4 ms·

Apart from leaks harming the privacy of customers, paying ransoms does social harm by providing an income and incentive to criminals. I found leaked details of

Apart from leaks harming the privacy of customers, paying ransoms does social harm by providing an income and incentive to criminals. I found leaked details of Royal Mail's negotiations with their attackers fascinating [0]. I'm not sure it's practical to outlaw the payment of ransoms, but it should at least be heavily taxed (say, 100%). Naively, I would expect this to cut by half the amount that can be extorted through ransomware attacks, making countries that implement such a tax less attractive targets. [0] https://www.theguardian.com/business/2023/feb/15/under-no-circumstances-will-we-pay-that-absurd-amount-royal-mail-tells-hackers https://www.theguardian.com/business/2023/feb/15/under-no-ci...

TylerE 4y ago
It’s been tried. Laws against paying just make people not report to the police at all.
- yellowsir 4y ago
  well, i guess laws against murder, makes murder no report them self...
  - JumpCrisscross 4y ago
    > laws against murder, makes murder no report them self One of these is more universally repulsive than the other. Were it illegal, I'm not sure I could be bothered to blow a whistle on a company paying a cyberransom. That's obviously different for murder.
  - thombat 4y ago
    The analogy is closer to being: the state will prosecute the murder victim's family for failing to properly protect them AND won't be able to locate or punish the true murderer. So in this situation, what's the family going to do? Mourn in private and not report the crime, maybe try for vigilante justice if they think they've identified the murderer.
    - abirch 4y ago
      And not let the community know there is a threat out there.
      - treeman79 4y ago
        In this scenario. the community is a danger to the family. Reporting the murder will see the community punish the family for not protecting the person better.
  - sieabahlpark 4y ago
    [dead]
- counttheforks 4y ago
  Then you toss the entire executive branch in prison when it inevitably leaks. The problem will solve itself soon enough. These criminal organizations should be treated as such.
netsharc 4y ago
Hah the LockBit negotiator displays that childish " I'm going to make something up and be convinced it's true" mentality that's much too common nowadays.. > LockBit refused to accept the explanation and accused the company’s negotiator of “bluffing”, speculating that the company’s directors probably held £100m of cryptocurrency personally that could “finish this nightmare”.
- msla 4y ago
  "I have the ability to punish you for my fantasy not being true" isn't childish, it's common among adults, and, indeed, is a defining feature among the adults who abuse children and anyone else less powerful than them. It is, in fact, one of the most powerful tools a dictator has: "You failed to capture that objective? You are incompetent, and possibly traitorous, so you will be executed, your family will be executed, and I will continue this war with competent generals who execute my plans because my plans are viable."
JohnFen 4y ago
If an organization pays a ransom, I consider that organization to be effectively in league with the criminals, and avoid doing any business with them in the future.

TylerE 4y ago

It’s been tried. Laws against paying just make people not report to the police at all.

yellowsir 4y ago
well, i guess laws against murder, makes murder no report them self...
- JumpCrisscross 4y ago
  > laws against murder, makes murder no report them self One of these is more universally repulsive than the other. Were it illegal, I'm not sure I could be bothered to blow a whistle on a company paying a cyberransom. That's obviously different for murder.
- thombat 4y ago
  The analogy is closer to being: the state will prosecute the murder victim's family for failing to properly protect them AND won't be able to locate or punish the true murderer. So in this situation, what's the family going to do? Mourn in private and not report the crime, maybe try for vigilante justice if they think they've identified the murderer.
  - abirch 4y ago
    And not let the community know there is a threat out there.
    - treeman79 4y ago
      In this scenario. the community is a danger to the family. Reporting the murder will see the community punish the family for not protecting the person better.
- sieabahlpark 4y ago
  [dead]
counttheforks 4y ago
Then you toss the entire executive branch in prison when it inevitably leaks. The problem will solve itself soon enough. These criminal organizations should be treated as such.

netsharc 4y ago

Hah the LockBit negotiator displays that childish " I'm going to make something up and be convinced it's true" mentality that's much too common nowadays.. > LockBit refused to accept the explanation and accused the company’s negotiator of “bluffing”, speculating that the company’s directors probably held £100m of cryptocurrency personally that could “finish this nightmare”.

msla 4y ago
"I have the ability to punish you for my fantasy not being true" isn't childish, it's common among adults, and, indeed, is a defining feature among the adults who abuse children and anyone else less powerful than them. It is, in fact, one of the most powerful tools a dictator has: "You failed to capture that objective? You are incompetent, and possibly traitorous, so you will be executed, your family will be executed, and I will continue this war with competent generals who execute my plans because my plans are viable."

JohnFen 4y ago

If an organization pays a ransom, I consider that organization to be effectively in league with the criminals, and avoid doing any business with them in the future.