8 ms·

I understand the sentiment, but you'd end up re-victimizing the victim. Someone who felt like they had no choice but to pay could later be prosecuted, while the

by Meekro 5y ago

I understand the sentiment, but you'd end up re-victimizing the victim. Someone who felt like they had no choice but to pay could later be prosecuted, while the the actual criminal walks free in anonymity.

nradov 5y ago
That is an acceptable outcome. Let the victims suffer. That protects the rest of us, and serves as an object lesson in proper cyber security.
- FredPret 5y ago
  So let people who aren’t experts at physical security suffer break-ins, and physically weak people get beaten up? We have law enforcement so everyone can be free to focus on their own value-add in life without having to learn 1000 skills to cover their own ass. I love security but 99% of people don’t, and shouldn’t
  - throwawaygh 5y ago
    > So let people who aren’t experts at physical security suffer break-ins, and physically weak people get beaten up? First, in many jurisdictions, paying protection money for physical security is illegal. Second, Colonial Pipeline has an operating revenue of $1.32 billion. I suppose in the USA it's technically a person, but... it's not actually a person. > We have law enforcement so everyone can be free to focus on their own value-add in life without having to learn 1000 skills to cover their own ass. I love security but 99% of people don’t, and shouldn’t I submit that oil pipeline operators, hospitals, and large corps are part of that 1%.
    - FredPret 5y ago
      You have a point. They should do minimum due diligence to harden their networks. However... how much do you want to bet that the CEO of a pipeline company has the knowledge to make this happen? One has to be an intelligent customer to make something like this happen.
      - WJW 5y ago
        Well then, perhaps there should be minimum requirements to become CEO of a large corporation in regulated areas like pipelines? If the alternative is large harm to the public, this seems like a no-brainer to me for future legislation.
        FredPret 5y ago
        It’s probably cleaner and easier to run this if the spooks set up a bureau of cyber security standards and fine strategically important companies for non-compliance. The gov can do security audits on these corps.
        briandear 5y ago
        So should the president of the United States be an expert on tactical jet engines? And also have a PHD in economics? And also be an expert in immunology? And power plant operations? How about the national airspace system? People are quick to conclude that Colonial’s security was “bad.” But do we know that to be true? A sophisticated, potentially state-sponsored organization initiated this attack. The best security in the world is not 100% secure. It might be wise to get the facts before rushing to judgement.
      - Siira 5y ago
        He's a CEO. His job is to ask others to find him the experts needed and manage them. He doesn't need to know any actual security engineering.
        FredPret 5y ago
        He needs to know the basics. How does he know someone is a real expert?
    - Vrondi 5y ago
      So, you are saying that there are jurisdictions where home security systems are illegal? Night watchmen/security guards and body guards are illegal? Where would these jurisdictions be located?
      - throwawaygh 5y ago
        I don't think that's even close to what I'm saying. I'm not even really sure what you are trying to communicate here; are you insinuating that ADT or Ring hire roving bands of bandits who break into houses that aren't protected by their security systems? If not, I genuinely don't know what you're trying to say here.
  - nradov 5y ago
    That's a non sequitur. Certainly law enforcement should aggressively pursue criminals who engage in assault, burglary, and extortion. But that has nothing to do with paying off ransomware gangs.
    - FredPret 5y ago
      Yes it does, it’s a crime, in this case a class of crime perpetrated, prosecuted, and prevented by experts. It falls under law enforcement
  - dumpsterdiver 5y ago
    > We have law enforcement so everyone can be free to focus on their own value-add in life without having to learn 1000 skills to cover their own ass. No, that's why we have division of labor. Law enforcement is just another brick in the wall. If a company is already making massive profits from the public by running critical services, why should tax payers fund their lack of diligence? Should we just fund their entire payroll while we're at it?
- aqme28 5y ago
  That's pretty easy to say when it's not e.g. your child being held for ransom.
  - ben509 5y ago
    I don't think people here are considering all forms of ransoms, but you hit on an interesting aspect of it all the same. It's why, I think, such a law wouldn't pass Constitutional review. If your person is threatened with imminent danger, you have a right to self-defense, we'll even let you commit intentional homicide if the threat is serious enough. And self-defense also covers your property and livelihood to a lesser extent. I think it'd be extremely hard to convince courts that this right to self-defense doesn't include negotiating with an attacker. Imagine if it were a crime to toss some money at a mugger and run away, for instance.
    - nradov 5y ago
      The US Constitution contains no explicit right to self defense. There are a variety of state and federal laws covering justifiable use of force but none of them are even remotely applicable to paying ransoms. If you disagree then please cite a specific legal case. https://www.natlawreview.com/article/us-government-warns-companies-legal-risk-paying-ransom-to-cybercriminals https://www.natlawreview.com/article/us-government-warns-com...
      - ben509 5y ago
        US law derived from common law, which recognized a right to self defense. All 50 states, DC, and federal jurisdictions then codified that right as law. While the 2A is not directly about self-defense, it plainly guarantees an individual right to maintain the means for self-defense, which implies a right to self-defense. There are cases covering a justifiable use of force because intentionally killing or harming a person is illegal, and self-defense is a defense against those charges. It's normally perfectly legal to pay someone whatever you want. You don't need a defense against something that's not a crime. There's no conflict in paying a ransom, so there's no case law. Regarding OFAC, as your link points out: > One issue is that victim organizations are required to check the list of sanctioned entities; however, many times the true identity of the cybercriminals are not known. I'm guessing there's no case law regarding paying ransoms to SDNs because nobody has an identity they can check. But do we need case law when OFAC says: > OFAC will consider a company’s self-initiated, timely and complete report of a ransomware attack to law enforcement to be a significant mitigating factor in determining the enforcement outcome if the situation is determined to have a sanctions nexus. If someone wanted to make a law against paying ransom, it would be quite novel and courts would have to look for applicable doctrine. I think the doctrine of self-defense would be a roadblock.
- ryanlol 5y ago
  This would only protect those without proper cyber security. Why is it acceptable to let random targets suffer as opposed to everyone without proper security?
AbrahamParangi 5y ago
Here we have a coordination problem, like the prisoner’s dilemma. People who pay ransom are the defectors, improving their situation at the cost of making the problem much worse for everyone. If fewer people paid ransom, ransomware would be less profitable and would happen less often and we’d all be better off. The government can help coordination by making defecting more costly (with criminal penalties).
- UncleOxidant 5y ago
  > The government can help coordination by making defecting more costly (with criminal penalties). not just sticks, but also carrots: The federal government should commit to doing all it can to help organizations that refuse to pay ransoms. This would include help from 3-letter agencies as well as bringing in alternative IT infrastructure. Obviously the federal government doesn't have all of these capabilities now, but this should be a priority going forward.
  - candiodari 5y ago
    Nobody in their right mind will consider a lot of attention by three letter agencies a reward or help. They may, and can, do a lot more damage than 0.4% of revenue, and can do a lot of damage to the individuals making the decisions as well. Even if they help out, it will alert everyone and everything in 5 governments to all details about their firm. Three letter agencies have used (and destroyed) companies for unrelated reasons and then left everyone without any recourse. With smaller companies, this happens regularly. Those governments will have representatives from their lenders, from their investors, from their large clients and so on in them, who will get a lot of details they wouldn't normally get access to. This is not happening.
    - UncleOxidant 5y ago
      It's the 3-letter agencies where the expertise lies. Maybe a new agency needs to be created outside of the intelligence agencies?
UncleOxidant 5y ago
The federal government should commit to doing what it can to help make organizations who refuse to pay ransoms whole again.
- jaywalk 5y ago
  Why should this be a problem that the federal government is required to solve? Or in other words: why should my tax dollars go to help an organization that couldn't manage their security properly?
  - Vrondi 5y ago
    Because this organization endangered the economy of a significant chunk of the country by their negligence, then your tax dollars should go to setting standards and holding them liable when they fail to meet those standards.
    - jaywalk 5y ago
      That's not what the OP said though. That is something completely different.
    - walshemj 5y ago
      Some board member resignations might be in order and being banned from being directors for 10-20 years
- nradov 5y ago
  That role can be better handled by private insurers in the same way they make policy holders whole after physical thefts.
jeffbee 5y ago
Let's be clear that the victims here are the public and the perpetrators are the computer operators at the pipeline firm.

by Meekro 5y ago

nradov 5y ago

That is an acceptable outcome. Let the victims suffer. That protects the rest of us, and serves as an object lesson in proper cyber security.

FredPret 5y ago
So let people who aren’t experts at physical security suffer break-ins, and physically weak people get beaten up? We have law enforcement so everyone can be free to focus on their own value-add in life without having to learn 1000 skills to cover their own ass. I love security but 99% of people don’t, and shouldn’t
- throwawaygh 5y ago
  > So let people who aren’t experts at physical security suffer break-ins, and physically weak people get beaten up? First, in many jurisdictions, paying protection money for physical security is illegal. Second, Colonial Pipeline has an operating revenue of $1.32 billion. I suppose in the USA it's technically a person, but... it's not actually a person. > We have law enforcement so everyone can be free to focus on their own value-add in life without having to learn 1000 skills to cover their own ass. I love security but 99% of people don’t, and shouldn’t I submit that oil pipeline operators, hospitals, and large corps are part of that 1%.
  - FredPret 5y ago
    You have a point. They should do minimum due diligence to harden their networks. However... how much do you want to bet that the CEO of a pipeline company has the knowledge to make this happen? One has to be an intelligent customer to make something like this happen.
    - WJW 5y ago
      Well then, perhaps there should be minimum requirements to become CEO of a large corporation in regulated areas like pipelines? If the alternative is large harm to the public, this seems like a no-brainer to me for future legislation.
      - FredPret 5y ago
        It’s probably cleaner and easier to run this if the spooks set up a bureau of cyber security standards and fine strategically important companies for non-compliance. The gov can do security audits on these corps.
      - briandear 5y ago
        So should the president of the United States be an expert on tactical jet engines? And also have a PHD in economics? And also be an expert in immunology? And power plant operations? How about the national airspace system? People are quick to conclude that Colonial’s security was “bad.” But do we know that to be true? A sophisticated, potentially state-sponsored organization initiated this attack. The best security in the world is not 100% secure. It might be wise to get the facts before rushing to judgement.
    - Siira 5y ago
      He's a CEO. His job is to ask others to find him the experts needed and manage them. He doesn't need to know any actual security engineering.
      - FredPret 5y ago
        He needs to know the basics. How does he know someone is a real expert?
  - Vrondi 5y ago
    So, you are saying that there are jurisdictions where home security systems are illegal? Night watchmen/security guards and body guards are illegal? Where would these jurisdictions be located?
    - throwawaygh 5y ago
      I don't think that's even close to what I'm saying. I'm not even really sure what you are trying to communicate here; are you insinuating that ADT or Ring hire roving bands of bandits who break into houses that aren't protected by their security systems? If not, I genuinely don't know what you're trying to say here.
- nradov 5y ago
  That's a non sequitur. Certainly law enforcement should aggressively pursue criminals who engage in assault, burglary, and extortion. But that has nothing to do with paying off ransomware gangs.
  - FredPret 5y ago
    Yes it does, it’s a crime, in this case a class of crime perpetrated, prosecuted, and prevented by experts. It falls under law enforcement
- dumpsterdiver 5y ago
  > We have law enforcement so everyone can be free to focus on their own value-add in life without having to learn 1000 skills to cover their own ass. No, that's why we have division of labor. Law enforcement is just another brick in the wall. If a company is already making massive profits from the public by running critical services, why should tax payers fund their lack of diligence? Should we just fund their entire payroll while we're at it?
aqme28 5y ago
That's pretty easy to say when it's not e.g. your child being held for ransom.
- ben509 5y ago
  I don't think people here are considering all forms of ransoms, but you hit on an interesting aspect of it all the same. It's why, I think, such a law wouldn't pass Constitutional review. If your person is threatened with imminent danger, you have a right to self-defense, we'll even let you commit intentional homicide if the threat is serious enough. And self-defense also covers your property and livelihood to a lesser extent. I think it'd be extremely hard to convince courts that this right to self-defense doesn't include negotiating with an attacker. Imagine if it were a crime to toss some money at a mugger and run away, for instance.
  - nradov 5y ago
    The US Constitution contains no explicit right to self defense. There are a variety of state and federal laws covering justifiable use of force but none of them are even remotely applicable to paying ransoms. If you disagree then please cite a specific legal case. https://www.natlawreview.com/article/us-government-warns-companies-legal-risk-paying-ransom-to-cybercriminals https://www.natlawreview.com/article/us-government-warns-com...
    - ben509 5y ago
      US law derived from common law, which recognized a right to self defense. All 50 states, DC, and federal jurisdictions then codified that right as law. While the 2A is not directly about self-defense, it plainly guarantees an individual right to maintain the means for self-defense, which implies a right to self-defense. There are cases covering a justifiable use of force because intentionally killing or harming a person is illegal, and self-defense is a defense against those charges. It's normally perfectly legal to pay someone whatever you want. You don't need a defense against something that's not a crime. There's no conflict in paying a ransom, so there's no case law. Regarding OFAC, as your link points out: > One issue is that victim organizations are required to check the list of sanctioned entities; however, many times the true identity of the cybercriminals are not known. I'm guessing there's no case law regarding paying ransoms to SDNs because nobody has an identity they can check. But do we need case law when OFAC says: > OFAC will consider a company’s self-initiated, timely and complete report of a ransomware attack to law enforcement to be a significant mitigating factor in determining the enforcement outcome if the situation is determined to have a sanctions nexus. If someone wanted to make a law against paying ransom, it would be quite novel and courts would have to look for applicable doctrine. I think the doctrine of self-defense would be a roadblock.
ryanlol 5y ago
This would only protect those without proper cyber security. Why is it acceptable to let random targets suffer as opposed to everyone without proper security?

AbrahamParangi 5y ago

Here we have a coordination problem, like the prisoner’s dilemma. People who pay ransom are the defectors, improving their situation at the cost of making the problem much worse for everyone. If fewer people paid ransom, ransomware would be less profitable and would happen less often and we’d all be better off. The government can help coordination by making defecting more costly (with criminal penalties).

UncleOxidant 5y ago
> The government can help coordination by making defecting more costly (with criminal penalties). not just sticks, but also carrots: The federal government should commit to doing all it can to help organizations that refuse to pay ransoms. This would include help from 3-letter agencies as well as bringing in alternative IT infrastructure. Obviously the federal government doesn't have all of these capabilities now, but this should be a priority going forward.
- candiodari 5y ago
  Nobody in their right mind will consider a lot of attention by three letter agencies a reward or help. They may, and can, do a lot more damage than 0.4% of revenue, and can do a lot of damage to the individuals making the decisions as well. Even if they help out, it will alert everyone and everything in 5 governments to all details about their firm. Three letter agencies have used (and destroyed) companies for unrelated reasons and then left everyone without any recourse. With smaller companies, this happens regularly. Those governments will have representatives from their lenders, from their investors, from their large clients and so on in them, who will get a lot of details they wouldn't normally get access to. This is not happening.
  - UncleOxidant 5y ago
    It's the 3-letter agencies where the expertise lies. Maybe a new agency needs to be created outside of the intelligence agencies?

UncleOxidant 5y ago

The federal government should commit to doing what it can to help make organizations who refuse to pay ransoms whole again.

jaywalk 5y ago
Why should this be a problem that the federal government is required to solve? Or in other words: why should my tax dollars go to help an organization that couldn't manage their security properly?
- Vrondi 5y ago
  Because this organization endangered the economy of a significant chunk of the country by their negligence, then your tax dollars should go to setting standards and holding them liable when they fail to meet those standards.
  - jaywalk 5y ago
    That's not what the OP said though. That is something completely different.
  - walshemj 5y ago
    Some board member resignations might be in order and being banned from being directors for 10-20 years
nradov 5y ago
That role can be better handled by private insurers in the same way they make policy holders whole after physical thefts.

jeffbee 5y ago

Let's be clear that the victims here are the public and the perpetrators are the computer operators at the pipeline firm.