3 ms·

I wonder about whether governments could make it illegal to pay ransomware. If a business from country X could not legally pay, then what would be the point of

I wonder about whether governments could make it illegal to pay ransomware. If a business from country X could not legally pay, then what would be the point of attacking any company from country X?

deepsun 5y ago
I believe it's already illegal ("know your customer", maybe they are terrorists). But ransom payments are tax-deductible nevertheless.
- dekkerbasser 5y ago
  Ransom payments are tax-deductible? If true that is nuts! Do you have a source?
  - belter 5y ago
    "Hit by a cyberattack? Your ransom payment to hackers may be tax deductible." https://www.chicagotribune.com/business/ct-biz-ransomware-payment-tax-deductible-20210621-3kxuzw4xdzgtzb3hvhihro4z74-story.html https://www.chicagotribune.com/business/ct-biz-ransomware-pa...
- bee_rider 5y ago
  Lawfare has done a little on this. (Article) https://www.lawfareblog.com/ransomware-payments-and-law https://www.lawfareblog.com/ransomware-payments-and-law (Podcast) https://www.lawfareblog.com/lawfare-podcast-how-can-congress-take-ransomware-problem https://www.lawfareblog.com/lawfare-podcast-how-can-congress... The article is a bit long, but I think the most salient parts are: > Consider, for example, Section 2339(B) of the material support statute, which makes it a crime for a person to provide material support or resources to a designated foreign terrorist organization. [...] But, at its core, it’s a ban on the giving of something of value to a designated overseas group. There is no exception in the law for circumstances like ransoms, though nobody has ever been prosecuted for material support in a situation involving, say, a kidnapping or hostage taking. So if Hamas or Al-Qaeda got into the ransomware business, it would already be a crime to pay the ransom—though it’s not clear whether the government would ever use its enforcement discretion to bring such a case. > [big list of similar laws] > Each of the aforementioned authorities is a piece of a legal puzzle that allows the government to target individuals and organizations in certain contexts. But these authorities are generally not well suited to be effective against current ransomware payments in general. > Generally, most of these laws, like the FCPA, will not apply, because the offending party often has only a tenuous connection—or perhaps no connection at all—to a government official. Even if it does, a prosecutor would have to prove that the payer knew this, which seems improbable. It seems to fall into this weird gap where it isn't clear if it is more like paying a ransom, paying for an IT service, or more like paying a bribe to continue doing business.
maze-le 5y ago
Then the payment will be done by "underground payment processors" with a hefty extra fee. It wouldn't solve the problem I think, only shift the path an organization has to take.
- turk- 5y ago
  No it wouldn't, no executive at any company would risk federal time and money laundering charges if it was made illegal.
  - jascii 5y ago
    That's what throw-away shell companies are for...
  - dboreham 5y ago
    That's what Michael Cohen is for.
  - trenning 5y ago
    Ah yeah HSBC Bank would never...
unstatusthequo 5y ago
Partly already true. You can’t pay criminals in OFAC listed countries (https://sanctionssearch.ofac.treas.gov/ https://sanctionssearch.ofac.treas.gov/) Now, the issue becomes how do you know? And what happens when it’s your businesses existence vs breaking the law?
- whoknew1122 5y ago
  Break the law. Every time. The fines are minuscule, and you'll likely be able to settle with the government without actually admitting wrong doing. There's also no personal consequences for the decision makers. Corporate accountability is laughable. So just break the law, get your small little fine, accept no wrong doing, and move on.

I wonder about whether governments could make it illegal to pay ransomware. If a business from country X could not legally pay, then what would be the point of attacking any company from country X?

deepsun 5y ago

I believe it's already illegal ("know your customer", maybe they are terrorists). But ransom payments are tax-deductible nevertheless.

dekkerbasser 5y ago
Ransom payments are tax-deductible? If true that is nuts! Do you have a source?
- belter 5y ago
  "Hit by a cyberattack? Your ransom payment to hackers may be tax deductible." https://www.chicagotribune.com/business/ct-biz-ransomware-payment-tax-deductible-20210621-3kxuzw4xdzgtzb3hvhihro4z74-story.html https://www.chicagotribune.com/business/ct-biz-ransomware-pa...
bee_rider 5y ago
Lawfare has done a little on this. (Article) https://www.lawfareblog.com/ransomware-payments-and-law https://www.lawfareblog.com/ransomware-payments-and-law (Podcast) https://www.lawfareblog.com/lawfare-podcast-how-can-congress-take-ransomware-problem https://www.lawfareblog.com/lawfare-podcast-how-can-congress... The article is a bit long, but I think the most salient parts are: > Consider, for example, Section 2339(B) of the material support statute, which makes it a crime for a person to provide material support or resources to a designated foreign terrorist organization. [...] But, at its core, it’s a ban on the giving of something of value to a designated overseas group. There is no exception in the law for circumstances like ransoms, though nobody has ever been prosecuted for material support in a situation involving, say, a kidnapping or hostage taking. So if Hamas or Al-Qaeda got into the ransomware business, it would already be a crime to pay the ransom—though it’s not clear whether the government would ever use its enforcement discretion to bring such a case. > [big list of similar laws] > Each of the aforementioned authorities is a piece of a legal puzzle that allows the government to target individuals and organizations in certain contexts. But these authorities are generally not well suited to be effective against current ransomware payments in general. > Generally, most of these laws, like the FCPA, will not apply, because the offending party often has only a tenuous connection—or perhaps no connection at all—to a government official. Even if it does, a prosecutor would have to prove that the payer knew this, which seems improbable. It seems to fall into this weird gap where it isn't clear if it is more like paying a ransom, paying for an IT service, or more like paying a bribe to continue doing business.

maze-le 5y ago

Then the payment will be done by "underground payment processors" with a hefty extra fee. It wouldn't solve the problem I think, only shift the path an organization has to take.

turk- 5y ago
No it wouldn't, no executive at any company would risk federal time and money laundering charges if it was made illegal.
- jascii 5y ago
  That's what throw-away shell companies are for...
- dboreham 5y ago
  That's what Michael Cohen is for.
- trenning 5y ago
  Ah yeah HSBC Bank would never...

unstatusthequo 5y ago

Partly already true. You can’t pay criminals in OFAC listed countries (https://sanctionssearch.ofac.treas.gov/ https://sanctionssearch.ofac.treas.gov/) Now, the issue becomes how do you know? And what happens when it’s your businesses existence vs breaking the law?

whoknew1122 5y ago
Break the law. Every time. The fines are minuscule, and you'll likely be able to settle with the government without actually admitting wrong doing. There's also no personal consequences for the decision makers. Corporate accountability is laughable. So just break the law, get your small little fine, accept no wrong doing, and move on.