13 ms·
The push to ban ransom payments is gaining momentum
- blackhaj7 2y agoSo now the hackers can ask for ransom and then, if you pay, threaten to tell people you paid the ransom afterwards. Double money
- ksaj 2y agoOnce companies are held accountable for the weapons and whatever else the money they paid in ransom gets spent on, things will finally change. Until then, we use the word "victim" with too much lenience. The secondary victims, the ones getting bombed, or the ones that will be targeted and threatened with the nukes that just got paid for with the ransom money, shouldn't be left out of the equation as they have been thus far. I'm sure some people don't like that way of thinking, but where else do you think one spends $22mil per "victim"? $30 billion a year buys a lot more than fancy clothes and yachts.
- cuu508 2y agoHow would holding companies accountable look? If you pay x amount as ransom, you must also pay x * some_multiplier as a fine, something like that?
- Yossarrian22 2y ago50 years in jail for everyone involved in approving the payment.
- halfcat 2y agoLet’s be realistic about this. A company can’t pay a ransom if they don’t have customers. Life sentences for all customers of businesses is the only effective path.
- yabatopia 2y agoAnd the death penalty for the engineer who didn’t patch a vulnerability or the software developer who wrote the buggy code. That will teach them! Judge Hindsight is ready to punish the victims. Hacks happen. Where starts or ends someone’s responsibility? Where stops the buck? Can we really expect that every layer in an organization is always fully aware of security and security risks, even unknown vulnerabilities? Security practices change over time. Not so long ago 12 character passwords were considered safe, 2FA didn’t exist, … I don’t think that harsher punishments and victim blaming is the way to go.
- BriggyDwiggs42 2y agoNukes? Not to hyperfixate lol i get your point but whyd you throw that in there?
- sanswork 2y agoI'm guessing because a lot of the ransom orgs are Russian with obvious ties to power.
- ElFitz 2y agoIt could work if we’re talking state-sponsored hackers. North Korea is well-known for that, although I’m not sure about ransomware, and I wouldn’t be surprised if Russia were into it too now.
- Ekaros 2y agoWhy not hold tax payers responsible as well?
- NoMoreNicksLeft 2y agoAt that point, the government is holding taxpayers ransom until they fix the ransomware problem. "Stop this or pay more taxes...er, fines."
- deleted 2y ago[deleted]
- dheera 2y agoI thought ransomware was a crime already? What would banning a crime do?
- solumunus 2y agoRead the title or any of the article: banning payments. In other words, if you’re a victim of ransomware you’re not allowed to pay off the attackers.
- dheera 2y agoI see, I read it as banning the practice of "asking for ransom payments"
- senectus1 2y agoheh, how long before state based attackers use this as a strategic tool to force supply line issues etc. I mean they do already but now when they get paid they can "dob in" a payer for a secondary attack vector.
- deleted 2y ago[deleted]
- bluGill 2y agoIt is illegal in most countries, but if you live in Russia, or North Korea not only is it legal it is encouraged by the government if you target "western" countries. Iran, China and India have also been accused of allowing ransomware (and likely other countries would allow it - but we have strong evidence of Russia and North Korea). What this means is it is legal for some people and they can target you. Which now leaves the problem of what should "western" countries do about this? The options are limited. Either it is CIA activities - but this assumes they have spies in place and risks given them up and so it is very limited; or it is a military invasion (of a major nuclear power!). There is diplomatic pressure of course, but there doesn't appear to be anything that can do about this. If you have a good idea I'm sure governments will be interested - but in general smart people have already been thinking about this so odds are you just don't understand why your idea is bad.
- dexwiz 2y agoDoes banning ransom payments really work? It just seems to create a service industry to pay on ransomed’s behalf.
- zer00eyz 2y agoBing Bing Bing!!! We have a winner! Legalized them, the FBI has to pay them for you, you have to give them 3x the cost of the payment. 1x to payment. 1x to finding people who committed the crime 1x to pay off everyone impacted. Increasing the cost of not being secure is the only way the problem will be addressed.
- halfcat 2y agoHow far do we take that? Adding layers and layers of security isn’t free, and it’s often at the expense of productivity, and if taken far enough, the profitability and viability of a business. What’s the right percentage of the economy to sacrifice to (maybe) stop one kind of crime?
- dclowd9901 2y agoAn unreasonably vulnerable business shouldn’t be considered a viable business.
- zizee 2y agoDefine "unreasonable".
- SkiFire13 2y agoMost ransomware don't need that much layers of security to be stopped. And even without them, backups go a long way to mitigate the damages.
- GoblinSlayer 2y agoJust balance it with the risk of ransomware.
- 2y ago
- pluto_modadic 2y agoGood. as someone who works in cybersecurity, I think hackers should get $0 from the victim, possibly get caught by police, and I think companies that get hacked should have to sit with their actions and DO BETTER for their customers.
- yardstick 2y agoDoes that extend to makers of buggy software, rather than those who often have little choice in what they use.
- nneonneo 2y agoIt’s not always buggy software; ransomware affiliates have been known to bribe company insiders to install malicious software on the network. The insider gets some cut of the eventual ransom. Works great on disgruntled employees or entry-level people. Fundamentally the financial incentive needs to be stopped in order to curb ransomware activities.
- halfcat 2y agoThe financial incentive to continue business operations will always be larger. Unless that’s the financial incentive you’re referring to.
- nradov 2y agoMaking it a criminal offense for a corporate officer to authorize a ransom payment would mostly eliminate the financial incentive. Very few employees will risk going to federal prison to protect their employer. Especially for publicly traded companies, large expenses are audited and difficult to hide.
- banish-m4 2y agoYep. Make it a crime to pay ransoms. No data is worth enabling and enriching criminals. Have tested backups stored offsite. If you fail at that, then you fail at business and deserve to go out of business.
- kazinator 2y ago> Ransomware is a profit-driven enterprise. If it is made unprofitable, most attacks will quickly stop. This is conjecture presented as fact. Here is an alternative conjecture: what if ransomware is mainly a sociopathically-driven enterprise, with a side interest in profit? Or what if a good chunk of it is? How many ransomware perpetrators have we captured, and subjected to psychological study, to be able to confidently say what ransomware is or is not?
- modernpacifist 2y agoIt seems reasonable to suggest that the number of profit-driven ransomware endeavors and the number of for-fun ransomware endeavors can both be non-zero and contain some overlap and some non-overlap. Therefore it seems that to make it unprofitable would at least eliminate the former reason which under all by the worst case scenario where those numbers are perfectly equal and overlapping would result in fewer ransomware endeavors. To say we shouldn't do X because it doesn't perfectly eliminate/solve Y is akin to saying we should do nothing because by that standard, we'll never do anything about Y.
- kazinator 2y agoNot only might X (= banning payments) not eliminate ransomware, it could make the problem worse! Those ransomware perpetrators who are motivated by profit could multiply their activities, if the yield is reduced: have more heists going on.
- modernpacifist 2y agoI don't see how banning payments would inherently create more opportunity for ransomware attacks. Assuming that the operators are already attacking as much as they can (why wouldn't they be - its more profit that way since its business after all) the only way to maintain profitability with lower per-attack yields would be to ask for more ransom per-attack which would likely drive the yields down even further. Reminds me of https://youtu.be/9pOiOhxujsE?si=GG6X16c8efr0I3Ey&t=213 https://youtu.be/9pOiOhxujsE?si=GG6X16c8efr0I3Ey&t=213
- bhawks 2y agoHow about a push to mandate 2fa for any entity holding data covered by GDPR or at the very least medical records. The United health care exploit was a password compromise as was the British library. The EPA just released a report saying 70% of the water infrastructure has laughable vulnerabilities like default passwords: https://www.newsweek.com/drinking-water-warning-issued-nationwide-cyberattacks-epa-1902756 https://www.newsweek.com/drinking-water-warning-issued-natio...
- Terr_ 2y agoImportant caveat: "Real" 2FA and not all these cheapo SMS messaging systems.
- siliconc0w 2y agoMake software companies liable if it's their bugs that lead to a compromise.
- halfcat 2y agoWho’s liable when a user is tricked into handing over a 2FA code? That’s the vast majority of the incidents I’ve seen over the years.
- tangentstar 2y agoThe software company would argue that the lawbreaking hacker was a supervening cause, while the consumer would argue the criminal was foreseeable. In the case of security software, the consumer might have a point. In practice such a claim is not usually successful.
- nradov 2y agoCustomers are already able to insist that software vendors indemnify them for security risks as a condition of purchase. No new laws are needed for this.
- listenallyall 2y agoIt would seem the unintended consequences of such a policy would be to ensure every cyber breach is kept entirely secret (so that ransom payments could be made discreetly), and not notifying law enforcement, software vendors, security researchers, or the customers. And then without any disclosure or collaboration, every company is on its own island, no collective learning, making it trivial for attackers to re-use the same exploit again and again.
- lelanthran 2y ago> It would seem the unintended consequences of such a policy would be to ensure every cyber breach is kept entirely secret (so that ransom payments could be made discreetly) It will show up somewhere in the tax filings. There's no such thing as discreet payments unless it's in such small amounts that it comes from petty cash. And since the ransomers are demanding payment in crypocurrency, it's even easier to spot for the clear majority of victims.
- vsuperpower2020 2y agoIt depends on how illegal "illegal" it is, too. Illegal doesn't mean criminal, and even then, companies do plenty of things that are normally criminal and they get away with a small fine.
- mschuster91 2y ago> It will show up somewhere in the tax filings. There's no such thing as discreet payments unless it's in such small amounts that it comes from petty cash. Create a shell company in some remote tax haven with lax disclosure laws, have them pay the ransom, and close the shell company afterwards. Companies are already good at dodging taxes this way.
- lelanthran 2y ago> Create a shell company in some remote tax haven with lax disclosure laws, have them pay the ransom, and close the shell company afterwards. Companies are already good at dodging taxes this way. That only works for hiding income, not hiding expenses. You create a shell company in Malta (for example). Now how do you get $$$ into that company so that it can pay the ransom? Okay, so you assign your payment to $MALTA-COMPANY the line-item of 'consulting fees'. It only takes a few companies to do this before the tax authorities are wise to it. After all, even for relatively tiny amounts companies still have to perform KYC on customers!. Think about it this way: if it was that easy to hide expenses from authorities, embezzlement schemes would be a lot simpler than they are now.
- greentext 2y ago[flagged]
- halfcat 2y agoAre the world police implementing this ban? And are they starting a world war to enforce it? Or how does this ban go into effect in your view?
- Gibbon1 2y agoWell we start with say you, you trade some of your bitcoin holdings, the feds seize your winnings, fine you and toss you in prison.
- coldtea 2y agoWhy start with the person trading bitcoin holdings or any other action for that matter? Why not just give the police arbitrary power to fine and toss in prison anybody? Sounds like getting to that with extra steps.
- Gibbon1 2y agoWell what you're doing is actually a felony already. https://www.federalcriminallawyer.us/securities-fraud/ https://www.federalcriminallawyer.us/securities-fraud/
- halfcat 2y agoHow do they seize it? Say I’ve got a 256-bit number memorized and I live on a farm in El Salvador. Is the US sending seal team 6 to interrogate every person trading bitcoin on earth? Or, is that maybe a bit unrealistic?
- Gibbon1 2y agoIf you're a foreigner you're not violating US laws by selling your fraudulent securities. If you sell to a US citizen you aught to stay away from places with extradition treaties. None of this is new or invalidated by magic coins in my computer.
- ggm 2y agoBan Insurance Companies buying back the stolen artworks. Or, demand they are destroyed on recovery.
- deleted 2y ago[deleted]
- MinelloGiacomo 2y agoFor my MSc in Cyber Risk strategy & governance my final dissertation was built on the parallelism of Italy's ban on payment of ransoms for kindnappings and the current ransomware trend. It's difficult to take solid conclusions, the measure could be effective in disrupting some financially motivated attackers but, given the current landscape, I guess the threat actors could shift more towards extorting end users where the ban will be more difficult to enforce. Ransomware rely heavly on financial incentives, for a company it comes down to cost but the same holds as well for threat actors, they try to go after the bigest whales they can get away with. Insurances may be loopholes, in Italy at the time they were banned as well.
- fullspectrumdev 2y agoSo what’s interesting is only a few years ago, ransomware such as CryptoLocker largely targeted individuals home machines as opposed to companies. Companies being hit was rarer. The ransom would be a few hundred dollars. Things got rather interesting after WannaCry and NotPetya - some underground markets/sites banned discussion of ransomware for a while, a lot of groups went quiet. Then it came back with almost exclusively targeting of enterprise/companies for big payoffs instead of a shitload of small payoffs.
- Animats 2y agoBanning ransoms worked, mostly, for terrorism. That has to be backed up by a sizable intelligence effort to find and fix the attackers, and a military effort to take them out.
- mschuster91 2y agoThat worked because the terrorism in question was Islamist - neither Russia, China nor Iran have any desire in having such groups grow powerful enough to be a threat to their interests, so it was in their interest to cooperate enough with the Western nations to quash the threat.
- bluish29 2y agoI think kidnapping for ransom is not a only a terrorism activity. Yes there are many cases of that but the majority will be related more with organized crime which usually enrich in weak and unstable government. There is correlation between terrorists activity and unstable countries but that is not always cause and effect relation. I.e you will find high statistics of kidnapping for ransom in Latin amaerica and even Mexico due to organized crime networks. There are variety of ways kidnapping for ransom works (including cyper attacks here but also something like human trafficking activities...etc [1]) So there are many actions taken to address those. They are not just confined into the islamists category. [1] https://www.nationalcrimeagency.gov.uk/what-we-do/crime-threats/kidnap-and-extortion https://www.nationalcrimeagency.gov.uk/what-we-do/crime-thre...
- mschuster91 2y agoYeah but the threshold for Western governments to engage in foreign, local stuff is very high. It's almost exclusively - some country or its exiled representatives directly ask for aid , e.g. against narco empires, but it's nowhere near a given that we react (e.g. Haiti, who has been begging for help for years now) - it threatens international shipping safety on popular trade routes, e.g. the Houthis in Yemen or Somalian pirates... and it's funny that the shipping co's complaining the loudest until military intervention comes are the ones who refuse to fly their ships under Western flags. - islamists threatening to spread their terrorism to other countries And that's it. Our general publics aren't very happy any more to spend trillions of dollars on oil grab operations or even on desperately needed support such as in Ukraine.
- coldtea 2y agoThe blackmail part is already illegal, so the criminals wont care one way or another. It's the victims that would now have two problems: damned if they pay, damned if they dont. It's not like the criminals will be at any increased risk or effort either. They're criminal operations already doing other criminal stuff, most of the work is automated (via viruses, bots, etc), and they already couldn't take the payments openly (it's not like they used a bank account).
- iansinnott 2y agoThe idea would be to reduce the likelihood of a payout.
- coldtea 2y agoIf this doesn't reduce the likelihood of ramsomware (because it's low effort to just send and see what happens) then it's only a problem for the victims
- bitnasty 2y agoI think that’s the point. Force the companies to improve their security practices.
- coldtea 2y agoI don't think the people drafting such laws have 2nd order thinking
- bluGill 2y agoDon't be so cynical, they do have such thinking (at least sometimes - like all other humans they have blind spots). They also have advisors who have such thinking. There are 532 people in congress, each who has several advisors, plus all the other officials in the FBI, CIA, NSA, military who have easy access to congress, dozens of lobbyists - it only takes one to have an idea and tell congress (though don't always agree and of course congress will not always do what they want). That is the US, every other country has different setups, but they will have something similar.
- mashlol 2y agoI'm ignorant but I've never understood why people actually pay the ransom. Aren't the attackers anonymous? What stops them from asking for another $Y after they get their $X, and not actually removing the ransomware? There's not much incentive for the attackers to actually do what they say after you pay them, right?
- user3939382 2y agoExtracting future ransoms can rely on their reputation
- vasco 2y agoThese attackers have made it clear they will release your data. They have done that many many times exactly because they know the target needs to believe they will release it. They even have customer support to help the targets recover everything.
- glandium 2y agoIt's not really hard, but they reportedly have better customer support than e.g. Google.
- Sayrus 2y agoAs crazy as it sounds, having a reputation to honor the unlocking of data is a great way to get other victims to pay. However, I'd be more suspicious of promises of data deletion.
- TeMPOraL 2y agoThe difference between regular business and organized crime is more that of a degree than that of a kind. Criminals may have less respect for law, greater risk tolerance, and go to greater extremes to acquire their customers, but at the end of the day, if they want people to pay them, they need to be known to deliver.
- trashtester 2y agoThis is exactly it. And it's a much broader principle than just ransoms. Any organization/group that live outside of an established legal system depends on being seen as honorable if they want to have any relationships with other organizations/groups. This applies to criminal groups (and individuals), clans in places like Afghanistan or Somalia and even to whole countries when dealing with each other. Essentially, such groups are playing repeated games of Prisoner's Dilemma. They need to be seen as playing a tit-for-tat strategy. If they are known for playing always-defect (or always-cooperate), other "players" will (if rational) play always-defect against them. This means they need to be honorable in that they keep their promises. But if someone disrespects them, they also must be predictable vengeful.
- billpg 2y agoI've seen enough reports of ransomware gangs failing to return their victims files even when they do pay up, that it's probably best to consider those files irrevocably lost and not pay.
- DeathArrow 2y agoIf you are unable to go after the criminal, you go after the victim.
- mihaaly 2y agoWe are a small but distributed organisation targeted by ransomware attack some weeks ago having poor luck that an employee noticed that something strange is underway just now in our system and pulled the plug without hesitation or waiting for instructions. Backups saved the day except a few days work of items easy to reproduce - memory is still fresh. We only had I guess less than 30 lost man days of work on efforts and a little downtime - in a mission noncritical period - while ensured (as far as possible) all is good, no malware remained, no spreading to local computers, reviewing practices, etc. Do take this seriously, we operate on a few millions EUR budget yearly - tightly counted - and still we were worthy for attack in their eyes. Watch out all!
- keeganpoppen 2y agogood on your employee who pulled the plug first and asked questions later-- that's the sign of an organization where people aren't afraid to do the right thing. very scary situation.
- ta1243 2y agoIt's always easy to say good on the employee who acted and stopped the problem The question is what happens with an employee who acted when there wasn't a problem?
- ianlevesque 2y agoLayoff. They were costing the company money for irrelevant problems.
- neilalexander 2y agoCongratulations: you've just created a culture where people are afraid to report potential issues for fear of losing their jobs. Maybe there are some cases where you find that specific individuals end up acting irrationally more often than not, but on the whole, it is better to treat these acts as if they were good faith until proven otherwise.
- trashtester 2y agoIt shouldn't be banned. Just add a +300% tax to it, while keeping it legal. (Banning will just lead to under-the-table payments). While this looks at face value like it's just making things worse, in fact it cuts the profits by 75% for any criminal trying to optimize the ransom demanded. Then use the tax collected to fund IT security research or something.
- fifteen1506 2y agoWhy ban? Force insurance companies to work -- actually insure -- and they'll have to start doing proactive work to keep in business. Are we trying to get a free working market or what??
- tangentstar 2y agoThe insurance company-driven model for industry specific safety improvement that worked so well for fire safety and auto safety has proven impossible because of three factors: 1. Cryptocurrency allows for unimaginably huge untraceable ransom payments that Amazon gift cards did not support, 2. No liability in tort for insecure software, and 3. Lack of computer security regulation (e.g., your car must have a seatbelt and ABS but your software can be arbitrarily bad without being prohibited). Insurance. Is not going to fix cybersecurity.
- sinuhe69 2y agoWhat is the difference between a computer ransom and a human kidnapping and ransoming situation? If I’m not allowed to pay ransom to save my business, does it means I should be also not allowed to pay ransom to save my loved ones?
- amadeuspagel 2y agoYes.
- bluGill 2y agoYes, and this was done a long time ago in places. While your kid might end up killed when the kidnapper realizes they can't get money from you, the criminals won't bother kidnapping again since there is no money in it and so overall society is much better - sorry that it was your kid that was killed. The rules are complex here. If your kid really is kidnapped ask the FBI (or local equivalent). Often they can pay a random on your behalf - with money they have means to trace. Sometimes if your life is in danger you can pay a bribe - but be sure to report to the FBI (or local equivalent) as soon as you are safe.
- furyg3 2y agoIt's kind of crazy to me that large companies are even able to make large, anonymous, unbudgeted, essentially cash payments (with no paper trail) at all.
- resource_waste 2y agoDeontology sounds great until reality hits. Then you do whatever is best. Your company's policies are subordinate to its survival.
- bluGill 2y agoThere is a paper trail in the large business - it just ends when the cash leaves the door as the payment is done by things like bitcoin. Though note the bitcoin isn't as anonymous as the the other side thinks and the FBI has managed to trace bitcoin at times, and they can mark some coins as tainted and so the evil actors have bitcoin that cannot be used, but this is still much more difficult that the large company which has careful records.
- grandinj 2y agoBetter to just ban cryptocurrency. Or impose the same controls that other banking systems have to obey. That will cut off the flow of funds.
- koalaman 2y agoDoes anybody wonder if these attacks aren't performing a public good in the long run by hardening our tech infrastructure in the West? It seems like hostilities with Russia, China, et al are likely to just get worse over time, and the long term high threat environment that these gangs have created for Western companies and utilities could give them a comparative advantage over time. That is assuming the same attacks aren't happening in China, Russia, North Korea, Iran, etc.
- blackeyeblitzar 2y agoI agree with the push for the ban to remove incentives but I do wonder about consistency. These days it seems the world is compromising and “negotiating with terrorists” all the time. For example look at how Hamas is being handled, for taking all those hostages and still holding onto them months later. Are these situations different?
- bluGill 2y agoNot really - there are no good options. Hamas kidnapped a bunch of people and Isreal's response to get back at Hamas is called a genocide for good reason - a lot of innocent people are dead as collateral damage. (or at least seemingly innocent, some of them support Hamas maybe). I have yet to see anyone suggest of a way to handle terrorists that doesn't result in more innocent victims in some form.
- lupire 2y agoThis ban is only ethical if the law authority does this job to stop criminals. Otherwise we end up in the same place as street crime: illegal to defend yourself, but also unprotected the authority that finds it easier deploy violence against victims than criminals.
- falqun 2y agoI'm just waiting till the first customer of some shady contract binding them to a greedy software company would use that to declare a payment as illegal and therefore that they cannot make it. Would be funny news like "XYZ says it cant pay oracle, declares it a ransom payment" :D
- jollyllama 2y agoI remember how surprised I was when ransomware really took off, that victims would pay and actually get their data back. Sure, it makes sense, that criminals benefit in the long run if they truly return the data, but I was surprised that the criminals were actually that farsighted. To me that suggests that rational economic forces really are at work and as a result, banning payments would cut back on ransomware attacks. This is very similar to having a "we don't negotiate with bad guys" policy, which is common at least as rhetoric if not in fact.
- euroderf 2y agoIs this becoming an "issue" because NK is raking it in ?
- iamleppert 2y ago100% the blame is to be put on crypto
- mrkramer 2y agoYes, financing cyberterrorism should be forbidden.
- nosmokewhereiam 2y agoIsmorgandoctrinelegalformyitnetwork.com is not registered, but it might be after hearing of a ban.
- rldjbpin 2y agohaving worked in a large company hit by the first wave of wannacry ransomware (https://news.ycombinator.com/item?id=14326555 https://news.ycombinator.com/item?id=14326555), i am doubtful that most companies can just ignore the disruption in business during an attack. not every company can go analogue while dealing with an attack like mgm. in a balance sheet, paying the ransom is just catching up to inadequate budgeting for systematic security efforts. while the person at the end will always be the weakest link, so much more can be done to avoid most attacks. maybe everyone going back to thin client like windows 365 would finally put this to end.