2 ms·
... except that "policies" don't cut it. Criminal penalties for paying are what you need, and not just for payments to specific designated entities, either. The
by Hizonner 5mo ago
... except that "policies" don't cut it. Criminal penalties for paying are what you need, and not just for payments to specific designated entities, either. The executive making the decision to pay has to have a real fear of personally spending time in actual prison.
- gnopgnip 5mo agoUS law has criminal penalties for paying a ransom to a designated criminal terrorist organization or under treasury sanctions.
- esseph 5mo agoMost hacking groups don't fall under that. Some, sure.
- cortesoft 5mo agoA criminal penalty is a form of policy
- Hizonner 5mo ago... but not the form of policy they actually have. Except for payments to specifically sanctioned organizations, the policy is "we'd really rather you didn't do that, but whatever". The specific sanctions don't cover most of the groups, either, and even when they do cover the group who got paid, you can't necessarily prove the people who got paid were the ones on the list. And there may be a scienter requirement even then; I don't know. Making a list of specific criminals you can't pay is just stupid. No ransoms, ever, period, or it's da slammah.