3 ms·

If paying ransoms become illegal in many countries, it would be very hard to find targets willing to break the law and pay ransom, making it less attractive of

If paying ransoms become illegal in many countries, it would be very hard to find targets willing to break the law and pay ransom, making it less attractive of an attack.

mytailorisrich 4y ago
Companies and people pay bribes all the time. But since it's illegal to it's kept secret.
- sodality2 4y ago
  True - but if it's made directly illegal it will still have some effect on the number of victims willing to. It won't solve it, of course.
GalenErso 4y ago
I don't think this is correct. There is very little cost, and risk, in conducting ransomware attacks. So even the odd chance of finding a target willing to break the law and pay up would be worth it. And in the long term, black hat groups could put pressure on national legislatures to amend the law by following through on their threats and deleting or releasing the files they've encrypted. One can imagine a not so far fetched scenario where entire industries are held hostage by a small group of anonymous individuals demanding to be paid or else, and legislatures capitulating and amending the law, because the alternative, to lose - lose, as in, complete bankruptcy - entire industries and corporations would be too costly in comparison. Black hats could even compel legislative changes by credibly threatening to compromise the personal data of politicians themselves.
- sodality2 4y ago
  I think this is a little far-fetched - I'd like to believe something (legislator comes clean, fed govt investigates more thoroughly as it is a direct threat to our democracy, etc) would stop that from happening. Worse has happened, though. I do believe that if the "market" for victims shrinks, naturally the number of ransomware attackers will shrink - sure, ransomware is "easy", but perhaps there's easier cybercrime to be committed with better odds. (I'm not sure how likely this is - I bet the ransomware scene is nowhere near saturated)
tshaddox 4y ago
Surely it would still depend on the normal economic calculations of the involved parties, like the penalty for paying a random, the likelihood of getting caught paying a ransom, and all the existing calculations like the value of the data to the victim, the penalty and risk of getting caught for the ransomers themselves, etc. You don't just get to say "making it illegal will destroy the incentive to do it," and if it doesn't work you can't just keep increasing the legal penalties until it starts working.
- bee_rider 4y ago
  This is true. It is a financial decision. The costs options are: * pay enough in IT to run an up to date, secure system * pay enough in ransom to get your files * eat the cost of losing your files Adding a possible fine to the middle one means the cost of the top and bottom ones can be higher. Either non-paying option makes the business of running ransomware schemes less viable.

If paying ransoms become illegal in many countries, it would be very hard to find targets willing to break the law and pay ransom, making it less attractive of an attack.

mytailorisrich 4y ago

Companies and people pay bribes all the time. But since it's illegal to it's kept secret.

sodality2 4y ago
True - but if it's made directly illegal it will still have some effect on the number of victims willing to. It won't solve it, of course.

GalenErso 4y ago

I don't think this is correct. There is very little cost, and risk, in conducting ransomware attacks. So even the odd chance of finding a target willing to break the law and pay up would be worth it. And in the long term, black hat groups could put pressure on national legislatures to amend the law by following through on their threats and deleting or releasing the files they've encrypted. One can imagine a not so far fetched scenario where entire industries are held hostage by a small group of anonymous individuals demanding to be paid or else, and legislatures capitulating and amending the law, because the alternative, to lose - lose, as in, complete bankruptcy - entire industries and corporations would be too costly in comparison. Black hats could even compel legislative changes by credibly threatening to compromise the personal data of politicians themselves.

sodality2 4y ago
I think this is a little far-fetched - I'd like to believe something (legislator comes clean, fed govt investigates more thoroughly as it is a direct threat to our democracy, etc) would stop that from happening. Worse has happened, though. I do believe that if the "market" for victims shrinks, naturally the number of ransomware attackers will shrink - sure, ransomware is "easy", but perhaps there's easier cybercrime to be committed with better odds. (I'm not sure how likely this is - I bet the ransomware scene is nowhere near saturated)

tshaddox 4y ago

Surely it would still depend on the normal economic calculations of the involved parties, like the penalty for paying a random, the likelihood of getting caught paying a ransom, and all the existing calculations like the value of the data to the victim, the penalty and risk of getting caught for the ransomers themselves, etc. You don't just get to say "making it illegal will destroy the incentive to do it," and if it doesn't work you can't just keep increasing the legal penalties until it starts working.

bee_rider 4y ago
This is true. It is a financial decision. The costs options are: * pay enough in IT to run an up to date, secure system * pay enough in ransom to get your files * eat the cost of losing your files Adding a possible fine to the middle one means the cost of the top and bottom ones can be higher. Either non-paying option makes the business of running ransomware schemes less viable.