3 ms·

I don't think that's quite fair. Each organization, especially ones that possess sensitive customer data, have a custodial duty to secure that data. Most of the

I don't think that's quite fair. Each organization, especially ones that possess sensitive customer data, have a custodial duty to secure that data. Most of these attacks are very preventable by following well documented best practices and industry recommendations. I think that "I wish my health provider paid the ransom" and "Health organizations should be responsible for protecting my data" are completely compatible views to hold.

JohnFen 3y ago
If nobody paid the ransom, ransomware attacks would be reduced to nearly zero. Paying the ransom means that other people will get ransomware attacks. So, effectively speaking, wishing someone paid the ransom means that you're also wishing that other will get hit with attacks because that's a direct consequence of paying.
- Atreiden 3y ago
  I follow your logic, I just think your conclusion is vastly oversimplified. Not paying the ransom also means that other people will get ransomware attacks. There is not direct causality here. There is some game theory, sure (a prisoner's dilemma, really). If nobody ever paid ransoms, there would be very little incentive for ransomware (though still not zero, some people just want to create chaos). But I don't think in a world-sized game with billions of actors that you can ascribe causality to the actions of a single actor. Wishing that you had driven to work instead of taking public transit (perhaps you missed an important meeting as a result) is not equivalent to wishing for public transit to be defunded (there is an equivalent feedback loop - decreasing ridership corresponds to reduced funding for public transit programs). Then consider that ransomware is only possible because of cybersecurity failings, and investing money into reasonable (some might even call them "common sense") security measures would also reduce these incidence rates to nearly zero. To be clear, I'm not advocating for paying ransomware ransoms, generally. I think this coalition is a good thing. But if a healthcare provider loses years of customer health data, that could lead to measurably worse health outcomes, and even excess mortality, for real people. An institution getting financially punished for not investing adequately in security seems like a better outcome than jeopardizing the health of real patients in the name of 'solidarity'. Meanwhile, a dozen other institutions pay the ransom and business continues as usual.
  - JohnFen 3y ago
    Yes, I completely understand the purely practical side of the issue. And perhaps paying the ransom does achieve a local maxima in terms of least harm, but it also prevents achieving an even greater maxima of least harm. To be clear, I'm not saying that anyone is obligated to "take one for the team", or that anyone is bad for not being willing to. I'm just saying that if everyone was willing to, far less harm would be done in the longer term. To me, a ransomware attack is little different than if someone just physically blew up the computers (or, with medical records, the hospital). It's a huge, costly disaster, but the damage is done. If we as a society thought of it like that and perhaps provided support (financial and otherwise) for people who get harmed like we do with any other large disaster, we could be in a better place for everyone except the criminals. Maybe we'd even put systems into place for the greater redundancy of medical records, to mitigate against actual health consequences of such attacks. We'd also have greater interest in providing support for implementation, education & investigation in terms of hardening against such attacks.

JohnFen 3y ago

If nobody paid the ransom, ransomware attacks would be reduced to nearly zero. Paying the ransom means that other people will get ransomware attacks. So, effectively speaking, wishing someone paid the ransom means that you're also wishing that other will get hit with attacks because that's a direct consequence of paying.

Atreiden 3y ago
I follow your logic, I just think your conclusion is vastly oversimplified. Not paying the ransom also means that other people will get ransomware attacks. There is not direct causality here. There is some game theory, sure (a prisoner's dilemma, really). If nobody ever paid ransoms, there would be very little incentive for ransomware (though still not zero, some people just want to create chaos). But I don't think in a world-sized game with billions of actors that you can ascribe causality to the actions of a single actor. Wishing that you had driven to work instead of taking public transit (perhaps you missed an important meeting as a result) is not equivalent to wishing for public transit to be defunded (there is an equivalent feedback loop - decreasing ridership corresponds to reduced funding for public transit programs). Then consider that ransomware is only possible because of cybersecurity failings, and investing money into reasonable (some might even call them "common sense") security measures would also reduce these incidence rates to nearly zero. To be clear, I'm not advocating for paying ransomware ransoms, generally. I think this coalition is a good thing. But if a healthcare provider loses years of customer health data, that could lead to measurably worse health outcomes, and even excess mortality, for real people. An institution getting financially punished for not investing adequately in security seems like a better outcome than jeopardizing the health of real patients in the name of 'solidarity'. Meanwhile, a dozen other institutions pay the ransom and business continues as usual.
- JohnFen 3y ago
  Yes, I completely understand the purely practical side of the issue. And perhaps paying the ransom does achieve a local maxima in terms of least harm, but it also prevents achieving an even greater maxima of least harm. To be clear, I'm not saying that anyone is obligated to "take one for the team", or that anyone is bad for not being willing to. I'm just saying that if everyone was willing to, far less harm would be done in the longer term. To me, a ransomware attack is little different than if someone just physically blew up the computers (or, with medical records, the hospital). It's a huge, costly disaster, but the damage is done. If we as a society thought of it like that and perhaps provided support (financial and otherwise) for people who get harmed like we do with any other large disaster, we could be in a better place for everyone except the criminals. Maybe we'd even put systems into place for the greater redundancy of medical records, to mitigate against actual health consequences of such attacks. We'd also have greater interest in providing support for implementation, education & investigation in terms of hardening against such attacks.