4 ms·

An unconventional approach could be to make it a severely penalized, strictly enforced, federal crime to pay ransom. (Of course, a year or so pre-warning of th

An unconventional approach could be to make it a severely penalized, strictly enforced, federal crime to pay ransom. (Of course, a year or so pre-warning of this kind of law would be required to allow for companies to lock their data down.)

hpoe 5y ago
All you get at that point is the right people using it to prosecute the honest people.
- bpodgursky 5y ago
  I think it would just give CEOs who want to do the right thing (and not pay) legal cover to tell the board of directors "Nope, not paying — the company is going to be shut down for a month. Deal with it, I'm not going to jail."
  - russian-hacker 5y ago
    And it would give CEOs who want to do the wrong thing an avenue to destroy competitors under the table.
    - Agathos 5y ago
      You could always hire a bunch of shadowrunners to destroy your competitor's computer system, but I don't know what that has to do with ransomware. But hey, I guess you could use cryptocurrency to pay the runners.
    - bpodgursky 5y ago
      This has always been true... and always been illegal.
  - _hyn3 5y ago
    What if it was more than a month? What if it was.. permanent?
    - AnimalMuppet 5y ago
      Then they totally failed at continuity planning, backups... a whole lot of things.
russian-hacker 5y ago
All that guarantees is ransomware attacks morph into existential threats. You're locked out of your data with no recourse.
giaour 5y ago
Isn’t it already extremely difficult to know whether you’re committing a felony by paying a ransom? You’re sending millions of dollars in bitcoins to an unidentified group of known felons; if they are (or are affiliated with) a group dedicated to the violent overthrow of a government, then congratulations, you’ve just provided material support to a terrorist organization. The US Treasury Office of Foreign Assets Control specifically warns about the legal risk you take by paying a ransom here: https://home.treasury.gov/system/files/126/ofac_ransomware_advisory_10012020_1.pdf https://home.treasury.gov/system/files/126/ofac_ransomware_a...
- russian-hacker 5y ago
  No different to paying your US taxes to fund the same thing.
  - deleted 5y ago
    [deleted]
- dmfb 5y ago
  “The [US government] is the world’s biggest terrorist organization.” –Noam Chomsky Source: https://youtube.com/watch?v=vRbnPA3fd5U https://youtube.com/watch?v=vRbnPA3fd5U
colinmhayes 5y ago
If the colonial pipeline hadn't paid the ransom there would be pandemonium on the east coast as people were forced to ration gas. I don't see how that helps. As long as computers exist they will be hacked. Spending more on security can help but can't stop it.
- AaronFriel 5y ago
  Colonial Pipeline ended up restoring data using their own backups anyway. They paid $5 million dollars for a decryption tool that was so slow that their own IT team was able to restore service sooner. https://www.bloomberg.com/news/articles/2021-05-13/colonial-pipeline-paid-hackers-nearly-5-million-in-ransom https://www.bloomberg.com/news/articles/2021-05-13/colonial-...
  - colinmhayes 5y ago
    The article says they used backups to help restore the system. That tells me that the backups weren't fully up to date, and that the missing info was worth 5 million.
ineedasername 5y ago
Companies could just use intermediaries, transfer the money to somebody that transfers it to the hackers. They could even do it fairly openly: They're not paying "ransom", they're paying a "consultancy fee" for assistance in dealing with the issue. That's not to say it shouldn't also be made illegal or in some other way difficult to pay (they could, for example, ban crypto currency use for the purpose of paying ransoms, or whatever-- just tossing out ideas) Banning ransoms alone isn't going to work. Companies already have liability for things like customer data breaches, and that hasn't eliminated them. We also need some sort of legal framework-- especially for large pieces of infrastructure-- for defining appropriate security procedures that must be followed. Also tie it to the ability to get government subsidies/grants etc. That's how it works in Higher Education: If colleges don't adhere to to DoE regs, they simply can't accept financial aid money given to students by the government. It's actually something that's audited with fines levied on a regular basis. Few schools if any ever lose the ability to get aid, but that's because the regs are enforced and fines are high enough to hurt. Really though I don't think you can stop this completely. We might say "every company can afford to get security right" etc., but they won't: Some will barely even try, others will simply be unlucky and out of 3,000 employees, one will slip up. The nature of this sort of attack is that on defense, you have to be 100% successful all of the time or you're done, and always having a perfect record is not a realistic expectation for all organizations. The problem is that for the hackers, this is a low risk, inexpensive, high reward process. As much as security has to improve, so does that equation. If there was a physical attack that shutdown the pipeline it would easily be labelled an act of terrorism, and these should be seen the same way, with the same level of resources used to go after anyone involved in these attacks.
kube-system 5y ago
I don’t think criminalizing the victims recovery attempt is the best way to solve this. Compare this to a street crime: One might say that muggers would be deterred if it were illegal for their victims to cooperate; if you have to fight back instead of handing over your wallet. But, at what cost for the victims? If we don’t think that companies are doing enough to protect their systems, then we should pass laws that require certain demonstrable standards at all times. We shouldn’t wait for them to become a victim before the law requires them to do anything. It’s too indirect and situationally unaware of a solution. I think laws should be written so it’s easy to know when you’re in compliance, and easy to know when you’re not. “Don’t get hacked” is basically an impossible moving target, particularly for small organizations. “Follow these best practices” is a much more reasonable standard. And we already have government organizations that put together standards for this, all lawmakers need to do is cite them.
ArkanExplorer 5y ago
The same could be achieved by banning the formal exchange of cryptocurrencies in the USA. If you can't buy the coins, you can't pay the ransom.

hpoe 5y ago

All you get at that point is the right people using it to prosecute the honest people.

bpodgursky 5y ago
I think it would just give CEOs who want to do the right thing (and not pay) legal cover to tell the board of directors "Nope, not paying — the company is going to be shut down for a month. Deal with it, I'm not going to jail."
- russian-hacker 5y ago
  And it would give CEOs who want to do the wrong thing an avenue to destroy competitors under the table.
  - Agathos 5y ago
    You could always hire a bunch of shadowrunners to destroy your competitor's computer system, but I don't know what that has to do with ransomware. But hey, I guess you could use cryptocurrency to pay the runners.
  - bpodgursky 5y ago
    This has always been true... and always been illegal.
- _hyn3 5y ago
  What if it was more than a month? What if it was.. permanent?
  - AnimalMuppet 5y ago
    Then they totally failed at continuity planning, backups... a whole lot of things.

russian-hacker 5y ago

All that guarantees is ransomware attacks morph into existential threats. You're locked out of your data with no recourse.

giaour 5y ago

Isn’t it already extremely difficult to know whether you’re committing a felony by paying a ransom? You’re sending millions of dollars in bitcoins to an unidentified group of known felons; if they are (or are affiliated with) a group dedicated to the violent overthrow of a government, then congratulations, you’ve just provided material support to a terrorist organization. The US Treasury Office of Foreign Assets Control specifically warns about the legal risk you take by paying a ransom here: https://home.treasury.gov/system/files/126/ofac_ransomware_advisory_10012020_1.pdf https://home.treasury.gov/system/files/126/ofac_ransomware_a...

russian-hacker 5y ago
No different to paying your US taxes to fund the same thing.
- deleted 5y ago
  [deleted]
dmfb 5y ago
“The [US government] is the world’s biggest terrorist organization.” –Noam Chomsky Source: https://youtube.com/watch?v=vRbnPA3fd5U https://youtube.com/watch?v=vRbnPA3fd5U

colinmhayes 5y ago

If the colonial pipeline hadn't paid the ransom there would be pandemonium on the east coast as people were forced to ration gas. I don't see how that helps. As long as computers exist they will be hacked. Spending more on security can help but can't stop it.

AaronFriel 5y ago
Colonial Pipeline ended up restoring data using their own backups anyway. They paid $5 million dollars for a decryption tool that was so slow that their own IT team was able to restore service sooner. https://www.bloomberg.com/news/articles/2021-05-13/colonial-pipeline-paid-hackers-nearly-5-million-in-ransom https://www.bloomberg.com/news/articles/2021-05-13/colonial-...
- colinmhayes 5y ago
  The article says they used backups to help restore the system. That tells me that the backups weren't fully up to date, and that the missing info was worth 5 million.

ineedasername 5y ago

Companies could just use intermediaries, transfer the money to somebody that transfers it to the hackers. They could even do it fairly openly: They're not paying "ransom", they're paying a "consultancy fee" for assistance in dealing with the issue. That's not to say it shouldn't also be made illegal or in some other way difficult to pay (they could, for example, ban crypto currency use for the purpose of paying ransoms, or whatever-- just tossing out ideas) Banning ransoms alone isn't going to work. Companies already have liability for things like customer data breaches, and that hasn't eliminated them. We also need some sort of legal framework-- especially for large pieces of infrastructure-- for defining appropriate security procedures that must be followed. Also tie it to the ability to get government subsidies/grants etc. That's how it works in Higher Education: If colleges don't adhere to to DoE regs, they simply can't accept financial aid money given to students by the government. It's actually something that's audited with fines levied on a regular basis. Few schools if any ever lose the ability to get aid, but that's because the regs are enforced and fines are high enough to hurt. Really though I don't think you can stop this completely. We might say "every company can afford to get security right" etc., but they won't: Some will barely even try, others will simply be unlucky and out of 3,000 employees, one will slip up. The nature of this sort of attack is that on defense, you have to be 100% successful all of the time or you're done, and always having a perfect record is not a realistic expectation for all organizations. The problem is that for the hackers, this is a low risk, inexpensive, high reward process. As much as security has to improve, so does that equation. If there was a physical attack that shutdown the pipeline it would easily be labelled an act of terrorism, and these should be seen the same way, with the same level of resources used to go after anyone involved in these attacks.

kube-system 5y ago

I don’t think criminalizing the victims recovery attempt is the best way to solve this. Compare this to a street crime: One might say that muggers would be deterred if it were illegal for their victims to cooperate; if you have to fight back instead of handing over your wallet. But, at what cost for the victims? If we don’t think that companies are doing enough to protect their systems, then we should pass laws that require certain demonstrable standards at all times. We shouldn’t wait for them to become a victim before the law requires them to do anything. It’s too indirect and situationally unaware of a solution. I think laws should be written so it’s easy to know when you’re in compliance, and easy to know when you’re not. “Don’t get hacked” is basically an impossible moving target, particularly for small organizations. “Follow these best practices” is a much more reasonable standard. And we already have government organizations that put together standards for this, all lawmakers need to do is cite them.

ArkanExplorer 5y ago

The same could be achieved by banning the formal exchange of cryptocurrencies in the USA. If you can't buy the coins, you can't pay the ransom.