4 ms·

LLike they would care about their victims facing legal consequences. If they don't pay, nuts to them. If they pay, I get money.

cirrus3 3y ago
Yes, obviously they don't care about the legal consequences for the victim. The goal is to make them think they won't ever get paid due to the threat of legal consequences on victim, and therefore they wouldn't bother doing ransom in the first place (which is pretty unrealistic imo).
- Wowfunhappy 3y ago
  Why is this unrealistic? The victims won't pay because they don't want to go to jail. If no one pays—or even if people pay much smaller amounts that are possible to hide—there isn't an incentive to launch ransomware.
  - cirrus3 3y ago
    It is unrealistic because as long as just enough victims pay to make it worthwhile, the bad guys will keep doing it. My assumption is that the cost to find victims and make the request is low enough and that number folks that will still pay regardless of the law is high enough to make it it worthwhile for the bad guys. Best case, it lowers the profit margin for the bad guys. Meanwhile, the victims face being punished even worse.
Wowfunhappy 3y ago
Businesses won't pay if their executives think it may cause them to go to jail.
- cirrus3 3y ago
  It just comes down to the cost-benefit for the bad guys. As long as it is profitable it won't stop. Yes, many big businesses may stop paying since the executives don't want to go to jail. Realistically if they are that big they can probably come up with a legal argument to justify the payment though within the mess of exceptions that would have to exist if this became a thing. In the end the bad guys are just going to adjust to target smaller companies that would be under the radar for being caught paying. In the end it doesn't really matter what the dynamics of it end up being. If it pays off to ransom, it will still happen, and I think there will always be a way to make it pay off for quite a while. The only real solution is better security that makes it unprofitable to even attempt to breach a company that makes a random possible. Threatening legal consequences for the victim is a very sideways way to go about achieving the goal of deterring the bad guys.

cirrus3 3y ago

Yes, obviously they don't care about the legal consequences for the victim. The goal is to make them think they won't ever get paid due to the threat of legal consequences on victim, and therefore they wouldn't bother doing ransom in the first place (which is pretty unrealistic imo).

Wowfunhappy 3y ago
Why is this unrealistic? The victims won't pay because they don't want to go to jail. If no one pays—or even if people pay much smaller amounts that are possible to hide—there isn't an incentive to launch ransomware.
- cirrus3 3y ago
  It is unrealistic because as long as just enough victims pay to make it worthwhile, the bad guys will keep doing it. My assumption is that the cost to find victims and make the request is low enough and that number folks that will still pay regardless of the law is high enough to make it it worthwhile for the bad guys. Best case, it lowers the profit margin for the bad guys. Meanwhile, the victims face being punished even worse.

Wowfunhappy 3y ago

Businesses won't pay if their executives think it may cause them to go to jail.

cirrus3 3y ago
It just comes down to the cost-benefit for the bad guys. As long as it is profitable it won't stop. Yes, many big businesses may stop paying since the executives don't want to go to jail. Realistically if they are that big they can probably come up with a legal argument to justify the payment though within the mess of exceptions that would have to exist if this became a thing. In the end the bad guys are just going to adjust to target smaller companies that would be under the radar for being caught paying. In the end it doesn't really matter what the dynamics of it end up being. If it pays off to ransom, it will still happen, and I think there will always be a way to make it pay off for quite a while. The only real solution is better security that makes it unprofitable to even attempt to breach a company that makes a random possible. Threatening legal consequences for the victim is a very sideways way to go about achieving the goal of deterring the bad guys.