5 ms·

Does banning ransom payments really work? It just seems to create a service industry to pay on ransomed’s behalf.

by dexwiz 2y ago

zer00eyz 2y ago
Bing Bing Bing!!! We have a winner! Legalized them, the FBI has to pay them for you, you have to give them 3x the cost of the payment. 1x to payment. 1x to finding people who committed the crime 1x to pay off everyone impacted. Increasing the cost of not being secure is the only way the problem will be addressed.
- halfcat 2y ago
  How far do we take that? Adding layers and layers of security isn’t free, and it’s often at the expense of productivity, and if taken far enough, the profitability and viability of a business. What’s the right percentage of the economy to sacrifice to (maybe) stop one kind of crime?
  - dclowd9901 2y ago
    An unreasonably vulnerable business shouldn’t be considered a viable business.
    - zizee 2y ago
      Define "unreasonable".
  - SkiFire13 2y ago
    Most ransomware don't need that much layers of security to be stopped. And even without them, backups go a long way to mitigate the damages.
  - GoblinSlayer 2y ago
    Just balance it with the risk of ransomware.
NoMoreNicksLeft 2y ago
How could it realistically be enforced? Never mind whether it does what we want, can we even perform the action? Imagine that we send anyone who orders that ransom payment be made, or those who conduct payment are all sentenced to death by boiling them feet first in oil. Imagine that no judge or jury shies away from the punishment. Then imagine that there are 1 million of these crimes per year within the United States. How many people are executed? 15? 600? Unless the government's doing ransom audits monthly, how the hell will they ever catch such people? Whistleblowers are safe even if they don't whistleblow, they're not on the hook for punishment. And they're not seeing something so unethical they feel morally compelled to act. Just coworkers who are trying to keep the company from falling apart (potentially even saving the whistleblower's job too). The criminals might try to leverage this by using it as further blackmail material, but that doesn't work in game theory. The individuals are relatively poor, so they can't be milked individually, and the business can't afford ongoing, indefinite ransom... changes the equation into the "definitely not worth it" category. If the individuals could afford it (in the strict sense), then they will refuse orders to covertly make payment, because then they are on the hook personally... so the criminals are going after the small fish and losing the big. This is unenforceable.
- lelanthran 2y ago
  > How could it realistically be enforced? By the tax authorities, who are already looking at every payment a business ever makes anyway! > This is unenforceable. Only for amounts that come from petty cash, at which point you have effectively reduced the major financial motivation for such crimes anyway.
  - devilbunny 2y ago
    The tax authorities care what you list as an expense. If you aren’t a public company and don’t try to write it off as an expense/loss, they don’t care.
- munch117 2y ago
  In the corporate sphere, this is way easier to investigate than most other forms of corporate crime. Investigating price fixing or discrimination is hard, because it happens over a protracted period, and you have to show a pattern, and everything is open to interpretation, etc. But this? There are two distinctive events that are basically impossible to hide: The disruption and the payment. Attacks on individuals are another matter, yes that's hard to enforce. But then, on the average, I don't think individuals actually benefit from paying this kind of ransom. It just tags you as a mark for further abuse. So maybe most people will accept that paying ransoms is just not something you do.
dclowd9901 2y ago
Or dodging reporting…
losteric 2y ago
Bans have helped fight other protection rackets. Businesses are less willing to comply with the mob when the government is swinging a bigger stick. And payments/criminal rewards get pressured down when it’s blatantly illegal
- bananenpubs 2y ago
  [flagged]

Does banning ransom payments really work? It just seems to create a service industry to pay on ransomed’s behalf.

by dexwiz 2y ago

Does banning ransom payments really work? It just seems to create a service industry to pay on ransomed’s behalf.

Bing Bing Bing!!! We have a winner! Legalized them, the FBI has to pay them for you, you have to give them 3x the cost of the payment. 1x to payment. 1x to finding people who committed the crime 1x to pay off everyone impacted. Increasing the cost of not being secure is the only way the problem will be addressed.

halfcat 2y ago
How far do we take that? Adding layers and layers of security isn’t free, and it’s often at the expense of productivity, and if taken far enough, the profitability and viability of a business. What’s the right percentage of the economy to sacrifice to (maybe) stop one kind of crime?
- dclowd9901 2y ago
  An unreasonably vulnerable business shouldn’t be considered a viable business.
  - zizee 2y ago
    Define "unreasonable".
- SkiFire13 2y ago
  Most ransomware don't need that much layers of security to be stopped. And even without them, backups go a long way to mitigate the damages.
- GoblinSlayer 2y ago
  Just balance it with the risk of ransomware.

NoMoreNicksLeft 2y ago

How could it realistically be enforced? Never mind whether it does what we want, can we even perform the action? Imagine that we send anyone who orders that ransom payment be made, or those who conduct payment are all sentenced to death by boiling them feet first in oil. Imagine that no judge or jury shies away from the punishment. Then imagine that there are 1 million of these crimes per year within the United States. How many people are executed? 15? 600? Unless the government's doing ransom audits monthly, how the hell will they ever catch such people? Whistleblowers are safe even if they don't whistleblow, they're not on the hook for punishment. And they're not seeing something so unethical they feel morally compelled to act. Just coworkers who are trying to keep the company from falling apart (potentially even saving the whistleblower's job too). The criminals might try to leverage this by using it as further blackmail material, but that doesn't work in game theory. The individuals are relatively poor, so they can't be milked individually, and the business can't afford ongoing, indefinite ransom... changes the equation into the "definitely not worth it" category. If the individuals could afford it (in the strict sense), then they will refuse orders to covertly make payment, because then they are on the hook personally... so the criminals are going after the small fish and losing the big. This is unenforceable.

lelanthran 2y ago
> How could it realistically be enforced? By the tax authorities, who are already looking at every payment a business ever makes anyway! > This is unenforceable. Only for amounts that come from petty cash, at which point you have effectively reduced the major financial motivation for such crimes anyway.
- devilbunny 2y ago
  The tax authorities care what you list as an expense. If you aren’t a public company and don’t try to write it off as an expense/loss, they don’t care.
munch117 2y ago
In the corporate sphere, this is way easier to investigate than most other forms of corporate crime. Investigating price fixing or discrimination is hard, because it happens over a protracted period, and you have to show a pattern, and everything is open to interpretation, etc. But this? There are two distinctive events that are basically impossible to hide: The disruption and the payment. Attacks on individuals are another matter, yes that's hard to enforce. But then, on the average, I don't think individuals actually benefit from paying this kind of ransom. It just tags you as a mark for further abuse. So maybe most people will accept that paying ransoms is just not something you do.

dclowd9901 2y ago

Or dodging reporting…

losteric 2y ago

Bans have helped fight other protection rackets. Businesses are less willing to comply with the mob when the government is swinging a bigger stick. And payments/criminal rewards get pressured down when it’s blatantly illegal

bananenpubs 2y ago
[flagged]