I would have used this stanza as I think it's a little more applicable in this situation:

"We never pay any-one Dane-geld,

   No matter how trifling the cost;

For the end of that game is oppression and shame,

   And the nation that plays it is lost!"

As another commenter said, individuals can prevent themselves from being victimized again by starting a regime of proper backups. It isn't as ideal as arresting the motherfuckers and sentencing them to 25 years in federal prison, but it prevents an individual from being labelled a mark.

On the other hand, when the FBI says 'just pay it', I'd argue that it makes all of North America more vulnerable. The end of this game is oppression and shame, and the nation that plays it is lost.

The U.S. Constitution actually has provisions for legally doing that. Lobby your congressmen to issue "letters of marque and reprisal", which Congress is authorized to provide precisely for businesses to engage in warlike behavior against pirates et al, which includes the modern form in "ransomware".

Is it?

From the perspective of the hacker, the hacker's best move is to take the money and simply demand more. There's zero incentive for the hacker to return the victim's data.

This becomes a probablistic situation: the approach I'd take if I were a victim would be to borrow an analogy from poker for the problem of deciding whether to call in order to possibly win a pot. First, I'd determine how much the data is worth to me, and use that to determine my "pot odds":

    pot_odds = ransom / value_of_data

    odds_of_data_being_returned ~= times_data_has_been_returned_after_ransom_paid / times_ransom_has_been_paid

    if pot_odds < odds_of_data_being_returned:
        pay_the_ransom()

1. "Many of these outfits" is not all: we still need a way to determine whether we should pay a ransom.

2. I'm sure I could manufacture a support forum which shows me to be trustworthy in an afternoon.

For (2), could you also find a way to get the FBI to release a statement saying you are trustworthy?

How so? Presumably they use a different one for each payment, no? Otherwise, how could they tell who paid?

http://www.coindesk.com/cryptowall-325-million-bitcoin-ranso...

Is it?"

Also, think what would happen if a ransomer failed to give the data back after being paid. The only benefit for the ransomer on that mark is to then say, "No, now I want x-more dollars." What is the mark going to do then, once the ransomer has proven untrustworthy? Give them yet more money?

I do buy the reputation argument when applied on a larger scale, though. I didn't realize that some of these operations were as large as other commenters have pointed out.

And while initially ransomware operators quite "solid" and for lack of a better word "trustworthy" the popularization of it lead to everyone and their mother writing ransomware in hopes to get a quick buck.

In those cases you can't even rely on the encryption being recoverable because the malware it self is utter garbage and the criminals don't care or don't even have the technical skills to operate a full ransom cycle campaign.

It's not uncommon to see even fairly fresh ransomware examples in the wild with dead BC wallet addresses, banned paypal, skrill (and other transaction providers accounts), incorrect routing numbers etc.

This ins't 5-10 years ago where some ransomware would actually give you a voip phone-number/skype/email to call or mail and you would get to speak to some Russian or Malaysian guy give them the money and actually get a key to recover your data.

Sure some ransomware operators still operate that way, some have more sophisticated automated systems with C&C servers but most figured it out that it doesn't matter because they are in it for the quick buck and well if you are going to commit a crime then what not fraud/scam your target in the same swoop.

Ironically this reality lead to the more established organized crime organizations that employ ransomware to generate income to actively fight against the new waves of quick cash ransom scams because they need people to still have some trust in the fact that they can get their data back if they pay.

And if you don't get the parody reference -- it's to the classic "You Bash the Balrog".

That one's a reference to a ST:TOS episode.

https://www.youtube.com/watch?v=FPvw0mHbyd0

This is assuming they bother to give back your data.

First, the ransomers have every incentive to actually abide by their promise to decrypt. In essence, they're running a business. Whereas in a kidnapping situation, ransoms are high ransomers tend to stay anonymous, and risk is high, with ransomware the monetary amounts involved are low, the ransomers typically conduct their actions under an established pseudonym, and the risk in upholding their side of the bargain is low. If they were to not hold up their end of the bargain and it became known that "LeetSquad" doesn't actually decrypt data, victims would stop paying. This would be a disaster.

Furthermore, while it's correct that a victim who pays signals their ease of being shaken down, again, the economics of the situation work in the victim's favor. These attacks aren't targeted. Given an effectively endless supply of potentially-paying victims, direct targeting is unnecessary, wasted effort. And again, risk of reputational damage is high. For evidence, look no further than this FBI recommendation!

For further evidence, consider the fact that in practice, these groups overwhelmingly keep their promises and don't appear to specifically re-target previous victims. They even, no joke, have online support staff who will work with you in the event of difficulties unlocking your data!

I had the idea once that one way to combat these groups would be to run a PR and news campaign attempting to convince the general population that ransomware groups will take the money and run, and that they'll just come after you again. Even if it isn't true, a successful campaign might do some serious damage to their profit margins.

This would be not enough IMO. Creating and spreading malware that takes money and NOT decrypt data will probably do. PR and news will follow. (And give that money to orphans or starving as a self-justification :)

The hacker wants to be trustworthy here so that new victims will be more likely to pay the ransom because they believe they will actually get their data back.

This might be one of the smarter moves to make so long as you kept your identity as a victim anonymous so you don't get retargeted by the ransomer.