4 ms·

One possible solution to such problems is to prohibit paying ransom by law. Hackers can still be destructive, but at least they will have less incentive to part

One possible solution to such problems is to prohibit paying ransom by law. Hackers can still be destructive, but at least they will have less incentive to participate in such activities.

SamReidHughes 5y ago
Another option is to add a 900% tax on ransom payments, owed by the payer. It would either lower the price of ransoms or get less of them paid. I don't know why that would be better than prohibition, but it would be funnier.
- afterburner 5y ago
  It wouldn't be funnier, it would have the exact same effect as a prohibition law.
- ipython 5y ago
  Unfortunately it looks like the exact opposite is occurring: https://apnews.com/article/technology-business-government-and-politics-d8c1e9958ad1e89eab83f44e6ca70a94 https://apnews.com/article/technology-business-government-an... The regularity of ransomware has apparently made the expense “ordinary” therefore now tax deductible. Shrug.
  - SilverRed 5y ago
    Wouldn't other types of crime like theft or damaged windows be the same?
qbasic_forever 5y ago
Companies get around that by hiring a security 'consultant' or other firm to pay the ransom. Conveniently the cost of the consultant is exactly the ransom. It's enough legal cover for the company to release statements like "XYZ corp is not negotiating or paying the ransom."
- narism 5y ago
  Assuming paying ransoms were illegal[0], arranging for another party to pay it (commit an illegal act) would be an act of conspiracy. [0] already being signaled: https://www.reuters.com/article/us-treasury-cyber-idUSKBN26M77U https://www.reuters.com/article/us-treasury-cyber-idUSKBN26M...
- xmprt 5y ago
  Sounds like there's an easy solution to that. Just don't allow ransom payments to be tax deductible.
- asteroidbelt 5y ago
  Then consultants go to jail. And if these consultants are in China or some other country, then the law can be formulated in a way someone should go to jail. Top managers will deny everything, but FBI will start investigations, the will be a whistleblower, and eventually FBI will offer a deal to some middle manager to testify in court that top managers knew that "consultants" were actually hackers. This will be enough to greatly discourage stakeholders to participate in paying to these consultants even indirectly. Maybe it won't work perfectly, but at least it will make paying more risky, more expensive, thus less often. Sanctions work the same way. You can't deal with a company who is under sanctions, and if you try to use some intermediary to get around sanctions, you can still be fined at least.
  - slver 5y ago
    > Then consultants go to jail. Because they'll just call 911 and say "I just paid ransom under cover"? You know this is why incompetent lawmakers terrify me. They believe they can just be "tough" and everyone just falls in line instead of trying the infinite loopholes you leave open, each of which is a better outcome for them than the draconian path drawn by the law in spirit. If you make payment illegal, not only you're punishing the victim, you're adding a STRONG INCENTIVE for them to keep the whole thing a SECRET. You're shooting your own foot.
    - asteroidbelt 5y ago
risyachka 5y ago
I'd argue that a far better solution is improving security requirements and developing better procedures. Hacks in many ways incentivize companies to invest in their security. Also, if you prohibit paying ransom nothing will probably change. Hackers will continue to steal data, they will just sell it like they always did. Sure they will target now companies that have more valuable data, but the big picture won't change.
slver 5y ago
> One possible solution to such problems is to prohibit paying ransom by law. Hackers can still be destructive, but at least they will have less incentive to participate in such activities. One possible solution to rape is that women walk around with a bomb and if someone tries to rape them they kill themselves and the attacker. Rapists can still be destructive, but at least they will have less incentive to participate in such activities.

One possible solution to such problems is to prohibit paying ransom by law. Hackers can still be destructive, but at least they will have less incentive to participate in such activities.

SamReidHughes 5y ago

Another option is to add a 900% tax on ransom payments, owed by the payer. It would either lower the price of ransoms or get less of them paid. I don't know why that would be better than prohibition, but it would be funnier.

afterburner 5y ago
It wouldn't be funnier, it would have the exact same effect as a prohibition law.
ipython 5y ago
Unfortunately it looks like the exact opposite is occurring: https://apnews.com/article/technology-business-government-and-politics-d8c1e9958ad1e89eab83f44e6ca70a94 https://apnews.com/article/technology-business-government-an... The regularity of ransomware has apparently made the expense “ordinary” therefore now tax deductible. Shrug.
- SilverRed 5y ago
  Wouldn't other types of crime like theft or damaged windows be the same?

qbasic_forever 5y ago

Companies get around that by hiring a security 'consultant' or other firm to pay the ransom. Conveniently the cost of the consultant is exactly the ransom. It's enough legal cover for the company to release statements like "XYZ corp is not negotiating or paying the ransom."

narism 5y ago
Assuming paying ransoms were illegal[0], arranging for another party to pay it (commit an illegal act) would be an act of conspiracy. [0] already being signaled: https://www.reuters.com/article/us-treasury-cyber-idUSKBN26M77U https://www.reuters.com/article/us-treasury-cyber-idUSKBN26M...
xmprt 5y ago
Sounds like there's an easy solution to that. Just don't allow ransom payments to be tax deductible.
asteroidbelt 5y ago
Then consultants go to jail. And if these consultants are in China or some other country, then the law can be formulated in a way someone should go to jail. Top managers will deny everything, but FBI will start investigations, the will be a whistleblower, and eventually FBI will offer a deal to some middle manager to testify in court that top managers knew that "consultants" were actually hackers. This will be enough to greatly discourage stakeholders to participate in paying to these consultants even indirectly. Maybe it won't work perfectly, but at least it will make paying more risky, more expensive, thus less often. Sanctions work the same way. You can't deal with a company who is under sanctions, and if you try to use some intermediary to get around sanctions, you can still be fined at least.
- slver 5y ago
  > Then consultants go to jail. Because they'll just call 911 and say "I just paid ransom under cover"? You know this is why incompetent lawmakers terrify me. They believe they can just be "tough" and everyone just falls in line instead of trying the infinite loopholes you leave open, each of which is a better outcome for them than the draconian path drawn by the law in spirit. If you make payment illegal, not only you're punishing the victim, you're adding a STRONG INCENTIVE for them to keep the whole thing a SECRET. You're shooting your own foot.
  - asteroidbelt 5y ago

risyachka 5y ago

I'd argue that a far better solution is improving security requirements and developing better procedures. Hacks in many ways incentivize companies to invest in their security. Also, if you prohibit paying ransom nothing will probably change. Hackers will continue to steal data, they will just sell it like they always did. Sure they will target now companies that have more valuable data, but the big picture won't change.

slver 5y ago

> One possible solution to such problems is to prohibit paying ransom by law. Hackers can still be destructive, but at least they will have less incentive to participate in such activities. One possible solution to rape is that women walk around with a bomb and if someone tries to rape them they kill themselves and the attacker. Rapists can still be destructive, but at least they will have less incentive to participate in such activities.