8 ms·
Paying ransom should be illegal. Ransom funds illegal activities. Not indirectly, like buying coffee or poppyseed or whatever, but literally money that is dire
by AbrahamParangi 5y ago
Paying ransom should be illegal.
Ransom funds illegal activities. Not indirectly, like buying coffee or poppyseed or whatever, but literally money that is directly reinvested in criminal activity- like ransomware.
- jsight 5y agoI feel the same way. It seems like the government wouldn't do it, but was practically encouraging the company to pay.
- colinmhayes 5y agoRansoms would still be paid. We just wouldn't know about it. I think it's better to allow companies to be transparent.
- teruakohatu 5y agoThe next group will want more than $5 million, and so on. If the lottery didnt allow advertising of big wins that were made, a lot less people would buy lottery tickets.
- ben509 5y agoNo, there's a hard upper limit on ransoms; the cost of recovery.
- nstj 5y agoWhat about when the cost of having the data exposed to the public is higher than that of recovery
- xphos 5y agoThat requires you to have that kind of data. The company could have be operating legally and not have compromising stuff. The ransomware team gains nothing if a company refuses to pay and has everything to lose by hacking. If there price is to high they are taking on a lot of risk for no reason. Hacks are smart people (I find breaking the law to be a bad decision but if one does it knowing the consequences and mitigations then they aren't dumb just unethical)
- ben509 5y agoYeah, I was pushing that all under "recovery." Say it all sums to $C. Arguably the bigger problem is you don't know that the ransomer will actually give you a valid key, but suppose you guess a likelihood P that they do. Now you have some scenarios: 1. Don't pay. We're out $C. 2. Do pay, and get a valid key. We're out $R. 3. Do pay, and get no key. We're out $R + $C. So the limit is at scenario 1 being equal to the combination of 2 and 3. Set C = PR + (1-P)(R + C), and your max ransom R = CP (You could probably work in additional costs for cleaning up even if the ransom is paid.)
- nstj 5y agoI mean them publishing your data not you getting it back
- FDSGSG 5y agoRansomware actors could easily punish such legislation. By continuing ransomware attacks they would place many companies in an impossible situation, either break the law by paying or face imminent collapse. How many jobs are you willing to lose in order to stop ransomware attacks? One ransomware attack probably costs the ransomware operation a few thousand dollars, any legislation would have to be extremely successful to result in a negative ROI.
- tlb 5y agoIt's as direct any other revenue => business activity connection. More direct than how buying coffee causes fields to be planted with coffee trees. Of this $5M, expect $4M to be spent on salaries in the next year or 2, funding 20 person-years of malicious hacking. 20 skilled people paid to hurt the internet instead of building it up. A terrible crime.
- rblatz 5y agoNow we have one less critical piece of infrastructure that could be trivially knocked out by a hostile state.
- PaulDavisThe1st 5y agoHow do you know that? What evidence is there that it's any more secure than it used to be?
- edoceo 5y agoThese pirates have committed to not hitting the same target again?
- toomuchtodo 5y agoAnd what about the others?
- xphos 5y agoBut they could have made holes in the system or not disclosed all system holes which other hackers might take advantage of in the future
- leesalminen 5y agoAh yes, the code of the pirates. The epitome of ethics and morality.
- 5y ago
- deleted 5y ago[deleted]
- Meekro 5y agoI understand the sentiment, but you'd end up re-victimizing the victim. Someone who felt like they had no choice but to pay could later be prosecuted, while the the actual criminal walks free in anonymity.
- nradov 5y agoThat is an acceptable outcome. Let the victims suffer. That protects the rest of us, and serves as an object lesson in proper cyber security.
- FredPret 5y agoSo let people who aren’t experts at physical security suffer break-ins, and physically weak people get beaten up? We have law enforcement so everyone can be free to focus on their own value-add in life without having to learn 1000 skills to cover their own ass. I love security but 99% of people don’t, and shouldn’t
- throwawaygh 5y ago> So let people who aren’t experts at physical security suffer break-ins, and physically weak people get beaten up? First, in many jurisdictions, paying protection money for physical security is illegal. Second, Colonial Pipeline has an operating revenue of $1.32 billion. I suppose in the USA it's technically a person, but... it's not actually a person. > We have law enforcement so everyone can be free to focus on their own value-add in life without having to learn 1000 skills to cover their own ass. I love security but 99% of people don’t, and shouldn’t I submit that oil pipeline operators, hospitals, and large corps are part of that 1%.
- FredPret 5y agoYou have a point. They should do minimum due diligence to harden their networks. However... how much do you want to bet that the CEO of a pipeline company has the knowledge to make this happen? One has to be an intelligent customer to make something like this happen.
- debt 5y agoThe ransom payments are covered by insurance. It’s the insurance companies making the payments.
- deleted 5y ago[deleted]
- gist 5y ago> Paying ransom should be illegal. Perhaps instead it should not be legal to say publicly you paid a ransom but ok to pay the ransom. That would tamp down a bit the publicity that encourages more actors. That would be a quick and easy fix along the lines of insider trading.
- sithadmin 5y ago>Paying ransom should be illegal In certain cases, it is: https://www.sidley.com/en/insights/newsupdates/2020/10/office-of-foreign-assets-control-making-or-facilitating-ransomware-payments-may-violate https://www.sidley.com/en/insights/newsupdates/2020/10/offic...
- paulpauper 5y agoit should be illegal if the government wants to help recoup the losses. If a have a firm that makes $100,000,000 a year in net-profit , paying a $5 ransomware is a cost of doing business, an unfortunate one nonetheless
- TheCoelacanth 5y agoIt incentivizes more crime and should be illegal. Businesses don't have a right to do whatever they want just because it is profitable.
- savanaly 5y agoIt should be illegal on another basis as well. Paying it contributes to a norm that randoms will be paid that will encourage more randomware in the future against other companies. So you're harming other people when you pay it. That's an externality that won't be factored into the decision to pay the ransom. Suppose god handed down powers that allowed you to smite from the earth anyone who ever paid a ransom with perfect accuracy and you made a credible commitment to do so. If this fact was well known, presumably random-paying would disappear overnight and ransomware attacks would soon cease to exist as well (ironically rendering the power to smite ransom-payers redundant). We won't ever live in that world but we can move marginally toward it by severaly penalizing clear cut cases where a company or individual pays a ransom.
- UncleOxidant 5y agoIndeed, not only should it be illegal, but the US Gov should offer any and all assistance for helping organizations get back online after such an attack. If organizations quit paying ransoms pretty soon the bad guys would give it up.
- ryoshu 5y agoA greyhat should launch ransomware and then not decrypt when the ransom is paid. Make the ransomware industry unreliable.
- cgb223 5y agoThis is the chaotic evil way of dealing with the problem
- tacocataco 5y agoWouldn't it be chaotic neutral?
- xvector 5y agoI think a lot of businesses would still pay. Pay $2M for a 50% chance of getting out of the situation, versus $200M in losses if you don’t - you’d take the gamble.
- fvv 5y agoThis fees will support next 1000's attacks , if someone gets attacked next i think should sue colonial pipeline
- mattnewton 5y agoI am not a lawyer, but my understanding is that while paying a ransom is not illegal itself, anything that facilitates the payment of a ransom is. There is a chance some party that handled the ransom money broke this law by doing so. There is another much greater chance that some party with a fiduciary duty to shareholders could be sued for misrepresenting the risk of this happening to shareholders.
- vortico 5y agoGiving up your wallet while at gunpoint should also be illegal!
- koheripbal 5y agoImagine making it illegal to hand over your wallet to a mugger holding a gun to you. All you are doing is incentivizing companies to not report these attacks.
- freshair 5y agoIf the mugger isn't bluffing, then he'll get your money one way or the other. This makes it different from paying ransoms. Furthermore, a corporation's bottom line is not truly comparable to a human life. However it is my understanding that paying ransoms to save human lives is technically illegal to. If paying a ransom to save your family member's life is illegal, then corporations paying ransoms to protect their finances should certainly be illegal.
- FDSGSG 5y ago>However it is my understanding that paying ransoms to save human lives is technically illegal to You are wrong.
- mrtesthah 5y agoIt would in incentivize more people to fight back rather than acquiesce, and therefore likely reduce the number of muggings.
- motbob 5y agoNot a good analogy, for two reasons. First, workers who don't have equity in a company don't really have a gun to their head even if the existence of the company is at risk. The real "gun to the head" is the threat of jail time. Second, it has historically been difficult to convince dozens of people to coordinate with each other and do something illegal for little to no personal gain.