4 ms·

Here we have a coordination problem, like the prisoner’s dilemma. People who pay ransom are the defectors, improving their situation at the cost of making the p

Here we have a coordination problem, like the prisoner’s dilemma. People who pay ransom are the defectors, improving their situation at the cost of making the problem much worse for everyone. If fewer people paid ransom, ransomware would be less profitable and would happen less often and we’d all be better off. The government can help coordination by making defecting more costly (with criminal penalties).

UncleOxidant 5y ago
> The government can help coordination by making defecting more costly (with criminal penalties). not just sticks, but also carrots: The federal government should commit to doing all it can to help organizations that refuse to pay ransoms. This would include help from 3-letter agencies as well as bringing in alternative IT infrastructure. Obviously the federal government doesn't have all of these capabilities now, but this should be a priority going forward.
- candiodari 5y ago
  Nobody in their right mind will consider a lot of attention by three letter agencies a reward or help. They may, and can, do a lot more damage than 0.4% of revenue, and can do a lot of damage to the individuals making the decisions as well. Even if they help out, it will alert everyone and everything in 5 governments to all details about their firm. Three letter agencies have used (and destroyed) companies for unrelated reasons and then left everyone without any recourse. With smaller companies, this happens regularly. Those governments will have representatives from their lenders, from their investors, from their large clients and so on in them, who will get a lot of details they wouldn't normally get access to. This is not happening.
  - UncleOxidant 5y ago
    It's the 3-letter agencies where the expertise lies. Maybe a new agency needs to be created outside of the intelligence agencies?
    - walshemj 5y ago
      Yet another one :-)
    - taurath 5y ago
      Yes, at least a 16-letter agency consisting of uppercase lowercase letters and special characters would be much better ;)
      - Sohcahtoa82 5y ago
        I like to use foreign letters like ß and ö in my passwords. Good luck guessing that password. I'm not even German.
sameboat632746 5y ago
I think criminal penalties is too much. I think at some point paying ransom is better than not paying, for example, in case of attacks on hospitals. People can literally die. What needs to happen is that when an organization that skips IT security practices, it should have large monetary penalties and its executives held responsible, no golden parachutes for them. You can imagine any factory where they don't practice OSHA safety guidelines will get in major trouble.
- kortilla 5y ago
  > in case of attacks on hospitals. People can literally die. Setting aside the appeal to emotion, there are a couple of things to unpack. In real-world ransom kidnappings, life and death was always at stake and the government still errs on the side of not paying. Second, you presume ransomware authors are prepared to commit murder. If a hospital cannot legally pay, the only thing to gain by shutting it down is murder.
- ls612 5y ago
  Kidnapping for ransom is basically a dead enterprise in the US because of laws essentially forbidding the paying of ransom. Your appeal to emotion is exactly the sort of thing that ransomware gangs want people to hear because its how they make money. In the long run though its a terrible idea.
  - FDSGSG 5y ago
    >Kidnapping for ransom is basically a dead enterprise in the US because of laws essentially forbidding the paying of ransom. This is bullshit. US laws do not prohibit ransom payments except to sanctioned and/or designated entities which tend to not operate within the US.
slavik81 5y ago
Civil penalties may be more palatable. If organizations are willing and able to pay a ransom, there should be no problem with paying a fine as well.
- dboreham 5y ago
  You've finally found a way to fund open source development.

UncleOxidant 5y ago

> The government can help coordination by making defecting more costly (with criminal penalties). not just sticks, but also carrots: The federal government should commit to doing all it can to help organizations that refuse to pay ransoms. This would include help from 3-letter agencies as well as bringing in alternative IT infrastructure. Obviously the federal government doesn't have all of these capabilities now, but this should be a priority going forward.

candiodari 5y ago
Nobody in their right mind will consider a lot of attention by three letter agencies a reward or help. They may, and can, do a lot more damage than 0.4% of revenue, and can do a lot of damage to the individuals making the decisions as well. Even if they help out, it will alert everyone and everything in 5 governments to all details about their firm. Three letter agencies have used (and destroyed) companies for unrelated reasons and then left everyone without any recourse. With smaller companies, this happens regularly. Those governments will have representatives from their lenders, from their investors, from their large clients and so on in them, who will get a lot of details they wouldn't normally get access to. This is not happening.
- UncleOxidant 5y ago
  It's the 3-letter agencies where the expertise lies. Maybe a new agency needs to be created outside of the intelligence agencies?
  - walshemj 5y ago
    Yet another one :-)
  - taurath 5y ago
    Yes, at least a 16-letter agency consisting of uppercase lowercase letters and special characters would be much better ;)
    - Sohcahtoa82 5y ago
      I like to use foreign letters like ß and ö in my passwords. Good luck guessing that password. I'm not even German.

sameboat632746 5y ago

I think criminal penalties is too much. I think at some point paying ransom is better than not paying, for example, in case of attacks on hospitals. People can literally die. What needs to happen is that when an organization that skips IT security practices, it should have large monetary penalties and its executives held responsible, no golden parachutes for them. You can imagine any factory where they don't practice OSHA safety guidelines will get in major trouble.

kortilla 5y ago
> in case of attacks on hospitals. People can literally die. Setting aside the appeal to emotion, there are a couple of things to unpack. In real-world ransom kidnappings, life and death was always at stake and the government still errs on the side of not paying. Second, you presume ransomware authors are prepared to commit murder. If a hospital cannot legally pay, the only thing to gain by shutting it down is murder.
ls612 5y ago
Kidnapping for ransom is basically a dead enterprise in the US because of laws essentially forbidding the paying of ransom. Your appeal to emotion is exactly the sort of thing that ransomware gangs want people to hear because its how they make money. In the long run though its a terrible idea.
- FDSGSG 5y ago
  >Kidnapping for ransom is basically a dead enterprise in the US because of laws essentially forbidding the paying of ransom. This is bullshit. US laws do not prohibit ransom payments except to sanctioned and/or designated entities which tend to not operate within the US.

slavik81 5y ago

Civil penalties may be more palatable. If organizations are willing and able to pay a ransom, there should be no problem with paying a fine as well.

dboreham 5y ago
You've finally found a way to fund open source development.