5 ms·

Why would it not be legal? If I was a hacker, the existence of a law prohibiting businesses from paying cyber ransoms would not deter me. If a company wanted to

Why would it not be legal? If I was a hacker, the existence of a law prohibiting businesses from paying cyber ransoms would not deter me. If a company wanted to follow the law and refused to pay the ransom the hackers asked of them, the hackers could follow through and delete or irreparably corrupt their files. The potential upside, that they pay the ransom, is significant, while the downside, that they don't, doesn't mean much. They'll just keep probing for targets. What are they gonna do? Arrest them? In all likelihood, they're hiding behind multiple VPNs, working from a virtual machine, from a country without an extradition treaty.

poszlem 4y ago
The argument seems implausible as it assumes that hackers would persist in deleting data, whereas in reality, they would probably shift their focus to other targets such as private companies that lack similar prohibitions. It is unclear what incentive they would have to continue hacking public companies if they cannot profit from that?
- GalenErso 4y ago
  > It is unclear what incentive they would have to continue hacking public companies if they cannot profit from that. The intent would be to put pressure on national legislatures to repeal laws that make paying ransoms illegal. Smart ransomware groups don't care about targets that can't afford to pay. So any "inability" to pay is either the result of stubbornness or a law, both of which can change if enough pressure is applied. Of course, the solution is for businesses to harden their systems enough to resist these sorts of intrusion in the first place.
  - bluGill 4y ago
    Note too that the threat of the law may be enough motivation to stop payment. Insurance in particular is already starting to look at how hardened your IT systems are as part of your coverage.
  - vuln 4y ago
    Company pays Cyber Insurance which contracts 3rd party in Panama/SA/Israel to pay the ransom and report back the decryption key. Completely legal.
sodality2 4y ago
If paying ransoms become illegal in many countries, it would be very hard to find targets willing to break the law and pay ransom, making it less attractive of an attack.
- mytailorisrich 4y ago
  Companies and people pay bribes all the time. But since it's illegal to it's kept secret.
  - sodality2 4y ago
    True - but if it's made directly illegal it will still have some effect on the number of victims willing to. It won't solve it, of course.
- GalenErso 4y ago
  I don't think this is correct. There is very little cost, and risk, in conducting ransomware attacks. So even the odd chance of finding a target willing to break the law and pay up would be worth it. And in the long term, black hat groups could put pressure on national legislatures to amend the law by following through on their threats and deleting or releasing the files they've encrypted. One can imagine a not so far fetched scenario where entire industries are held hostage by a small group of anonymous individuals demanding to be paid or else, and legislatures capitulating and amending the law, because the alternative, to lose - lose, as in, complete bankruptcy - entire industries and corporations would be too costly in comparison. Black hats could even compel legislative changes by credibly threatening to compromise the personal data of politicians themselves.
  - sodality2 4y ago
    I think this is a little far-fetched - I'd like to believe something (legislator comes clean, fed govt investigates more thoroughly as it is a direct threat to our democracy, etc) would stop that from happening. Worse has happened, though. I do believe that if the "market" for victims shrinks, naturally the number of ransomware attackers will shrink - sure, ransomware is "easy", but perhaps there's easier cybercrime to be committed with better odds. (I'm not sure how likely this is - I bet the ransomware scene is nowhere near saturated)

poszlem 4y ago

The argument seems implausible as it assumes that hackers would persist in deleting data, whereas in reality, they would probably shift their focus to other targets such as private companies that lack similar prohibitions. It is unclear what incentive they would have to continue hacking public companies if they cannot profit from that?

GalenErso 4y ago
> It is unclear what incentive they would have to continue hacking public companies if they cannot profit from that. The intent would be to put pressure on national legislatures to repeal laws that make paying ransoms illegal. Smart ransomware groups don't care about targets that can't afford to pay. So any "inability" to pay is either the result of stubbornness or a law, both of which can change if enough pressure is applied. Of course, the solution is for businesses to harden their systems enough to resist these sorts of intrusion in the first place.
- bluGill 4y ago
  Note too that the threat of the law may be enough motivation to stop payment. Insurance in particular is already starting to look at how hardened your IT systems are as part of your coverage.
- vuln 4y ago
  Company pays Cyber Insurance which contracts 3rd party in Panama/SA/Israel to pay the ransom and report back the decryption key. Completely legal.

sodality2 4y ago

If paying ransoms become illegal in many countries, it would be very hard to find targets willing to break the law and pay ransom, making it less attractive of an attack.

mytailorisrich 4y ago
Companies and people pay bribes all the time. But since it's illegal to it's kept secret.
- sodality2 4y ago
  True - but if it's made directly illegal it will still have some effect on the number of victims willing to. It won't solve it, of course.
GalenErso 4y ago
I don't think this is correct. There is very little cost, and risk, in conducting ransomware attacks. So even the odd chance of finding a target willing to break the law and pay up would be worth it. And in the long term, black hat groups could put pressure on national legislatures to amend the law by following through on their threats and deleting or releasing the files they've encrypted. One can imagine a not so far fetched scenario where entire industries are held hostage by a small group of anonymous individuals demanding to be paid or else, and legislatures capitulating and amending the law, because the alternative, to lose - lose, as in, complete bankruptcy - entire industries and corporations would be too costly in comparison. Black hats could even compel legislative changes by credibly threatening to compromise the personal data of politicians themselves.
- sodality2 4y ago
  I think this is a little far-fetched - I'd like to believe something (legislator comes clean, fed govt investigates more thoroughly as it is a direct threat to our democracy, etc) would stop that from happening. Worse has happened, though. I do believe that if the "market" for victims shrinks, naturally the number of ransomware attackers will shrink - sure, ransomware is "easy", but perhaps there's easier cybercrime to be committed with better odds. (I'm not sure how likely this is - I bet the ransomware scene is nowhere near saturated)