or more since this story first broke. I'm surprised the hackers haven't released all the info as a warning about what happens if you don't pay up in a timely manner.
- paulpauper 5y agomaybe they are bluffing
- duckfang 5y agoThey're not bluffing. hXXp:// wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd DOT onion/blog/040c040c85339ebb4b2a8f8d865b4d2c5c83121b48c8dfde5436a78b113919fa/ (from Babuk) "The negotiations reached a dead end, the amount we were offered does not suit us, we are posting 20 more personal files on officers, you can download this archive, the password will be released tomorrow. if during tomorrow they do not raise the price, we will release all the data." The password AND link to a 161MB rar file is present and working.
- bena 5y agoBlackmail is a gun with one bullet that can only shoot one target. Once you release the information, you can never get paid. Any leverage you had is gone. So if the goal is to get paid, releasing the information is actually counter-productive. Blackmail is a game of chicken.
- natmaka 5y agoAs a gang with a "provable" identity and a will to avoid any latency they may release those data as a way to "educate" their future victims.
- bena 5y agoFirst, that assumes that people are rational actors. They are not. Second, if these people were trustworthy, they wouldn't be blackmailing you in the first place. And once they get the money, what's to stop them from asking for more? It's not like they stop having the information once they get paid.
- tjpnz 5y agoAny thoughts on why this continues to be such an issue? Is it a case of companies not heeding the warnings or are the attacks just becoming more sophisticated?
- paulpauper 5y agocompanies too lazy and stingy to take basic precautions until too late
- wonderwonder 5y agoIts not just companies, they US government is hacked massively all the time.
- belatw 5y ago“ A day after the initial threat was posted, the gang tried to spur payment by leaking personal information of some police officers taken from background checks, including details of officers’ past drug use, finances and — in at least one incident — of past sexual abuse.” I’m all for leaking this data. It would be a heroic act to let the people know how bad our police really are.
- onei 5y agoDoes drug use and poor financial decisions, regardless of age, context, and scale, make you a fundamentally bad police officer? I'm not sure that's a bandwagon I can blindly jump on.
- roflc0ptic 5y agoLocking people up for doing drugs is a moral travesty. Locking people up for doing drugs while you also do drugs is... just like, entirely beyond the pale. Extorting people for money is also bad, and I hope that the extortionists don't get paid, and just release this shit. Police misconduct is the worst sort of misconduct.
- paulpauper 5y agothe penalty for just using recreational quantities of drugs vs. dealing them is way less harsh though
- detaro 5y agoHaving done drugs in the past is not "police misconduct". Enforcing bad drug laws is also not "police misconduct". Conflating these things is not going to help you fix any of them.
- loveistheanswer 5y ago>Locking people up for doing drugs is a moral travesty. Locking people up for doing drugs while you also do drugs is... just like, entirely beyond the pale. We've had multiple recent presidents and vice presidents who have used illegal drugs. That seems far more "beyond the pale" because the president has more power than anyone to ending the drug war
- paulpauper 5y agoThe musk twitter btc giveaway thing is more profitable and no footprint. no detection. better than ransomware from a criminal perspective.
- paulpauper 5y agoRansomware btc are so tainted as to be worthless. I cannot imagine that these criminals are able to cashout easily, if at all. To cash out tainted btc you need a buyer. At some point there will be leaks and major arrests of these ppl. Just being in Russia is not safe enough. IN certain cases, the US government does do kidnappings.
- nyhc99 5y agoKidnapping a Russian national on Russian soil might be doable, but I doubt we would risk the potential political fallout in 99.9% of ransomware cases. If the pipeline attack doesn't provoke it then I don't know what it will take
- matheusmoreira 5y agoThey can just use Monero instead. It's fungible, there's no way to tell which coins are or aren't tainted by criminal activity.
- throwitaway12 5y agoWell that's if they are smart and there has to be a strong market for Monero. BTC is king in that aspect.
- clarkmoody 5y agoPlease show me the market where "tainted" BTC command a massive ~~premium~~ discount. (Edit: thanks paulpauper)
- paulpauper 5y agoyou mean discount?
- clarkmoody 5y agoYes! Thank you.
- steve76 5y ago1:59 PM EST: The power goes out 2:00 PM EST: Ransomware group claims responsibility 2:01 PM EST: Ransomware group demands Putin ____s a pig 2:20 PM EST: Ransomware group releases deep fake of Putin ____'ing a pig 2:21 PM EST: Your UPS starts recharging and power goes back on, with you oblivious to the entire thing.
- warmwaffles 5y agoThis is why I do not trust government registries for anything. It _will_ leak and it is just a matter of _when_ that leak will happen.
- spillguard 5y agoPrivate companies of every size have major data leaks all the time. Why distrust only the government?
- warmwaffles 5y agoI don't trust them either. I should have clarified that, but government seems to always lag behind on security updates for all sorts of devices.
- clarkmoody 5y agoGovernment information has deadly consequences when leaked. Also, private companies don't expect you to lay down your life to defend them.
- themaninthedark 5y agoThis is not an either or situation, both government and private business get hacked and data stolen. BUT: Only the government has the force of law to aid in their data collection. Theoretically: if you wanted to avoid Google/Facebook web tracking, you could never use their services, block all cookies and domains. You might not have the best web experience but you could still browse the web. If the government made a WebID to help people stop the tracking/prevent certain ads from being served to minors/think of the children/... then you would have a nice juicy target of information on a whole bunch of people. The same with gun control arguments, if there is a gun registry then it is a target. Now there can be a debate on if the trade off of having that target helps prevent other more serious crimes. Another example might be library system membership. Libraries membership lists have but they are not all linked, this is inconvenient if you want to take out books from different systems but might help protect the data more.
- david56423 5y agoHow do these police departments get hacked in the first place? Do these ransomware gangs have multiple 0 days?
- vengefulduck 5y agoI have a feeling it was something like an email with an attachment called important_tax_info.docx.exe. People are much easier to exploit than software.
- asdff 5y agoWhen I worked at a hospital there would be a phishing attempt like this to emails like once a month. Luckily IT was set up pretty well to expect these events so nothing major happened. I'm sure orgs are constantly being phished.
- bena 5y agoYep. We occasionally get emails that look like they're from other organizations in our collective to phish for information.
- bena 5y agoExactly. I think people need to read or reread The Art of Deception. The best tool to gain access to sensitive information isn't a laptop, it's a Hershey's bar.
- macinjosh 5y agoI doubt it. Because governments, just like big corporations are susceptible to important but small things like software updates falling through the cracks. The incentives aren't right so it is allowed to happen.
- ChrisArchitect 5y agothis isn't really much ad to the ongoing story is it? Other than 'talks breaking down'
- nnm 5y agoAnother reason why bitcoin should be banned.
- clarkmoody 5y ago99.9% of criminal activity is conducted in US Dollars. Should we ban those?
- system2 5y agoWhy don't we ban criminals instead?
- CoastalCoder 5y ago(I'm new to this topic, so I apologize if this has been discussed to death elsewhere...) Wouldn't it make sense for governments to make it crushingly illegal to pay a ransom? I would think that drastically changes the calculations of would-be ransomers.
- lozaning 5y agoIt's my understanding that it is illegal-ish, depending on the exact circumstance. https://home.treasury.gov/system/files/126/ofac_ransomware_advisory_10012020_1.pdf https://home.treasury.gov/system/files/126/ofac_ransomware_a...
- 542458 5y agoBut it’s sort of wishy-washy maybe-technically-but-never-once-been-enforced illegal. Not “actively enforced and we can send your CEO to jail” illegal (like export control or whatever), which companies would actually take seriously.
- trompetenaccoun 5y agoI agree. Also better PR work. The article is based on information the criminals have released, it's pure speculation that negotiations have even happened in the first place. If it would be categorically illegal and if they would clearly communicate that it is so, there wouldn't be much of a discussion and people could focus on the main issue - the security breach.
- andred14 5y ago"The media is the enemy of the people" - President Trump This is either planned or made up BS. How could the USA public/private sector not have good enough security to avoid this? We all know here that it is NOT rocket science to secure today's simple computer networks.
- bastardoperator 5y agoI would assume most records can be requested via FOIA?
- diveanon 5y agoTake the money and release them anyways.