7 ms·
FBI held back ransomware decryption key to run operation targeting hackers
- encryptluks2 5y agoI trust our government's tech and hacking capabilities as much as I trust politicians to ensure that ISPs are held accountable for subsidies and grants.
- Darmody 5y agoI don't see why the FBI would have bad intentions here. Everyone in the US, including the FBI and the NSA have in their best interest a functioning economy without companies being ransomwared to death.
- meowface 5y agoIntentions don't necessarily correspond very much to outcomes.
- aqme28 5y agoThey didn't have bad intentions, but they might have mismatched incentives. An FBI agent wants to stop criminals and have a big bust more-so than they want to generally preserve the economy.
- AlexAndScripts 5y agoThey were trying to do both. The attackers weren't going to stop with Kaseya.
- anshorei 5y agoThe FBI's intentions are getting more funds. Seeming to be doing something useful is more important to that end than actually doing something useful, hence their colorful history of creating easy problems to fix and then solving them to great fanfare, particularly well-documented in the aftermath of 9/11. It's much safer to find mentally unstable people, surround them by undercover agents and get them to incriminate themselves than it is to go after actual criminals.
- roddux 5y agohttps://archive.is/K9JP3 https://archive.is/K9JP3
- AlexAndScripts 5y agoWorking to fix things in the long run. I don't see an issue here.
- aqme28 5y agoUnsuccessfully though. In the end this just added harm with no benefit.
- AlexAndScripts 5y agoYeah, and that's a shame. Hindsight is 20/20. At the end of the day though, they couldn't have known that would happen, and they made the right choice. The Kaseya hack was terrible - they were trying to stop that happening again.
- aqme28 5y ago> they made the right choice You can't say that definitively. It seems unethical and incorrect to me.
- superjan 5y agoThey had to make the choice with the info available at that time. And exposing and prosecuting ransomware criminals could help to prevent future cases: The perpetrators are techies who are not street thugs, they could make money with legit work.
- aqme28 5y agoI agree with everything you wrote, but I don't see how any of it proves that they made the "correct decision."
- AlexAndScripts 5y agoI suppose its subjective. In my opinion their job is to protect a whole nation (and, on a larger scale, the West)'s interests in the long run. If that means delaying the release of encryption keys in order to prevent future attacks, I think that's a worthy tradeoff. And even if the tradeoff didn't end up worth it (due to no fault of their own), their actions at the time were in my opinion entirely reasonable.
- acatton 5y agoRelated: the video "Why The Cops Won't Help You When You're Getting Stabbed" https://www.youtube.com/watch?v=jAfUI_hETy0 https://www.youtube.com/watch?v=jAfUI_hETy0 TL;DW: In the US, the police owes you no protection. See https://en.wikipedia.org/wiki/Town_of_Castle_Rock_v._Gonzales https://en.wikipedia.org/wiki/Town_of_Castle_Rock_v._Gonzale...
- cm2187 5y agoor rather, why you can't sue them if they fail to protect you, which is slightly different. It is still their role to protect you. Kind of like it is a doctor's role to try to cure you but you can't sue the doctor if they don't succeed.
- WitCanStain 5y agoCan you sue a doctor if they don't try?
- deleted 5y ago[deleted]
- cm2187 5y agoGrey zone. You can't sue them because they haven't tried all the experimental treatments known. You probably can't even sue them if it is a misdiagnosis, unless it was egregious. The police equivalent is that you don't expect them to be able to intercept every bullet fired everywhere. Particular if it is a the risk of their own lives.
- unyttigfjelltol 5y agoEh, in the US if a doctor does like none of her peers and fails to cure you, yes, doctors do get sued. The point of the video was police as a fraternity don't have any obligation to protect you, personally, absent special circumstances. Which, when you get down to it is sort of like doctors-- if I have a heart attack across the street from a hospital, you know, I'd appreciate them trying to save me but unless there is some special circumstance I'm not confident they're required to.
- aqme28 5y agoI don't like this. To analogize this to a medical problem-- it would be severely unethical for a doctor to withhold proven treatment in order to study the course of a disease. The FBI shouldn't continue to victimize for a (failed) chance at stopping the perpetrators.
- carlmcqueen 5y agohttps://www.cdc.gov/tuskegee/timeline.htm https://www.cdc.gov/tuskegee/timeline.htm Which has been done before.
- boomboomsubban 5y agoIt's worse than the analogy as in this case the "disease" clearly noticed it was being studied, which could have had catastrophic results and leave the disease better at hiding in the future.
- analogdreams 5y agoI think it's fair to argue we are seeing this in real time right now around Covid and refusals by certain hospital systems to even let people try something like Ivermectin or other off label drugs.
- LocalH 5y agoThis is SOP for the FBI. They've also gotten caught leaving a CSAM distribution network running after gaining control of it, for the same reason.
- sschueller 5y agoGreat but if I actively held something like that back I would probably be procecuted as an accomplice.
- spicybright 5y agoThe FBI doing secret projects without understanding the technology behind them? *shocked pikachu meme*
- AlexAndScripts 5y agoNo, as it says in the article, they understood the tech entirely. There is just a trolley-problem-esque debate about whether withholding the key to stop future attacks was worth it.
- rank0 5y agoI am not sure I see a huge issue here. The FBI does similar things when investigating any other criminal enterprise. Sometimes it's difficult to weigh the short term benefit against a potentially larger longer term benefit.