5 ms·

The U.S. needs to make it illegal to pay ransom. Then respond with force, arresting people, targeting however you can. Further, this should be a wake up call.

The U.S. needs to make it illegal to pay ransom. Then respond with force, arresting people, targeting however you can. Further, this should be a wake up call. If you're a business harden your network and make backups.

miketery 5y ago
Most adversaries are in non extradition regions.
- tomschlick 5y ago
  If those countries take away the legal system route of extradition for attacks on critical infrastructure, then in my mind its justifiable to go the batman style of extradition with a special forces team.
  - young_unixer 5y ago
    Or make hacking legal so that companies start taking appropiate measures instead of labelling themselves as victims.
    - tomschlick 5y ago
      White hat hacking, sure.
  - yaw13 5y ago
    Because fixing the infrastructure couldn’t possibly work, we need renditions and live fire operations. Totally.
    - ncphil 5y ago
      Fixing infrastructure won't get done because the people in charge are too stupid, lazy and greedy to fix it. Most of them are so wealthy they're completely insulated from the consequences of their actions (or inaction, as the case may be). Folks need to wake up and realize they're living in a global public-private idiocracy.
  - PeterisP 5y ago
    So, sign an extradition treaty or we'll declare war? Because that's what sending in troops without their consent means.
    - tomschlick 5y ago
      More like, don’t harbor or foster attacks on critical infrastructure or we will take action to bring those that do to justice. At what point do those actions by other countries become acts of war?
      - deleted 5y ago
        [deleted]
    - Stasis5001 5y ago
      It's interesting to compare this to the physical-world analog. What if somebody shows up at the US-Canada border, start shooting rockets at Canada, and the US refuses to acknowledge this as a crime or extradite? What if the rockets are aimed at a critical piece of infrastructure near the border and can cause billions in damage? One could argue that if the US condones these attacks, they have effectively already declared war on Canada.
      - PeterisP 5y ago
        Well that's the main issue, currently the states do not consider such cyberattacks the equivalent of sending troops or rockets across the border that justify a "kinetic" response but rather the equivalent of earlier espionage activities which usually justifies only a diplomatic response. Of course, that might change in the future.
Scoundreller 5y ago
I believe it is illegal. But lacking enforcement. There’s a reason people hire these intermediary “consultants” to pay the ransoms.
- zerocrates 5y ago
  It's generally not illegal to pay ransom, though with ransomware you have the issue that the recipients may be subject to US sanctions and it could be illegal to send them money on those grounds.
LatteLazy 5y ago
Or identify certain certain specific "hacks" and setup a bounty program. If you can gain root access by guessing the CEOs password, he should be punished not you. Edit: doubly so if the company is question is part of important infrastructure (including food supply).
DesiLurker 5y ago
more appropriately, it should be required to report ransom payments on balance sheet under separate heading.
dahart 5y ago
I think all of that has happened already, it is a wakeup call, and the US is making it illegal to pay. https://home.treasury.gov/system/files/126/ofac_ransomware_advisory_10012020_1.pdf https://home.treasury.gov/system/files/126/ofac_ransomware_a...
- paxys 5y ago
  Only if they violate existing international sanctions.
ransom1538 5y ago
"The U.S. needs to make it illegal to pay ransom." Ugh. So you get attacked through some old wordpress install, freak out to get your company online, pay, now you also go to jail for paying a ransom. Not a fan of this plan.
- droidist2 5y ago
  Or the attackers even use the fact that you paid to blackmail you.
qbasic_forever 5y ago
Even with backups we've seen companies are more than willing to pay a modest ransom, like the pipeline last month. It takes a long time to fully restore big infrastructure from backup--especially if it's something like old tapes. But yeah, companies should stop viewing security and IT as a cost center and start paying up for good penetration testing every few years.
wyager 5y ago
Ransom is actually quite efficient (in a utilitarian sense) in scenarios like this. The net long-term result is an efficient allocation of resources towards computer security.
slig 5y ago
> The U.S. needs to make it illegal to pay ransom. They don't need ransom if they can buy put options.
- Stasis5001 5y ago
  See Matt Levine's 10 laws of insider trading. In particular, "5. Don’t do it by planting bombs at a company and shorting its stock." Somebody nicely put a non-paywall link here: https://github.com/0xNF/lawsofinsidertrading.com https://github.com/0xNF/lawsofinsidertrading.com Buying puts in this fashion will generally be a remarkable, traceable event. There's a reason ransoms typically go through cryptocurrency.
fernly 5y ago
> Then respond with force, arresting people, targeting however you can. Yeah that's a nice fantasy. "Hands up, Russky bastards, the Navy Seal Bin Laden crew is here to take you out." Shoots up a row of laptops while bearded Russian hackers cower in fear. Except for that to happen the Seals would have to have reliable intel from inside an uncooperative foreign state, and the ability to move freely, carrying guns, in that foreign state; and if they raided in it without permission, that would be an act of war.
- anticodon 5y ago
  Oh, so it's Russia the root of all evil again. Without a single piece of evidence. How convenient! Thanks god we have nuclear weapons, otherwise we'd definitely experience another incursion like Iraq or Afghanistan, that were made under absurd pretexts and only led to great numbers of civilian casualties and some economical gain for the US and/or US government officials tied to the military complex.
ArkanExplorer 5y ago
Go even further. Make it illegal to buy the instruments of ransomware - cryptocurrencies themselves.
ClumsyPilot 5y ago
The US needs to make it illegal to have private data left in a database without a password (hello equifax), or on a old machine with obsolete OS with known vulnerabilities. Or to sell routers, wifi printers, cameras and smart TVs with known security flaws, and to leave it without updates. Then respond with force, arresting people, targeting however you can.

miketery 5y ago

Most adversaries are in non extradition regions.

tomschlick 5y ago
If those countries take away the legal system route of extradition for attacks on critical infrastructure, then in my mind its justifiable to go the batman style of extradition with a special forces team.
- young_unixer 5y ago
  Or make hacking legal so that companies start taking appropiate measures instead of labelling themselves as victims.
  - tomschlick 5y ago
    White hat hacking, sure.
- yaw13 5y ago
  Because fixing the infrastructure couldn’t possibly work, we need renditions and live fire operations. Totally.
  - ncphil 5y ago
    Fixing infrastructure won't get done because the people in charge are too stupid, lazy and greedy to fix it. Most of them are so wealthy they're completely insulated from the consequences of their actions (or inaction, as the case may be). Folks need to wake up and realize they're living in a global public-private idiocracy.
- PeterisP 5y ago
  So, sign an extradition treaty or we'll declare war? Because that's what sending in troops without their consent means.
  - tomschlick 5y ago
    More like, don’t harbor or foster attacks on critical infrastructure or we will take action to bring those that do to justice. At what point do those actions by other countries become acts of war?
    - deleted 5y ago
      [deleted]
  - Stasis5001 5y ago
    It's interesting to compare this to the physical-world analog. What if somebody shows up at the US-Canada border, start shooting rockets at Canada, and the US refuses to acknowledge this as a crime or extradite? What if the rockets are aimed at a critical piece of infrastructure near the border and can cause billions in damage? One could argue that if the US condones these attacks, they have effectively already declared war on Canada.
    - PeterisP 5y ago
      Well that's the main issue, currently the states do not consider such cyberattacks the equivalent of sending troops or rockets across the border that justify a "kinetic" response but rather the equivalent of earlier espionage activities which usually justifies only a diplomatic response. Of course, that might change in the future.

Scoundreller 5y ago

I believe it is illegal. But lacking enforcement. There’s a reason people hire these intermediary “consultants” to pay the ransoms.

zerocrates 5y ago
It's generally not illegal to pay ransom, though with ransomware you have the issue that the recipients may be subject to US sanctions and it could be illegal to send them money on those grounds.

LatteLazy 5y ago

Or identify certain certain specific "hacks" and setup a bounty program. If you can gain root access by guessing the CEOs password, he should be punished not you. Edit: doubly so if the company is question is part of important infrastructure (including food supply).

DesiLurker 5y ago

more appropriately, it should be required to report ransom payments on balance sheet under separate heading.

dahart 5y ago

I think all of that has happened already, it is a wakeup call, and the US is making it illegal to pay. https://home.treasury.gov/system/files/126/ofac_ransomware_advisory_10012020_1.pdf https://home.treasury.gov/system/files/126/ofac_ransomware_a...

paxys 5y ago
Only if they violate existing international sanctions.

ransom1538 5y ago

"The U.S. needs to make it illegal to pay ransom." Ugh. So you get attacked through some old wordpress install, freak out to get your company online, pay, now you also go to jail for paying a ransom. Not a fan of this plan.

droidist2 5y ago
Or the attackers even use the fact that you paid to blackmail you.

qbasic_forever 5y ago

Even with backups we've seen companies are more than willing to pay a modest ransom, like the pipeline last month. It takes a long time to fully restore big infrastructure from backup--especially if it's something like old tapes. But yeah, companies should stop viewing security and IT as a cost center and start paying up for good penetration testing every few years.

wyager 5y ago

Ransom is actually quite efficient (in a utilitarian sense) in scenarios like this. The net long-term result is an efficient allocation of resources towards computer security.

slig 5y ago

> The U.S. needs to make it illegal to pay ransom. They don't need ransom if they can buy put options.

Stasis5001 5y ago
See Matt Levine's 10 laws of insider trading. In particular, "5. Don’t do it by planting bombs at a company and shorting its stock." Somebody nicely put a non-paywall link here: https://github.com/0xNF/lawsofinsidertrading.com https://github.com/0xNF/lawsofinsidertrading.com Buying puts in this fashion will generally be a remarkable, traceable event. There's a reason ransoms typically go through cryptocurrency.

fernly 5y ago

> Then respond with force, arresting people, targeting however you can. Yeah that's a nice fantasy. "Hands up, Russky bastards, the Navy Seal Bin Laden crew is here to take you out." Shoots up a row of laptops while bearded Russian hackers cower in fear. Except for that to happen the Seals would have to have reliable intel from inside an uncooperative foreign state, and the ability to move freely, carrying guns, in that foreign state; and if they raided in it without permission, that would be an act of war.

anticodon 5y ago
Oh, so it's Russia the root of all evil again. Without a single piece of evidence. How convenient! Thanks god we have nuclear weapons, otherwise we'd definitely experience another incursion like Iraq or Afghanistan, that were made under absurd pretexts and only led to great numbers of civilian casualties and some economical gain for the US and/or US government officials tied to the military complex.

ArkanExplorer 5y ago

Go even further. Make it illegal to buy the instruments of ransomware - cryptocurrencies themselves.

ClumsyPilot 5y ago

The US needs to make it illegal to have private data left in a database without a password (hello equifax), or on a old machine with obsolete OS with known vulnerabilities. Or to sell routers, wifi printers, cameras and smart TVs with known security flaws, and to leave it without updates. Then respond with force, arresting people, targeting however you can.