It wouldn't work in this case. It will be similar to drug trade, where everything is hush hush and the price probably will go up. It will just push more innocent people into white colar crime.

You are running the company. You spend all your life getting to CEO position. And then boom breach and your company has massive loss, lawsuits and you are out of the job. Probably 9/10 CEO types will just engage in a crime to avoid that situation.

Current situation is way better. All breaches are public, prices are public, so the correct answer is to invest in security and if you get caught with your pants down, just pay the fee Let justice department handle it from that point on.

The way bank robberies are handled is the best. Just give them everything they ask for. In the end of the day it is either insured and even if it is not, it is stupid to risk anyones life for money created in fractional-reserve banking system.

> It will be similar to drug trade, where everything is hush hush and the price probably will go up.

It's somewhat more difficult for actual businesses to buy drugs, though, isn't it? The money would show up in audits and all that.

I assume that the money is just laundered and appears as clean money on accounts.

If drugs distributor has money in cash, they will probably engage in loaning short-term to ligitimate businessses with very predictable massive cashflows that pay in cash: construction, cleaning, farming, gambling etc. They don't even have to pay in cash, as long as they have cash receivables that will work as well.

They probably called something like Farming Loans Inc and deliver cash in the beginning of the month for business to meet their cash requirements. They either use it to pay their workers or will just deposit into their account as revenue. Month later they just send me back the check,that is loan pay back that is 100% clean money.

Obviously they will need to manage Farming Loans Inc balance sheet to explain where the seed money for loans are coming from, but that's where white colar crime comes in, where not so good accountants and lawyers will cook books.

For ransom money, the system will be even more cleaner. Somebody will create offshore consulting security firm, that will engage clients in return for consulting fees. So if somebody has breach, they will call them and like we need some consulting. Consulting firm will talk to ransom guys, get keys and then bill the client. So if you accountant and look at the balance sheet of multimillion dollar company, you will see consulting fee invoice and that is pretty much it. For IRS or FBI to dig any evidence, they will have to get a whistleblower plus somehow get the documents of offshore company, which makes it impossible.

In the end of the day white colar crime is 100x bigger then anything to do with drugs/ ransomware and it starts early, because the system pushes people to behave this way and 100% trust base and a lot of behaviours are 100% legal.

The good example is retail brokerage companies that encourage day trading, options trading, FX pares trading. This is just a scam, but hey why not.

While I understand the sentiment, there needs to be a reasonable alternative here. You can’t ask people or organizations not to protect or recover their property if they have no other recourse.

I don’t know much about this travel agency. They may or may not have had a security team. What they did have was mentioned in this article: liability. They took steps to reduce or eliminate this liability. I think we all know that there’s no proof these attackers acted in good faith past the actual decryption, but now CWT can at least say they attempted to recover lost data.

I think we can only realistically hold companies liable for transactions like this when we have better government resourcing and oversight. Getting the FBI involved in stuff like this is difficult, as they’re over loaded with such cases.

I also feel we should never hold individuals liable for stuff like this. It’s unreasonable to expect people who aren’t security professionals to know how to defend or respond to threats like this given how rapidly the landscape changes.

Figuring out a good way to holistically deal with cyber criminals will probably be a problem we struggle with for years, if not decades.

How about a tax on paying bounties that is used solely to fund agencies that track down and put those engaging in criminal activity online in jail. In order to be allowed to deduct the expense require paying the tax.

I think this is a step in the right direction, but I'd expand this to be a tax on all organizations that maintain large enough systems to become targets because:

1. Taxing only the victims is adding salt to a wound: these companies are already hurting from being attacked, lost money to the ransomer, and are likely to lose more shortly thereafter due to bad PR. They'll need this money to fix things and hire/consult appropriate experts.

2. Taxing all parties likely to be hit by stuff like this spread the financial burden amount companies of all sizes. Larger companies/targets can thus help protect smaller outfits that aren't well enough funded to field a robust security team or program.

3. Some kind of revenue stream is required here to beef up federal/regional programs relating to cybersecurity. There's no real source of funding for this that doesn't come out of a larger budget. The scope of the problem is large enough that I feel it justifies a specialized agency with it's own budget. Having a dedicated tax applied to parties with need for the service/support seems fair and progressive to me.

It's almost like there should be some national security agency whose sole purpose would be to uncover this kind of activity and help those impacted. I wonder what I'd call it?

No Such Agency!

Jokes aside, I absolutely agree that this is a failure of the US federal government and congress. We should have answers for these things for now, or at least the beginnings of a national security program to combat cyber crime. The FBI is seriously overwhelmed and the other three letter agencies can't be bothered to play the blue team as far as I'm aware.

Isn't this likely short sighted in the same way that people talk about draconic enforcement of immigration laws?

Criminalizing ransoms will result in victims doing it in secret, not in the elimination of ransoms. People won't be able to share information, and the financial incentive will continue to exist.

If you were a corporate executive would you risk hard prison time just to save your employer from taking a loss? The whole point of imposing draconian penalties is to make such attacks unprofitable. If the attackers know they won't be able to extract any money from victims then they'll move on to some other scheme.

Executives don't go to jail when their companies kill people. There's no way we manage to restructure our justice system so that they go to jail for paying ransoms.

There are reasons why companies manage to do tons of illegal things. A lot of executives would have a good amount of their wealth in company stocks, for example. This has no reason to be an exception.

> If you were a corporate executive would you risk hard prison time just to save your employer from taking a loss?

Uh, have you looked at all the corporate scandals of the last, say, 40 years?

White collar execs never do hard time anyway. At the absolute worst they get 6 months at some cushy minimum security... aka Club Fed.

Banks deal with cartels and other bad guys, they make lot of money and pay a small fine when they get caught. Why do you think paying ransoms would be different?

I'm curious, how do you feel about people paying ransom for traditional kidnappings? Same logic, or is it different?

In general paying off kidnappers is also a bad policy. However I see a huge difference between protecting human lives versus protecting corporate assets.

Ok, and now a hospital with critical medical information gets hit by the ransom. What then?

Well in the case of UCSF, they paid $1.14M[1].

But really, I expect such a law would provide for exceptions, with a maximum payout capability. And for such a law to come after an offsite airgap backup requirement for such entities.

But really, the answer is that the equivalent physical criminal action: walking into a hospital and absconding with all of their medical records, would result in criminal action against the thief. Their actions may be akin to manslaughter if deaths result.

[1]: https://www.ucsf.edu/news/2020/06/417911/update-it-security-...

What's the difference?

Cut deeply enough - take out entire companies - and people lose their jobs.

People can't eat. People lose their health insurance that allows them to afford their life-saving medication.

At some point, it's not just "big corporations"; it's the people that work for them, too.

"People lose their health insurance that allows them to afford their life-saving medication."

Only in one country on the planet.

Job loss is not the equivalent of death. Full stop.

Tell that to a family where both parents are unemployed, they got 2-3 kids, a mortgage, a couple of maxed credit cards, they used to live paycheck-to-paycheck, one of the kids needs special care that the state doesn't provide due to budget cuts.

Now take this scenario to every major financial crisis (e.g. USA today, Latin America for the past couple of decades, some EU countries hit 20-30% unemployment a decade ago, and are still recovering).

It won't kill them instantly but consider what it does to them, if it turns them to crime, alcoholism, depression, and the general impact on the quality of life.

That’s an incredibly naive way of viewing things. Not everyone can afford losing their job. Let’s say job loss increases your chance of dying by 5% — not an exaggeration in some communities — 20 jobs lost is exactly the same as one death.

There's a very specific value of human life: https://www.npr.org/transcripts/835571843

Reading "Never Split The Difference" - sounds like the police will work with families pay off kidnappers is some countries, but get it down from millions to a token amount. I think he aims for zero though most of the time.

I liked the part about delaying the negotiations until Friday in (I think) Haiti, because they realised a lot of kidnappers just wanted money to blow partying on the weekend. They got away with paying a lot less.

Police/authorities want to do that because (perhaps) there is a connection between crime and terrorism. Meaning that, if you pay $100m to the kidnapper, 50% of that amount will end up funding <insert terrorist org>. They want to drain this to the lowest possible amount.

It seems to be a necessary part of the strategy though as the negotiation also helps to delay and buy time for escape/rescue.

They sometimes paid the amount. In some countries that was probably seen as a better plan. It probably depends how loose the cannons are.

> "However I see a huge difference between protecting human lives versus protecting corporate assets."

The idea that there are fundamental differences between human lives and corporate assets is flawed. There's a very specific value of human life: https://www.npr.org/transcripts/835571843

The value of human life is orthogonal to economic value, and doesn't follow the same rules. It works like fine art. The price of art doesn't move towards a final value; paintings bought and sold for centuries still appreciate faster than inflation. They aren't getting any better, the only thing that's changing is the amount of money people have to spend on paintings.

Human life appreciates the same way. In some number of years the government will decide that the economy can sustain valuing human life at a trillion dollars. And they'll look back at us and see that we undervalued life in the same way that we can look back and see that the Romans undervalued human life. Lives are worth whatever we can afford.

> Wrong

They said they saw a difference.

They didn’t say other people didn’t see a difference.

>"They said they saw a difference."

Which would be the point, that there are no fundamental differences between corporate assets and human lives.

If I say I like cats, and you find an article saying someone else doesn’t like cats, that does not mean I’m mistaken on the fact that I like cats.

You seem to think they said that ‘everyone sees a difference’. They didn’t. They said ‘I see a difference’. They’re only ‘wrong’ about that if you think they’re lying to us about their own personal position.

I edited my original comment to now say "The idea that there are fundamental differences between human lives and corporate assets is flawed."

Thank you for your logic lesson but I fail to see how this changes the discussion.

The main idea here is that prohibiting payouts might make the crime less frequent. That’s somehow reasonable given the relative low stakes involved—from a moral perspective, data is usually of a lesser value than human lives. Therefore, yes, those cases are very different indeed. For once, kidnapping a human being is already punishable enough by itself so it makes no sense to punish a payout that could actually save a live.

The only reason the kidnappings happen is because the payouts happen. If effective measures stopped any real possibility of payouts, the kidnappings would stop, too, saving a lot more lives.

Possibly. The previous argument stand either way.

Not the OP but I think it is clearly different, as kidnappers are putting someone's life in danger.

Maybe require cyber insurance instead, pricing premiums based on audits performed by infosec practitioners. Similar to auto insurance, and what happens when you’re a high risk driver; you still have insurance, but you’re paying out the nose for it.

Our current legal framework doesn’t support such a draconian suggestion as presented imho.

You want poor security practices to be painful, not fatal, to the corporate entity.

As a business owner, I can tell you that having a “cyber” rider on a business E&O policy can be eye-wateringly expensive.

As an infosec practitioner, I can’t tell you how many times I’ve seen someone have insurance and their security posture be effectively nothing, or the insurance not pay out even with reasonable measures in place. Market failure in my opinion, needs more regulation.

Agreed.

I’ve done a lot of infrastructure work, so my home network is...robust. Quite unusual; even for many corporations.

Two DMZs, three routers, three WiFi networks, two NAS units, etc. Also lots of redundant backups.

Our legal framework already contains many prohibitions on financial transactions with criminals and terrorists. It wouldn't be difficult to add one more.

My point is there are better, more reasonable ways to arrive at the same end goal: effective infosec practices that prevent ransomware attacks (among other threat actors).

Banning ransomware payments just makes it more difficult; someone will still find a way to save their business by paying. You want to resolve the root issue: a business not taking security seriously.

So you suggestion is to let any company that doesn't have the budget to have a proper cybersecurity team just die? I'll guarantee you that most of the small businesses that you encounter each day do not have such a thing setup.

> let any company that doesn't have the budget to have a proper cybersecurity team just die?

Are you implying that without a cybersecurity team, you'll fall victim to ransomware and be forced to pay up to stay in business? Because that's a false dichotomy - the simplest of backup solutions would have prevented this. And if a company can't manage the most basic offline redundancy for their critical business operations, I really don't have a problem with them going under. It's less burdensome than being compliant with the local tax code, which all businesses have to do already.

> the simplest of backup solutions would have prevented this.

Incorrect. The black hats almost always encrypt backups, too. You could say "what about offline, glacial backups?" But then you're no longer talking about "the simplest of backup solutions"

>"the most basic offline redundancy"

How many people you meet everyday that are not in IT even knows what offline redundancy means?

I think what your suggestion amounts to, is effectively a mandate on SMBs having either an in house security team, or a contract with a consultancy on cyber security. That's a huge burden. It's not really easier than local tax code. These things change much more frequently and it's not like you can just walk into a local H&R Block to take care of your cybersecurity needs. Ransomeware, as it is now, didn't even exist (or is that popular) 10 years ago.

> the simplest of backup solutions would have prevented this

A big part of the threat is the disclosure of sensitive data that they exfiltrated. Backups don't help this.

Not to mention that the pros delay encryption until they've managed to screw up backups, too.

I think this is where insurance can come into play. Like get a smoke alarm and sprinklers, but also get fire insurance.

An insurance would be a much better idea than what OP suggested.

Cyber insurance is already a thing.

Even though not paying the ransom is recommended, some companies are instead paying the ransom as part of their insurance coverage. For example, earlier this year Lake City, Florida was a victim of a ransomware attack. After receiving approval from their insurer. Lake City paid $460,000 in order to restore their systems. Since they had cyber insurance, the city only had to pay a $10,000 deductible.

https://content.naic.org/cipr_topics/topic_ransomware.htm

I don't think that budget is the problem. You can be very safe without a big budget. It's a lack of priority and management valuing quick development over security.

Why not make it a criminal offense for companies who don't take reasonable approaches to preventing such attacks in the first place? We place a lot of trust in companies that hold our personal data (e.g. Equifax), and I'd argue there need to be harsh penalties. The tools exist and guidelines are clear.

It shouldn't be the criminals penalizing them, but here they are filling the gap that the regulators ignored.

Not that but you could punish companies severely for the security practices that led to the hack. If those are high enough, it could make better security cheaper than paying randsom.

Or start small: tax these payments at a rate of 400%