4 ms·
The US should make it illegal to pay ransom, with a penalty of prison for anyone paying a ransom or authorizing payment. The purpose of the law is that now ran
by ars 3y ago
The US should make it illegal to pay ransom, with a penalty of prison for anyone paying a ransom or authorizing payment.
The purpose of the law is that now ransomware gangs will be less likely to target US companies because companies are unlikely to risk paying them.
- ironmagma 3y agoIt's maybe already illegal[1][2]. That doesn't stop companies from paying for it. If you're a hospital, you're weighing breaking the letter of the law with killing a bunch of people. [1] https://www.gma-cpa.com/technology-blog/paying-ransom-on-a-ransomware-attack-is-illegal https://www.gma-cpa.com/technology-blog/paying-ransom-on-a-r... [2] https://cbs12.com/news/cbs12-news-i-team/hospital-ransomware-attack-to-pay-or-not-to-pay-data-patient-lawsuit-florida-hca-healthcare-tenet-st-marys-good-samaritan-florida-7-20-2023 https://cbs12.com/news/cbs12-news-i-team/hospital-ransomware...
- gregwebs 3y agoPaying ransomware is not in any way illegal in the United States. Making payments to sanctioned entities (ransomware or otherwise) is. If companies go to their insurer, etc, they will probably get help to do the compliance to check to see if the payment requested would go to an OFAC sanctioned entity or not.
- bee_rider 3y agoIs the duty to make sure you know you aren’t paying to a sanctioned entity, or is it to not know whether or not you are? Given the sources of many of these attacks, one should reasonably assume they are likely to be doing business with a sanctioned entity, right?
- gregwebs 3y agoThere isn't necessarily a way to know who you are actually dealing with. Maybe in some cases there might be some information to figure this out to some degree. But normally the only information that is certain is where the payment is going. Which is just a bitcoin wallet address.
- bee_rider 3y agoIf you aren’t a hospital, you are helping the ransomware gangs amortize the cost of their R&D. Thus directly helping those who hit hospitals, and, as a result, contributing to those deaths.
- ploum 3y ago— If you don’t give me 10k$, I will tell the authorities that you have paid a ransom of 100k$. — Ok, here’s the money. — Thanks. If you don’t give me 10k$ more, I will tell the authorities about our previous deal.
- M3L0NM4N 3y agoThat's stupid. If you don't actually pay them, there would be no evidence of you paying them. Their case would hold absolutely no water.
- phpisthebest 3y agoNo I did not pay a ransom, I paid a 7 figure consulting fee to a cyber security company not based in the US, who somehow magically resolved the issue for us...
- smith7018 3y agoThere are instances where that doesn't make sense. For example, there was that plastic surgery office that got hacked a couple weeks ago. I get why they think it's better to at least try to prevent such private information from getting out. making it illegal to pay the ransom means that every patients' medical history and pre/post op photos would be leaked. That's a nightmare.