4 ms·

It's maybe already illegal[1][2]. That doesn't stop companies from paying for it. If you're a hospital, you're weighing breaking the letter of the law with kil

• gregwebs 3y ago
  Paying ransomware is not in any way illegal in the United States. Making payments to sanctioned entities (ransomware or otherwise) is. If companies go to their insurer, etc, they will probably get help to do the compliance to check to see if the payment requested would go to an OFAC sanctioned entity or not.
  • bee_rider 3y ago
    Is the duty to make sure you know you aren’t paying to a sanctioned entity, or is it to not know whether or not you are? Given the sources of many of these attacks, one should reasonably assume they are likely to be doing business with a sanctioned entity, right?
    • gregwebs 3y ago
      There isn't necessarily a way to know who you are actually dealing with. Maybe in some cases there might be some information to figure this out to some degree. But normally the only information that is certain is where the payment is going. Which is just a bitcoin wallet address.
• bee_rider 3y ago
  If you aren’t a hospital, you are helping the ransomware gangs amortize the cost of their R&D. Thus directly helping those who hit hospitals, and, as a result, contributing to those deaths.