3 ms·

> You could change that percentage to any amount and it wouldn't change a thing, So what you're saying is that the criminals could quadruple their demands, and

> You could change that percentage to any amount and it wouldn't change a thing, So what you're saying is that the criminals could quadruple their demands, and everyone would still pay? I doubt it works like that. SOME high profile companies would still pay, but in many cases the threat would not justify paying 4x more. If we assume the criminals do not generally do much research on each company's ability to pay, but just have a more or less even price for everyone, I think it's rather safe to assume that they've tuned the ransoms to a level that more or less optimizes the total payment they receive. If it's made 4x more expensive to pay, fewer organizations would pay. And those who still pay will provide a lot of funding for efforts to battle this kind of crime. > and ransomware attackers will just lower the price if it's not This is at least half the purpose of adding the tax. If the price is lowered significantly, the economic loss for the non-criminal part of society is reduced. Also, lower revenues means that it will get harder for ransomware groups to "attract talent", meaning there will be fewer threats out there. Making payments illegal, on the other hand, just pushes the payments under ground. It's going to be about as successful as when they tried to ban alcohol.

bluGill 2y ago
> So what you're saying is that the criminals could quadruple their demands, and everyone would still pay? Maybe, maybe not. Everyone has a different threshold of what they will pay. Everyone has different costs to recover. Nobody really knows the exact cost to recover until they are done, by the time you realize you underestimated the cost of recovery it is too late.
- trashtester 2y ago
  Do you really think that if most companies were willing to pay 4x more, the criminals would not simply ask for 4x more? If so, why don't they?
  - bluGill 2y ago
    What is someone willing to pay is not known and different for different combanies. also too much invites action so they need to pe careful.
iLoveOncall 2y ago
> So what you're saying is that the criminals could quadruple their demands, and everyone would still pay? No. There's a major psychological difference between paying 1M to criminals to recover your data and 3M to the government, and paying 4M to criminals.
- trashtester 2y ago
  If anything, I suspect many company leaders would see the 3M tax as a bigger incentive to refuse to pay than paying those extra 3M to the criminal. At least the capitalists I've met tend to really HATE taxes.

bluGill 2y ago

> So what you're saying is that the criminals could quadruple their demands, and everyone would still pay? Maybe, maybe not. Everyone has a different threshold of what they will pay. Everyone has different costs to recover. Nobody really knows the exact cost to recover until they are done, by the time you realize you underestimated the cost of recovery it is too late.

trashtester 2y ago
Do you really think that if most companies were willing to pay 4x more, the criminals would not simply ask for 4x more? If so, why don't they?
- bluGill 2y ago
  What is someone willing to pay is not known and different for different combanies. also too much invites action so they need to pe careful.

iLoveOncall 2y ago

> So what you're saying is that the criminals could quadruple their demands, and everyone would still pay? No. There's a major psychological difference between paying 1M to criminals to recover your data and 3M to the government, and paying 4M to criminals.

trashtester 2y ago
If anything, I suspect many company leaders would see the 3M tax as a bigger incentive to refuse to pay than paying those extra 3M to the criminal. At least the capitalists I've met tend to really HATE taxes.