10 ms·
How is it even legal to pay ransoms? Surely this is transferring money to criminal enterprises. If it is not illegal it needs to be made illegal.
by ukoki 4y ago
How is it even legal to pay ransoms? Surely this is transferring money to criminal enterprises. If it is not illegal it needs to be made illegal.
- GalenErso 4y agoWhy would it not be legal? If I was a hacker, the existence of a law prohibiting businesses from paying cyber ransoms would not deter me. If a company wanted to follow the law and refused to pay the ransom the hackers asked of them, the hackers could follow through and delete or irreparably corrupt their files. The potential upside, that they pay the ransom, is significant, while the downside, that they don't, doesn't mean much. They'll just keep probing for targets. What are they gonna do? Arrest them? In all likelihood, they're hiding behind multiple VPNs, working from a virtual machine, from a country without an extradition treaty.
- poszlem 4y agoThe argument seems implausible as it assumes that hackers would persist in deleting data, whereas in reality, they would probably shift their focus to other targets such as private companies that lack similar prohibitions. It is unclear what incentive they would have to continue hacking public companies if they cannot profit from that?
- GalenErso 4y ago> It is unclear what incentive they would have to continue hacking public companies if they cannot profit from that. The intent would be to put pressure on national legislatures to repeal laws that make paying ransoms illegal. Smart ransomware groups don't care about targets that can't afford to pay. So any "inability" to pay is either the result of stubbornness or a law, both of which can change if enough pressure is applied. Of course, the solution is for businesses to harden their systems enough to resist these sorts of intrusion in the first place.
- bluGill 4y agoNote too that the threat of the law may be enough motivation to stop payment. Insurance in particular is already starting to look at how hardened your IT systems are as part of your coverage.
- vuln 4y agoCompany pays Cyber Insurance which contracts 3rd party in Panama/SA/Israel to pay the ransom and report back the decryption key. Completely legal.
- sodality2 4y agoIf paying ransoms become illegal in many countries, it would be very hard to find targets willing to break the law and pay ransom, making it less attractive of an attack.
- mytailorisrich 4y agoCompanies and people pay bribes all the time. But since it's illegal to it's kept secret.
- sodality2 4y agoTrue - but if it's made directly illegal it will still have some effect on the number of victims willing to. It won't solve it, of course.
- GalenErso 4y agoI don't think this is correct. There is very little cost, and risk, in conducting ransomware attacks. So even the odd chance of finding a target willing to break the law and pay up would be worth it. And in the long term, black hat groups could put pressure on national legislatures to amend the law by following through on their threats and deleting or releasing the files they've encrypted. One can imagine a not so far fetched scenario where entire industries are held hostage by a small group of anonymous individuals demanding to be paid or else, and legislatures capitulating and amending the law, because the alternative, to lose - lose, as in, complete bankruptcy - entire industries and corporations would be too costly in comparison. Black hats could even compel legislative changes by credibly threatening to compromise the personal data of politicians themselves.
- sodality2 4y agoI think this is a little far-fetched - I'd like to believe something (legislator comes clean, fed govt investigates more thoroughly as it is a direct threat to our democracy, etc) would stop that from happening. Worse has happened, though. I do believe that if the "market" for victims shrinks, naturally the number of ransomware attackers will shrink - sure, ransomware is "easy", but perhaps there's easier cybercrime to be committed with better odds. (I'm not sure how likely this is - I bet the ransomware scene is nowhere near saturated)
- ruined 4y agoit is. depends on jurisdiction, but if the ransoming organization is a sanctioned entity, it may be considered an illegal sanctions violation. for instance, the US OFAC has issued this statement warning companies to not pay ransoms: https://home.treasury.gov/system/files/126/ofac_ransomware_advisory_10012020_1.pdf https://home.treasury.gov/system/files/126/ofac_ransomware_a... royal mail is in the UK, but the UK has its own sanctions regime with similar penalties. edit: the UK OFSI has issued a similar warning this month https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1135587/Ransomware___Sanctions_guidance__Feb_2023_.pdf https://assets.publishing.service.gov.uk/government/uploads/...
- bena 4y agoShould we also make it illegal to get mugged? Make it a crime to be murdered? Making the payment of ransom illegal just means you never hear about ransoms again.
- bluGill 4y agoIn general you are allowed to do something illegal if your life is in danger. That is if I'm kidnapped I'm allowed to pay what is otherwise a bribe to go free. So we should make getting mugged illegal, so long as the law is clear that the illegal part only applies if you have a reasonable way to get away from the mugging without paying. I'm not sure how you can be mugged and yet have a reasonable way to get away without paying, I leave that question to the reader.
- bena 4y agoYou don't turn victims of crimes into criminals as well. This shouldn't need to be said.
- tshaddox 4y ago> I'm not sure how you can be mugged and yet have a reasonable way to get away without paying, I leave that question to the reader. What if you're skilled in hand to hand combat? Or what if you're familiar enough with firearms to notice the mugger's weapon looks fake? Would you then be legally required to attempt to fight back? Would a judge need to estimate your probability of dying, and if it was under some threshold you would be punished for not attempting to fight?
- yesco 4y agoWhile ridiculous, I bet it would probably result in less muggings...
- hyperman1 4y agoAs I understand it, it is indeed illegal in most countries. What happens in practice is the victim hires a 'data recovery specialist' company, provides them the encrypted files, and ask them to decrypt them with their magic algorithms. The data recovery specialist coincidentally is paid a little bit more than the ransom. The specialist then contacts the hackers, pays the ransom, decrypts the files, and provides them back to the victim. Specialist, victim and maybe also law enforcement do their utmost best not to ask/explain how exactly the files were decrypted, citing e.g. trade secrets or an accidental key leak in the malware. The data recovery specialist generally hires a contractor, who hires a contractor, who ... , so ransom money trail passes trough plenty of jurisdictions to darken the trail.
- deleted 4y ago[deleted]
- sefrost 4y agoAny sources on that?
- windthrown 4y agoCertainly not 100% of cases but very common: "As ransomware attacks crippled businesses and law enforcement agencies, two U.S. data recovery firms claimed to offer an ethical way out. Instead, they typically paid the ransom and charged victims extra." https://features.propublica.org/ransomware/ransomware-attack-data-recovery-firms-paying-hackers/ https://features.propublica.org/ransomware/ransomware-attack...
- charlieyu1 4y agoWhat if ransom is paid but the attackers do not fulfill their end?
- bee_rider 4y agoThis is possible of course, but it would reduce the willingness of people to pay bribes generally. Also I guess it might cause the victims to take more desperate measures, possibly get more attention by law enforcement somehow.
- paulpauper 4y agoSure, that would be fine if the govt. is willing to help cover the loss of business. This is not without precedent, like 2008 and 2021 bailouts.
- tshaddox 4y agoThat's weird. It's like saying it should be illegal to give your wallet to a mugger.
- californical 4y agoIt’s more like the mugger already has your wallet, but says they’ll give it back if you make a $1000 donation to their criminal organization, going around normal law enforcement. I’d guess that’s also illegal, but IANAL.
- bee_rider 4y agoIt is not very similar I think — in a mugging the “don’t pay” downside is violence, possible death. In a ransomware situation, the victim is basically making an economic decision — is the cost of losing their files greater than the cost of the ransom. The cost of dying is basically infinite, the cost of paying the ransom can be shifted up and down with fines until it is high enough to disincentivize paying.
- tshaddox 4y agoI don’t know. A mugger could make other threats too that aren’t direct bodily injury or death. It could be “pay me money or I’ll burn down your restaurant” (that’s more like a protection racket than a “mugging”). That’s pretty similar to the threat to one’s livelihood that many of these ransomware attacks constitute.
- bee_rider 4y agoYeah, that’s more of a protection racket. Mugging is essentially by definition backed by the threat of violence I’m pretty sure. Possibly a bluff of course!
- 908B64B197 4y agoIt's also orders of magnitude cheaper to just restore from backup. I can't imagine their S3 bill is above 80 millions...
- pc_edwin 4y agoThe prospect of a world in which victims are transformed into criminals is profoundly dystopian. Such laws run the risk of fostering a climate in which individuals frequently transgress established legal boundaries, with the authorities given free rein to target anyone they please on a whim. This would inevitably lead to a breakdown of the rule of law and a culture of lawlessness that would imperil the rights and liberties of all citizens.
- pc86 4y ago"Preventing large monetary transfers to organized crime inevitably leads to a culture of lawlessness and imperils all citizens" is certainly an interesting take, I'll give you that.
- pc_edwin 4y agoThe alternative is a moral/philosophical claim that there are no situations where dealing with organised crime is acceptable. This is patently absurd, as there exists not only situations where its reasonable but an imperative to deal with organised crime.
- muro 4y agoSuch as?
- pc_edwin 4y agoHackers gaining control of air traffic systems and threatening to shut them down or threatening to open dams during peak monsoon season? Hackers gaining control over the space station and not only threatening the lives of the crew but also threatening to send it back to earth targeting a high population area.