4 ms·
This is always the game theory of ransoms, and it is a classic example of a collective action problem (and is a form of a prisoner's dilemma). Each individual
by cortesoft 5mo ago
This is always the game theory of ransoms, and it is a classic example of a collective action problem (and is a form of a prisoner's dilemma).
Each individual company is probably better off paying the ransom, but everyone would be better off if no one paid a ransom.
This is why the United States, for example, has an official no-ransom policy, and why other no-ransom policies exist. You have to have something forcing the individual victim to not pay, otherwise they will always be incentivized to pay and ransoms will continue to be profitable.
https://en.wikipedia.org/wiki/Collective_action_problem https://en.wikipedia.org/wiki/Collective_action_problem
https://en.wikipedia.org/wiki/Prisoner%27s_dilemma https://en.wikipedia.org/wiki/Prisoner%27s_dilemma
- Hizonner 5mo ago... except that "policies" don't cut it. Criminal penalties for paying are what you need, and not just for payments to specific designated entities, either. The executive making the decision to pay has to have a real fear of personally spending time in actual prison.
- gnopgnip 5mo agoUS law has criminal penalties for paying a ransom to a designated criminal terrorist organization or under treasury sanctions.
- esseph 5mo agoMost hacking groups don't fall under that. Some, sure.
- cortesoft 5mo agoA criminal penalty is a form of policy
- Hizonner 5mo ago... but not the form of policy they actually have. Except for payments to specifically sanctioned organizations, the policy is "we'd really rather you didn't do that, but whatever". The specific sanctions don't cover most of the groups, either, and even when they do cover the group who got paid, you can't necessarily prove the people who got paid were the ones on the list. And there may be a scienter requirement even then; I don't know. Making a list of specific criminals you can't pay is just stupid. No ransoms, ever, period, or it's da slammah.
- bombcar 5mo agoYou can also have the "excessive force" doctrine, where holding someone or something for ransom results in your entire country being a smoldering crater. But just like fail2ban, this gives someone else decision-making control over your actions, which can be abused.
- kjkjadksj 5mo agoWhile the us stance has resulted in savings on potential ransom, it has also lead to people being kept in prison for very long time until prisoner exchanges might be worked out. That cost to an individuals life being imprisoned is probably far in excess whatever the US might pay. Plus the US prints its own monopoly money and doesn’t really play by the rules of economics anyhow ever since getting off gold standard.
- WillPostForFood 5mo agoCash is not the real cost; the cost is by agreeing to continue printing ransom money, you cause more individuals to be kidnapped.
- kjkjadksj 5mo agoSeems the rate of kidnapping is currently orthogonal from the ransom so it is unclear that they will have a linear relationship in this way as you describe.
- appreciatorBus 5mo agoThat ransoms today are denominated in USD and that the US might be printing too many USD has nothing to do with whether or not ransoms should be paid. The day the USD falls, ransoms will simply be denominated in something else and the same underlying collective action problem will remain. This is just way of avoiding the core issue by blaming something unrelated that you don't like. A: U should clean your room, it would be better for you & the rest of your family B: FU dad, everyone knows there's no such thing as a clean room under capitalism!!!!!
- cortesoft 5mo agoThis is literally the exact point I am making, and the US policy isn’t about saving money. Like you said (and like I said in my post), for an individual kidnap victim, the best option would be to pay the ransom. It is better to pay the money and be free. However, that means a kidnap group now has more money, which will make them better able to kidnap another victim and demand more money. The point of a “no ransom” policy is that it takes the choice away from the individual, who would choose to pay it, and changes the game theory to make kidnapping not worth it. The whole reason you need a policy at all is BECAUSE it is better for the person to pay the ransom.
- Ysx 5mo ago> Each individual company is probably better off paying the ransom, but everyone would be better off if no one paid a ransom. You're then a target known to be vulnerable and pay ransoms, so best focus on security.
- sgc 5mo agoIf you have to pay, at least try to negotiate 1) a guarantee that the hackers won't just do it again sometime later, and 2) full disclosure / assistance in repairing your vulnerabilities so you have some kind of head start for the future. Outside of politically motivated hackers, this would probably be reasonably successful.
- Symbiote 5mo agoOther hacking groups now know Instructure pays up.
- LgWoodenBadger 5mo agoWhat possible type of guarantee could one ever hope to "negotiate" with someone who has just successfully blackmailed/ransomed/extorted?
- sgc 5mo agoWe are in the context of already having to pay. You are at their mercy no matter what, so the only value of any interaction with them is based on hoping they have incentive to maintain their promises to protect their reputation etc. It's not a good situation to be in, but still, try to make the best of it.
- kelnos 5mo agoIf the ransomware operator believes that breaking their word might make it harder to get money out of future victims, they'll keep their word. They might not believe that, but if you're at the point where you're paying anyway, you might as well try to get that commitment from them.
- janalsncm 5mo agoThere’s a similar dynamic from within the hacker group itself. For the ransom group, it is better for them to be perceived as trustworthy. Pay the ransom and we won’t leak your data. For any individual within the ransom group, they can get a big payout by selling the data.
- MagicMoonlight 5mo agoI don’t know if that’s really true. Nobody would really give a shit if you leaked where everyone goes to college… because it’s already on their LinkedIn or whatever. The only people it’s valuable for is the ransomee, because they don’t want the reputational hit of having their data everywhere.
- HDBaseT 5mo agoIt really isn't as simple as that. You are leaking email addresses that likely otherwise wouldn't be out there publicly. Whilst email addresses and names are "effectively" public, they aren't just in a one big database anyone on the planet can access. Every single one of those email addresses will receive increased spam and phishing attempts, with more isolated information (such as School, First+Last Name, Subjects, Teachers/Lecturers, etc) the phishing attempts can be more refined. i.e, Student receives an email that looks like its from their school (has email footer, has student name, has relevant teacher name, subject name, etc), the user is now more likely to click some sketchy link. These little identifiers add up, especially when cross-references with other leaks. Even more problematic when most of the users wrapped up in a leak like this are under 18 too. A lot of this stuff could be done previously, although the effort and scale to do so would of been higher/harder.
- SoftTalker 5mo agoDepends on what they actually got. Names and email addresses? Considered public and are not so valuable. Universities usually publish those in a directory anyway. Messages between students and instructors? Likely pretty boring, but possibly embarassing or confidential for a given individual. Grades? Could be a FERPA violation. Critical PII such as SSNs? Probably not in the LMS to begin with.
- gopher_space 5mo agoFamously summarized by Kipling https://www.kiplingsociety.co.uk/poem/poems_danegeld.htm https://www.kiplingsociety.co.uk/poem/poems_danegeld.htm
- esafak 5mo agoTIL https://en.wikipedia.org/wiki/Danegeld https://en.wikipedia.org/wiki/Danegeld
- BennyH26 5mo agoAnd that’s exactly why the incidence of kidnapping plummeted in Italy once ransom payments were made illegal
- latexr 5mo agoHow does that work? I.e. say a kidnapping occurs and the ransom is paid. What kind of trouble does the paying party get into? A fine? Jail?
- bluGill 5mo agoSo long as the potential payer knows they will get something they are going to slow down. They might pay, but suddenly becomes harder because they have to hide what they are doing. Many won't figure out how to pay. The real value though is enough people consider themselves honest and won't do anything they know is illegal. They already hate dealing with criminals, but so long as paying is legal they might do it, but as soon as it affects their moral code they won't. The whole system collapses because just a few people saying no to paying means the kidnappers lose money on too many operations.
- latexr 5mo agoI understand the mechanism and the point of making it illegal, that’s not the question. What I want to know is what exactly are the lawful repercussions for the person who paid.
- jasonfarnon 5mo agoA fine or sentence is probably on the books but it never comes to that. The main thing is to freeze the family's assets, and more importantly to publicize this procedure so the mafia or whoever knows there's no point in threatening the family.
- mlyle 5mo agoThere's one more piece that matters. If no one pays the ransoms, but people believe that large ransoms are paid-- you still have the crime.
- Ancapistani 5mo agoThe obverse is true - because a ransom organization is dependent upon their reputation, a company claiming to have paid and received confirmation from the group could prevent them from releasing it as well. The general public (including the next victims) don't have a way to confirm if payment was made. ShinyHunters would have to choose between arguing publicly that they were not paid or not releasing the data to protect their own reputation...
- mlyle 5mo agoGood/funny observation. Game theory and economics are fun. :D I do think that the partial information problem relating to new entrants into this market is interesting though. The number of potential threat actors with partial/no information but that might speculate based on grandiose visions of ransom or outdated history is high. We see dumb attempts at real-world ransoms/extortion which don't get paid at a pretty high clip based on this kind of partial knowledge.
- HDBaseT 5mo agoIt's an interesting idea, although I think in the heat of the moment, the last thing your org should be thinking of will be playing games with one of the most prolific hacker groups on the planet. You'll probably get your data leaked anyways, potentially get compromised again (see Instructure situation) and end up in a way worse place if you just shut up and paid it, or let it leak normally.
- protocolture 5mo ago>but everyone would be better off if no one paid a ransom. I doubt if everyone would be better off if state level actors found and used these vulnerabilities instead of ransom seekers.
- ergocoder 5mo agoWhy don't someone pretend to be ransom hacker, take the money, and release the hacked data anyway? This will progress the game theory to the point where nobody will pay ransom because the thieves won't honor the deals anyway.