5 ms·

Banning it directly is a bad idea. Much of the same effect can be achieved by punishing companies that pay ransoms (or pay criminals or criminal organizations f

Banning it directly is a bad idea. Much of the same effect can be achieved by punishing companies that pay ransoms (or pay criminals or criminal organizations for similar reasons) by slapping a +300% tax on top of the payment (at least for companies). If the size of the ransom stays the same, this provides a stronger incentive to keep IT security at a sensible level. Or, if this means criminals have to lower their demands to get paid, then the profitability goes down. Use the money collected to fund IT security programs (research, awareness and assistance to companies in need of improving security.

iLoveOncall 2y ago
Very often the cost of recovery would be much higher than 4 times the ransom. Just look at the British Library as discussed in the article, not paying the 500K ransom cost them more than 6M so far. And was much more damaging to the public (I know because I tried to register after the ransomware and they simply don't have online registration anymore). They are STILL basically offline more than 6 months after: > We're continuing to experience a major technology outage as a result of a cyber-attack. Our buildings are open as usual, however, the outage is still affecting our website, online systems and services, as well as some onsite services. This is a temporary website, with limited content outlining the services that are currently available, as well as what's on at the Library. You could change that percentage to any amount and it wouldn't change a thing, it will still be cheaper to pay in most cases, and ransomware attackers will just lower the price if it's not. Change the British Library to any privately owned company, and no matter the price it will ALWAYS be better to pay than to be literally out of business for more than half a year (dead at that point).
- trashtester 2y ago
  > You could change that percentage to any amount and it wouldn't change a thing, So what you're saying is that the criminals could quadruple their demands, and everyone would still pay? I doubt it works like that. SOME high profile companies would still pay, but in many cases the threat would not justify paying 4x more. If we assume the criminals do not generally do much research on each company's ability to pay, but just have a more or less even price for everyone, I think it's rather safe to assume that they've tuned the ransoms to a level that more or less optimizes the total payment they receive. If it's made 4x more expensive to pay, fewer organizations would pay. And those who still pay will provide a lot of funding for efforts to battle this kind of crime. > and ransomware attackers will just lower the price if it's not This is at least half the purpose of adding the tax. If the price is lowered significantly, the economic loss for the non-criminal part of society is reduced. Also, lower revenues means that it will get harder for ransomware groups to "attract talent", meaning there will be fewer threats out there. Making payments illegal, on the other hand, just pushes the payments under ground. It's going to be about as successful as when they tried to ban alcohol.
  - bluGill 2y ago
    > So what you're saying is that the criminals could quadruple their demands, and everyone would still pay? Maybe, maybe not. Everyone has a different threshold of what they will pay. Everyone has different costs to recover. Nobody really knows the exact cost to recover until they are done, by the time you realize you underestimated the cost of recovery it is too late.
    - trashtester 2y ago
      Do you really think that if most companies were willing to pay 4x more, the criminals would not simply ask for 4x more? If so, why don't they?
      - bluGill 2y ago
        What is someone willing to pay is not known and different for different combanies. also too much invites action so they need to pe careful.
  - iLoveOncall 2y ago
    > So what you're saying is that the criminals could quadruple their demands, and everyone would still pay? No. There's a major psychological difference between paying 1M to criminals to recover your data and 3M to the government, and paying 4M to criminals.
    - trashtester 2y ago
      If anything, I suspect many company leaders would see the 3M tax as a bigger incentive to refuse to pay than paying those extra 3M to the criminal. At least the capitalists I've met tend to really HATE taxes.
red_admiral 2y ago
My "lawful evil" approach to this would be to put the money thus collected in a special fund for counter-intelligence operations targeting people who produce and use ransomware. Collect 1M in ransom, someone else now has 3M to fight you with.
- trashtester 2y ago
  Off topic: When I was a teenager and started playin D&D (1st ed), there was only Lawful/Neutral/Chaotic. No Good/Evil. At the time, I tended to see the world primarily as Good vs Evil, so AD&D (2nd ed) seemed like an improvement. As I got older, I came to realize that what people consider "Evil" is mostly used for people we're in some partisan conflict with. Like in Israel/Palestine: Each side see the other side as "Evil" and themselves as the "Good Guys". If anything, the main purpose of allowing ourselves to see some groups or individuals as "Evil" is to dehumanize them in ways that allow us to do "Evil" things to them. Lawful vs Chaotic makes a lot more sense to me than back then, though. It's the yin/yang dualism that when in balance gives rise to most of the interesting dynamical phenomena.
  - voltaireodactyl 2y ago
    The lead prosecutor at Nuremberg described evil as “lack of empathy” which I think is just about the best possible definition available to human beings.
nradov 2y ago
Banning ransoms directly is a good idea. Even if that results in massive losses or even bankruptcies by victims, that is an acceptable consequence to prevent money from flowing to criminal organizations and hostile foreign governments. Sometimes you have to amputate a damaged limb to save the body. Paying a ransom in any circumstance should be a criminal offense.
- sharlos201068 2y ago
  Plus if companies are less likely to pay the ransom, ransoming companies becomes less profitable.

iLoveOncall 2y ago

Very often the cost of recovery would be much higher than 4 times the ransom. Just look at the British Library as discussed in the article, not paying the 500K ransom cost them more than 6M so far. And was much more damaging to the public (I know because I tried to register after the ransomware and they simply don't have online registration anymore). They are STILL basically offline more than 6 months after: > We're continuing to experience a major technology outage as a result of a cyber-attack. Our buildings are open as usual, however, the outage is still affecting our website, online systems and services, as well as some onsite services. This is a temporary website, with limited content outlining the services that are currently available, as well as what's on at the Library. You could change that percentage to any amount and it wouldn't change a thing, it will still be cheaper to pay in most cases, and ransomware attackers will just lower the price if it's not. Change the British Library to any privately owned company, and no matter the price it will ALWAYS be better to pay than to be literally out of business for more than half a year (dead at that point).

trashtester 2y ago
> You could change that percentage to any amount and it wouldn't change a thing, So what you're saying is that the criminals could quadruple their demands, and everyone would still pay? I doubt it works like that. SOME high profile companies would still pay, but in many cases the threat would not justify paying 4x more. If we assume the criminals do not generally do much research on each company's ability to pay, but just have a more or less even price for everyone, I think it's rather safe to assume that they've tuned the ransoms to a level that more or less optimizes the total payment they receive. If it's made 4x more expensive to pay, fewer organizations would pay. And those who still pay will provide a lot of funding for efforts to battle this kind of crime. > and ransomware attackers will just lower the price if it's not This is at least half the purpose of adding the tax. If the price is lowered significantly, the economic loss for the non-criminal part of society is reduced. Also, lower revenues means that it will get harder for ransomware groups to "attract talent", meaning there will be fewer threats out there. Making payments illegal, on the other hand, just pushes the payments under ground. It's going to be about as successful as when they tried to ban alcohol.
- bluGill 2y ago
  > So what you're saying is that the criminals could quadruple their demands, and everyone would still pay? Maybe, maybe not. Everyone has a different threshold of what they will pay. Everyone has different costs to recover. Nobody really knows the exact cost to recover until they are done, by the time you realize you underestimated the cost of recovery it is too late.
  - trashtester 2y ago
    Do you really think that if most companies were willing to pay 4x more, the criminals would not simply ask for 4x more? If so, why don't they?
    - bluGill 2y ago
      What is someone willing to pay is not known and different for different combanies. also too much invites action so they need to pe careful.
- iLoveOncall 2y ago
  > So what you're saying is that the criminals could quadruple their demands, and everyone would still pay? No. There's a major psychological difference between paying 1M to criminals to recover your data and 3M to the government, and paying 4M to criminals.
  - trashtester 2y ago
    If anything, I suspect many company leaders would see the 3M tax as a bigger incentive to refuse to pay than paying those extra 3M to the criminal. At least the capitalists I've met tend to really HATE taxes.

red_admiral 2y ago

My "lawful evil" approach to this would be to put the money thus collected in a special fund for counter-intelligence operations targeting people who produce and use ransomware. Collect 1M in ransom, someone else now has 3M to fight you with.

trashtester 2y ago
Off topic: When I was a teenager and started playin D&D (1st ed), there was only Lawful/Neutral/Chaotic. No Good/Evil. At the time, I tended to see the world primarily as Good vs Evil, so AD&D (2nd ed) seemed like an improvement. As I got older, I came to realize that what people consider "Evil" is mostly used for people we're in some partisan conflict with. Like in Israel/Palestine: Each side see the other side as "Evil" and themselves as the "Good Guys". If anything, the main purpose of allowing ourselves to see some groups or individuals as "Evil" is to dehumanize them in ways that allow us to do "Evil" things to them. Lawful vs Chaotic makes a lot more sense to me than back then, though. It's the yin/yang dualism that when in balance gives rise to most of the interesting dynamical phenomena.
- voltaireodactyl 2y ago
  The lead prosecutor at Nuremberg described evil as “lack of empathy” which I think is just about the best possible definition available to human beings.

nradov 2y ago

Banning ransoms directly is a good idea. Even if that results in massive losses or even bankruptcies by victims, that is an acceptable consequence to prevent money from flowing to criminal organizations and hostile foreign governments. Sometimes you have to amputate a damaged limb to save the body. Paying a ransom in any circumstance should be a criminal offense.

sharlos201068 2y ago
Plus if companies are less likely to pay the ransom, ransoming companies becomes less profitable.