6 ms·
“Never negotiate with terrorists” is a simple and clear mantra, and as most clear and simple concepts it hides a lot of assumptions. One of them is you are rea
by makeitdouble 5y ago
“Never negotiate with terrorists” is a simple and clear mantra, and as most clear and simple concepts it hides a lot of assumptions.
One of them is you are ready to lose the hostage in the worst case scenario. That’s how the police sees it, because the society benefits more from being firm in individual cases than losing a few of its members that might not come back anyway.
That’s a hard one to swallow, hard enough that govs also sometimes can’t follow the mantra and just pay the ransom.
It’s crazy hard to get people to sacrifice themselves for the better good, it’s yet a bigger ask for corporations who already screw the public day in day out.
- enkid 5y agoNever negotiate with terrorists is only a thing because it puts you in a stronger negotiation position.
- cwkoss 5y agoAnd it's just posturing. I'm sure the US negotiates with groups it labels as terrorists through backchannels.
- koheripbal 5y agoLiterally every government says this publicly, and then negotiates privately.
- andrewmcwatters 5y agoFrom the perspective of the individual, there is no greater good than defending one’s self.
- kag0 5y agoHardly. There are many philosophies that argue that the greatest good lies with how we interact with the other. And on a purely primal level it's common to prioritize one's offspring over one's self. I think most cultures recognize this intuitively.
- andrewmcwatters 5y agoI’m not arguing philosophy. I’m arguing how absurd the statement “it’s crazy hard to get people to sacrifice themselves for the better good” is, as if OP would sacrifice his or herself for anyone here they didn’t know. What a grand delusional statement, like the sibling comment here. It’s literally arguing moral superiority while ignoring pragmatic reality. Maybe you watch a little bit too much television, but there are plenty of spouses out there who would, for example, not want their wife to die in childbirth if they had the option.
- SamBam 5y agoIf you don't see the chasm between "people should sacrifice themselves for the greater good" (which I'd generally disagree with, particularly if you're not defining what the greater good is) and "there is no greater good than defending one’s self" then I can't help you.
- deleted 5y ago[deleted]
- SamBam 5y agoWhat an absurd statement, to just say unequivocally, ignoring the plenty of philosophies and ethical systems have disagreed entirely with that.
- andrewmcwatters 5y agoYeah, totally absurd. Would you sacrifice your life for the strangers on this forum? Let me guess, no? Huh, wild.
- rurp 5y agoWait, so you think that defending anonymous strangers from the internet is an exhaustive set of circumstances where one might risk their life?
- andrewmcwatters 5y agoOh, of course.
- deleted 5y ago[deleted]
- SamBam 5y agoYawn.
- anoncake 5y agoThere are people who would.
- makeitdouble 5y agoI tried to put it in a neutral way, and I think it’s a far from a black and white issue. Not to go too sideways, but hostage (with humans, not data) situations are typically about other people. When you’re the target, it’s not your life on the line, but your loved/valuable ones. So you’re not defending just yourself, you actually have to care about at least someone else to have it happen to you. And some care about a lot more than just their loved ones, they’ll also think about their friends, family, sometimes the rest of the society. Everyone is different and there is no absolute best, but let’s at least recognize it’s complex and there’s lots of ways to think about it.
- kag0 5y agoFrom another comment, it looks that mantra will become law in the US https://cisomag.eccouncil.org/paying-ransom-is-now-illegal-u-s-dept-of-treasury-warns/ https://cisomag.eccouncil.org/paying-ransom-is-now-illegal-u...
- MattGaiser 5y agoIsn't that just applying existing sanction law to ransomware?
- avgDev 5y agoI mean couldn't government pay the ransom and then go great lengths to track the suspects and send special forces after them? Surely US govt. has the ability to track almost anyone. Having US govt. on your ass should a decent deterrent. Just take a look at how hard FBI came down on cartels and individuals who were involved in killing Enrique Camarena. Cartel leaders were arrested in Mexico and several individual in the US.
- Griffinsauce 5y agoThat introduces a scale problem. Even for the US.
- microtherion 5y agoIt appears that some of the major ransomware gangs are operating from Russia and are tolerated by the government, as long as they don't hit domestic targets. The US cannot really send special forces there without risking a massive escalation.
- londons_explore 5y agoI'm sure the US has hundreds of spies and personnel in Russia at any point in time. But sending a spy to a software developers house and assassinating them probably isn't going to stop the problem - more people will spring up doing the same.
- kilroy123 5y agoWe might not though. We don't even have a main diplomat there. Russia has always been notoriously hard to spy on. I would not be surprised if there was only a handful of well placed assets and most of the spying being done electronically.
- MrMorden 5y agoNo, but the people operating in Russia like to travel elsewhere, and do. Also, the US and allies can enforce Russian AML laws as written on paper. If, say, the UK freezes all of Oleg Deripaska's assets there, Vova will absolutely get the message. We're not going to bring down the Russian government with military force for a million different reasons, but doing it with sanctions and prosecution is a totally different story.
- nradov 5y agoThe US government has negotiated with the Taliban (a formally designated terrorist group) for prisoner exchanges. https://www.bbc.com/news/world-asia-50471186 https://www.bbc.com/news/world-asia-50471186
- koheripbal 5y agoThe "don't negotiate with terrorists" is itself a negotiation tactic meant to lower the attack surface of any entity. It's the sort of thing you say publicly, but then privately you settle with your adversary. Absolutism is never a useful tactic.
- munificent 5y agoYes, but getting your opponent to believe you will take an absolute position is often the most useful tactic.
- kevincox 5y ago> Absolutism is never a useful tactic. That sounds pretty absolutest.
- henvic 5y agoTaxation works exactly like this. You might even want to establish an isolated society, but if you try, good luck dealing with the IRS.
- dilyevsky 5y agoI don’t think this mantra was ever anything more than a meme. LE always negotiate, this mantra is designed to just better their negotiating position
- smnrchrds 5y ago> because the society benefits That's the theory. But much like war on drugs or TSA, whether its real-world outcomes match the theoretical ones is debatable. https://www.newamerica.org/international-security/policy-papers/pay-ransom-or-not/ https://www.newamerica.org/international-security/policy-pap...
- formerly_proven 5y ago> “Never negotiate with terrorists” is a simple and clear mantra, and as most clear and simple concepts it hides a lot of assumptions. This has nothing to do with that idea. The reason the orgs paid the random once was because they had a severe lack of backup and other data safety protocols in combination with a vector to be infected (from all what we know, the latter is common and difficult to avoid): paying the ransom is likely their only choice to maintain the business. It is not surprising at all that these orgs can and will be infected again, and will continue to show a lack in the security and data safety departments, and so they will continue to pay ransoms. It's sort of an inverse survivorship bias: if you get infected once because you're susceptible, you're likely to get infected again unless you fix your susceptibility.
- thepete2 5y agoIt has from a certain angle: For society/the internet as a whole it might be better for no one to pay the ransom at the cost of some of them perishing. The ransomware attacks would become unprofitable and would eventually stop. But to assume any organization wouldn't pay the ransom if its survival depends on it is obviously unrealistic.
- kelnos 5y agoI think that mantra does work here. I would be totally fine with legislation making it illegal to pay in the case of ransomware attacks. Some companies might be completely destroyed by an attack that they can't pay off, but that is for the greater good of society: if criminals know companies have a low probability of paying since they're legally barred from doing so, they're less likely to target them.
- SamBam 5y agoWhen they hit a hospital, what is the hospital supposed to do? Not negotiate, for some "greater good" and let patients die? https://threatpost.com/ransomware-hits-hospitals-hardest/162096/ https://threatpost.com/ransomware-hits-hospitals-hardest/162...
- SwanRonson 5y agoThey’re supposed to back up their data and set up proper contingencies. By failing to do so, they are already putting patients lives in the hands of the encryptors.
- SamBam 5y agoYes. Of course they were supposed to do so, then. But they didn't, and now they've been hit. Now, in the real world, what are they supposed to do: pay, or hold out and let the patients die as punishment for the hospital's mistakes?
- kortilla 5y agoLet the patients die. That’s on the hackers hands, not the hospital. Additionally, you’re making a huge assumption that the hackers are willing to escalate themselves to mass murders, which is a big leap most criminals aren’t willing to take.
- squiggleblaz 5y ago> Of course they were supposed to do so, then. But they didn't, and now they've been hit. In order for this to be a useful tactic, there needs to be no defection. The only way there can be no defection is if the legislature prohibits defection. At that point, the hospital is on notice that they have to apply adequate security measures against this kind of attack. For instance, hospitals normally have power supplies that are capable of getting them through foreseeable blackouts. If they're going to rely on computer systems in the treatment of patients, they had better make sure they're secure. Right now, today, it isn't a surprise. And the hackers are on notice that they are effectively killing the patients. The hackers are after the money. If the threat of death will get them the money, they're all for it. If it won't, they'll move on to a country where it does work.
- notdang 5y agoUntil your own child or spouse is held hostage or sequestrated. You will negotiate.
- denton-scratch 5y ago"“Never negotiate with terrorists” is a simple and clear mantra, and as most clear and simple concepts it hides a lot of assumptions" The word 'terrorists', for one. It's mostly used to mean 'my opponents' these days. What we are facing with ransomware is not insurrectionists or protestors, but gangsters. They make their living by stealing from people, cheating them, and threatening them. Many insurrectionists are honourable people that you can safely make a deal with. There is no gangster with that property. Take backups, test the recovery procedure, don't make bargains with gangsters.
- kortilla 5y ago> who already screw the public day in day out And then everyone clapped at the high-brow analysis.
- Siira 5y agoIt’s not really about sacrificing people for the greater good. Negotiating has high externalities that include future murders. Like all externalities, the involved people don’t give a shit.