4 ms·

Very often the cost of recovery would be much higher than 4 times the ransom. Just look at the British Library as discussed in the article, not paying the 500K

Very often the cost of recovery would be much higher than 4 times the ransom. Just look at the British Library as discussed in the article, not paying the 500K ransom cost them more than 6M so far. And was much more damaging to the public (I know because I tried to register after the ransomware and they simply don't have online registration anymore). They are STILL basically offline more than 6 months after: > We're continuing to experience a major technology outage as a result of a cyber-attack. Our buildings are open as usual, however, the outage is still affecting our website, online systems and services, as well as some onsite services. This is a temporary website, with limited content outlining the services that are currently available, as well as what's on at the Library. You could change that percentage to any amount and it wouldn't change a thing, it will still be cheaper to pay in most cases, and ransomware attackers will just lower the price if it's not. Change the British Library to any privately owned company, and no matter the price it will ALWAYS be better to pay than to be literally out of business for more than half a year (dead at that point).

trashtester 2y ago
> You could change that percentage to any amount and it wouldn't change a thing, So what you're saying is that the criminals could quadruple their demands, and everyone would still pay? I doubt it works like that. SOME high profile companies would still pay, but in many cases the threat would not justify paying 4x more. If we assume the criminals do not generally do much research on each company's ability to pay, but just have a more or less even price for everyone, I think it's rather safe to assume that they've tuned the ransoms to a level that more or less optimizes the total payment they receive. If it's made 4x more expensive to pay, fewer organizations would pay. And those who still pay will provide a lot of funding for efforts to battle this kind of crime. > and ransomware attackers will just lower the price if it's not This is at least half the purpose of adding the tax. If the price is lowered significantly, the economic loss for the non-criminal part of society is reduced. Also, lower revenues means that it will get harder for ransomware groups to "attract talent", meaning there will be fewer threats out there. Making payments illegal, on the other hand, just pushes the payments under ground. It's going to be about as successful as when they tried to ban alcohol.
- bluGill 2y ago
  > So what you're saying is that the criminals could quadruple their demands, and everyone would still pay? Maybe, maybe not. Everyone has a different threshold of what they will pay. Everyone has different costs to recover. Nobody really knows the exact cost to recover until they are done, by the time you realize you underestimated the cost of recovery it is too late.
  - trashtester 2y ago
    Do you really think that if most companies were willing to pay 4x more, the criminals would not simply ask for 4x more? If so, why don't they?
    - bluGill 2y ago
      What is someone willing to pay is not known and different for different combanies. also too much invites action so they need to pe careful.
- iLoveOncall 2y ago
  > So what you're saying is that the criminals could quadruple their demands, and everyone would still pay? No. There's a major psychological difference between paying 1M to criminals to recover your data and 3M to the government, and paying 4M to criminals.
  - trashtester 2y ago
    If anything, I suspect many company leaders would see the 3M tax as a bigger incentive to refuse to pay than paying those extra 3M to the criminal. At least the capitalists I've met tend to really HATE taxes.

trashtester 2y ago

> You could change that percentage to any amount and it wouldn't change a thing, So what you're saying is that the criminals could quadruple their demands, and everyone would still pay? I doubt it works like that. SOME high profile companies would still pay, but in many cases the threat would not justify paying 4x more. If we assume the criminals do not generally do much research on each company's ability to pay, but just have a more or less even price for everyone, I think it's rather safe to assume that they've tuned the ransoms to a level that more or less optimizes the total payment they receive. If it's made 4x more expensive to pay, fewer organizations would pay. And those who still pay will provide a lot of funding for efforts to battle this kind of crime. > and ransomware attackers will just lower the price if it's not This is at least half the purpose of adding the tax. If the price is lowered significantly, the economic loss for the non-criminal part of society is reduced. Also, lower revenues means that it will get harder for ransomware groups to "attract talent", meaning there will be fewer threats out there. Making payments illegal, on the other hand, just pushes the payments under ground. It's going to be about as successful as when they tried to ban alcohol.

bluGill 2y ago
> So what you're saying is that the criminals could quadruple their demands, and everyone would still pay? Maybe, maybe not. Everyone has a different threshold of what they will pay. Everyone has different costs to recover. Nobody really knows the exact cost to recover until they are done, by the time you realize you underestimated the cost of recovery it is too late.
- trashtester 2y ago
  Do you really think that if most companies were willing to pay 4x more, the criminals would not simply ask for 4x more? If so, why don't they?
  - bluGill 2y ago
    What is someone willing to pay is not known and different for different combanies. also too much invites action so they need to pe careful.
iLoveOncall 2y ago
> So what you're saying is that the criminals could quadruple their demands, and everyone would still pay? No. There's a major psychological difference between paying 1M to criminals to recover your data and 3M to the government, and paying 4M to criminals.
- trashtester 2y ago
  If anything, I suspect many company leaders would see the 3M tax as a bigger incentive to refuse to pay than paying those extra 3M to the criminal. At least the capitalists I've met tend to really HATE taxes.