6 ms·

Stepping up enforcement fails all the time. If you want ransomware to stop being effective, make it illegal to pay the ransom.

snapetom 5y ago
I would have loved to have seen what would have happened to the East Coast of the US if Colonial wasn't allowed to pay ransomware, or the various beef suppliers in the Americas if they weren't allowed to pay. Making it illegal to pay just isn't feasible for practical business purposes.
- toast0 5y ago
  I imagine, Colonial would have restarted the pipeline without billing and figure it out later. Probably similar for beef suppliers, although I didn't read any media about what systems were impacted there. Assuming some of the labelling or other food safety things were impacted, you would need an FDA waiver of some sort.
GilbertErik 5y ago
The main argument against making ransom payments illegal is that it simply drives ransom payments underground. Legislating something, similar to vices like drugs, alcohol or gambling, doesn't make it go away.
- a1369209993 5y ago
  I assume they mean make it illegal for corporations to pay the ransom. It's obviously unjust and ineffective to punish private individuals for paying ransoms, but that's not where the money is. OTOH, corporations have budgets and can be prosecuted if X millions dollars disappears out of it.
  - hcurtiss 5y ago
    I don’t view it as obviously unjust as applied to individuals. That may suck for that person, but turning off the revenue demands substantially reduces the odds others are subject to ransoms. If all you do is focus on the individual case, you never actually address the root cause.
- hcurtiss 5y ago
  If you make it a felony to pay ransoms (which I strongly support), there will be far fewer ransom demands. Yes, some of it will go underground, but in my view it’s the only way to actually decrease the demand side of the equation.
  - arrozconcosas 5y ago
    How will you know if the total amount of ransom payments goes down? How will you know how much is under the table vs over the table? This argument seems to be "the over the table stuff goes down therefore the total goes down" which is faulty logic.
    - scoopertrooper 5y ago
      It would follow logically that it'd go down. It's like saying making murder illegal would only push murder under the table. A company currently performs a simple mathematical equation when deciding to pay a ransom. Does the reputational and financial cost of not paying the ransom outweigh the price of the ransom? In a world where ransom payments were illegal, then those same companies would also have to include the legal penalties and probability of being caught as part of that equation. Obviously, some companies would still see a net benefit in paying the ransom, but fewer would, so less ransoms would be paid. It seems to me like you're trying to use 'war on drugs' logic on ransoms. The key difference is that companies don't want to pay ransoms, but do so out of necessity.
    - addingnumbers 5y ago
      Reducing the growth rate of a subset of a total does reduce the growth rate of that total.
  - true_religion 5y ago
    Sure, but what you’ll end up with is that the fewer people who still do it while is illegal are those in the most desperate and sympathetic sounding straits. It’s like prostitution, if it’s illegal you find that most sex workers are the most vulnerable in society. When it’s not, sex workers can be anyone who doesn’t want to drive 6 hours for Uber on the weekend for extra cash.
- spywaregorilla 5y ago
  Make hiding ransomware attacks a criminal offense mandatory and offer whistleblower programs to companies that try to conceal it. This is an issue of national security. Individual alcohol problems are irrelevant and not comparable to large corporations.
  - weego 5y ago
    And then you've just created a chain of legislation with the associated loopholes and confusion which will allow corporations to hide and deny any of it happening and then using legal fog to stonewall any Govt investigations and force people to risk their careers to call it out. Forcing people to be whistle blowers is not a scalable enforcement plan. Very few people are willing to be one. We need to legislate with the goal of corporate transparency not for more hidden behavior.
breakfastduck 5y ago
Punish the victim not the perpetrator, nice.
- fouric 5y ago
  Nobody is even suggesting that the perpetrator shouldn't continue to be punished (when caught).
pgeorgi 5y ago
Make insecure software the problem of its producer, so that except for gross negligence by the user, the software vendor is on the hook (reimbursing customers) and will want to prevent ransomware from being a thing in the first place.
- RNCTX 5y ago
  Bingo. It's high comedy to me that 90+% of ransomware is targeted at Windows, and yet beyond the year 2020 you can still find corporate-speak in the wild that all basically boils down to a hare-brained assumption that the corporate vendor will in some way be liable if the customer suffers a breach. When in fact the largest of software vendors sits in plain sight, obviously liable for poor designs that invite these breaches, and no one has held them to account for it.
  - spywaregorilla 5y ago
    What percent of ransomware on windows is driven by software vulnerabilities rather than careless users?
    - RNCTX 5y ago
      All of it, because Windows is closed source. A user cannot be responsible for a black box's contents.
- mschuster91 5y ago
  Even the most secure piece of software - assuming such a thing even exists! - can't do a thing against incompetent users. Even a perfectly patched Windows instance can't be reasonably protected against an user executing an attachment of an email that then goes ahead and encrypts all files writable by the user. The only option is to ban the user from anything executable and interpreters as Apple does on their iDevices, but we all rightfully and regularly complain about that one. As for vulnerable software: I agree, some pressure on Microsoft to open-source or at least provably audit their software would be nice - but it's rare to have a definitive attribution on how a piece of malware entered your organization, at least not in places where record-keeping and retention is restricted by laws like the GDPR.
codegeek 5y ago
That's like saying "make it illegal to get robbed". If I have a robber with a gun to my head asking for my wallet, I would comply. I wouldn't tell them sorry it is illegal to give you my wallet. You should not penalize the victim. Crack down on perps, not victims please.
- elondaits 5y ago
  Also, there are middle-man "security companies" that you can pay to "help you decrypt your files" and what they do is simply pay the ransom under the table for you... So you can't really tell if a company paid the ransom or not.
  - snapetom 5y ago
    Yep. It's like governments that forbid use of things like facial recognition software by its police departments. Sure, the police department doesn't use facial recognition, but they commonly work around this by using a vendor that may or may not use facial recognition. This model is actually commonly employed by both companies and that are forbidden to do something.
  - Enginerrrd 5y ago
    You can also make it illegal to seek assistance from an out-of-jurisdiction middle-man. Thus, any middle men are going to be subject to the same regulations.
- spywaregorilla 5y ago
  No those are not similar cases. Yours is urgent, violent, tiny scale, and individual level. The individual doesn't have any agency in this situation. The alternative is get shot and robbed. If a corporation is unable to pay a ransom then the incentive to do the ransomware attack immediately drops. Cracking down on perps would be nice, but is not feasible.
  - nindalf 5y ago
    No. I can’t believe this needs to be explained, but the two situations are remarkably alike. If all of a corporations data is being held to ransom, there is no choice in the matter, they must pay. You’re talking like losing all their customers or IP or shutting down the corporation wouldn’t hurt anyone but it would hurt all their employees at the least. What such an idiotic, short sighted policy would do is to encourage corporations to pay the ransom in secret. This only strengthens the hackers because now law enforcement has no idea who is being hit, when, and with what malware.
sdenton4 5y ago
The other approach is to remove the transaction system. Make bitcoin trivially traceable (or drive it out of existence entirely) and it becomes much more difficult to handle the ransom payments, and thus, to profit from the operation.
arcticbull 5y ago
And make it illegal to purchase the tokens they use to make the payments.

snapetom 5y ago

I would have loved to have seen what would have happened to the East Coast of the US if Colonial wasn't allowed to pay ransomware, or the various beef suppliers in the Americas if they weren't allowed to pay. Making it illegal to pay just isn't feasible for practical business purposes.

toast0 5y ago
I imagine, Colonial would have restarted the pipeline without billing and figure it out later. Probably similar for beef suppliers, although I didn't read any media about what systems were impacted there. Assuming some of the labelling or other food safety things were impacted, you would need an FDA waiver of some sort.

GilbertErik 5y ago

The main argument against making ransom payments illegal is that it simply drives ransom payments underground. Legislating something, similar to vices like drugs, alcohol or gambling, doesn't make it go away.

a1369209993 5y ago
I assume they mean make it illegal for corporations to pay the ransom. It's obviously unjust and ineffective to punish private individuals for paying ransoms, but that's not where the money is. OTOH, corporations have budgets and can be prosecuted if X millions dollars disappears out of it.
- hcurtiss 5y ago
  I don’t view it as obviously unjust as applied to individuals. That may suck for that person, but turning off the revenue demands substantially reduces the odds others are subject to ransoms. If all you do is focus on the individual case, you never actually address the root cause.
hcurtiss 5y ago
If you make it a felony to pay ransoms (which I strongly support), there will be far fewer ransom demands. Yes, some of it will go underground, but in my view it’s the only way to actually decrease the demand side of the equation.
- arrozconcosas 5y ago
  How will you know if the total amount of ransom payments goes down? How will you know how much is under the table vs over the table? This argument seems to be "the over the table stuff goes down therefore the total goes down" which is faulty logic.
  - scoopertrooper 5y ago
    It would follow logically that it'd go down. It's like saying making murder illegal would only push murder under the table. A company currently performs a simple mathematical equation when deciding to pay a ransom. Does the reputational and financial cost of not paying the ransom outweigh the price of the ransom? In a world where ransom payments were illegal, then those same companies would also have to include the legal penalties and probability of being caught as part of that equation. Obviously, some companies would still see a net benefit in paying the ransom, but fewer would, so less ransoms would be paid. It seems to me like you're trying to use 'war on drugs' logic on ransoms. The key difference is that companies don't want to pay ransoms, but do so out of necessity.
  - addingnumbers 5y ago
    Reducing the growth rate of a subset of a total does reduce the growth rate of that total.
- true_religion 5y ago
  Sure, but what you’ll end up with is that the fewer people who still do it while is illegal are those in the most desperate and sympathetic sounding straits. It’s like prostitution, if it’s illegal you find that most sex workers are the most vulnerable in society. When it’s not, sex workers can be anyone who doesn’t want to drive 6 hours for Uber on the weekend for extra cash.
spywaregorilla 5y ago
Make hiding ransomware attacks a criminal offense mandatory and offer whistleblower programs to companies that try to conceal it. This is an issue of national security. Individual alcohol problems are irrelevant and not comparable to large corporations.
- weego 5y ago
  And then you've just created a chain of legislation with the associated loopholes and confusion which will allow corporations to hide and deny any of it happening and then using legal fog to stonewall any Govt investigations and force people to risk their careers to call it out. Forcing people to be whistle blowers is not a scalable enforcement plan. Very few people are willing to be one. We need to legislate with the goal of corporate transparency not for more hidden behavior.

breakfastduck 5y ago

Punish the victim not the perpetrator, nice.

fouric 5y ago
Nobody is even suggesting that the perpetrator shouldn't continue to be punished (when caught).

pgeorgi 5y ago

Make insecure software the problem of its producer, so that except for gross negligence by the user, the software vendor is on the hook (reimbursing customers) and will want to prevent ransomware from being a thing in the first place.

RNCTX 5y ago
Bingo. It's high comedy to me that 90+% of ransomware is targeted at Windows, and yet beyond the year 2020 you can still find corporate-speak in the wild that all basically boils down to a hare-brained assumption that the corporate vendor will in some way be liable if the customer suffers a breach. When in fact the largest of software vendors sits in plain sight, obviously liable for poor designs that invite these breaches, and no one has held them to account for it.
- spywaregorilla 5y ago
  What percent of ransomware on windows is driven by software vulnerabilities rather than careless users?
  - RNCTX 5y ago
    All of it, because Windows is closed source. A user cannot be responsible for a black box's contents.
mschuster91 5y ago
Even the most secure piece of software - assuming such a thing even exists! - can't do a thing against incompetent users. Even a perfectly patched Windows instance can't be reasonably protected against an user executing an attachment of an email that then goes ahead and encrypts all files writable by the user. The only option is to ban the user from anything executable and interpreters as Apple does on their iDevices, but we all rightfully and regularly complain about that one. As for vulnerable software: I agree, some pressure on Microsoft to open-source or at least provably audit their software would be nice - but it's rare to have a definitive attribution on how a piece of malware entered your organization, at least not in places where record-keeping and retention is restricted by laws like the GDPR.

codegeek 5y ago

That's like saying "make it illegal to get robbed". If I have a robber with a gun to my head asking for my wallet, I would comply. I wouldn't tell them sorry it is illegal to give you my wallet. You should not penalize the victim. Crack down on perps, not victims please.

elondaits 5y ago
Also, there are middle-man "security companies" that you can pay to "help you decrypt your files" and what they do is simply pay the ransom under the table for you... So you can't really tell if a company paid the ransom or not.
- snapetom 5y ago
  Yep. It's like governments that forbid use of things like facial recognition software by its police departments. Sure, the police department doesn't use facial recognition, but they commonly work around this by using a vendor that may or may not use facial recognition. This model is actually commonly employed by both companies and that are forbidden to do something.
- Enginerrrd 5y ago
  You can also make it illegal to seek assistance from an out-of-jurisdiction middle-man. Thus, any middle men are going to be subject to the same regulations.
spywaregorilla 5y ago
No those are not similar cases. Yours is urgent, violent, tiny scale, and individual level. The individual doesn't have any agency in this situation. The alternative is get shot and robbed. If a corporation is unable to pay a ransom then the incentive to do the ransomware attack immediately drops. Cracking down on perps would be nice, but is not feasible.
- nindalf 5y ago
  No. I can’t believe this needs to be explained, but the two situations are remarkably alike. If all of a corporations data is being held to ransom, there is no choice in the matter, they must pay. You’re talking like losing all their customers or IP or shutting down the corporation wouldn’t hurt anyone but it would hurt all their employees at the least. What such an idiotic, short sighted policy would do is to encourage corporations to pay the ransom in secret. This only strengthens the hackers because now law enforcement has no idea who is being hit, when, and with what malware.

sdenton4 5y ago

The other approach is to remove the transaction system. Make bitcoin trivially traceable (or drive it out of existence entirely) and it becomes much more difficult to handle the ransom payments, and thus, to profit from the operation.

arcticbull 5y ago

And make it illegal to purchase the tokens they use to make the payments.