Also imagine how well this would go - your child was kidnapped, but now you have to go to prison because you had the gall to make sure they go home safe.
Like, I get your point, but it's one of those armchair social science ideas that can go into a cabinet full of really cool and really obvious ideas that won't ever be implemented in reality.
They often are taken seriously. The problem is most of the ransomware gangs operate out of Russia, and Russian law enforcement permits the activity if Russian citizens aren't targeted. (There may be a short blacklist for citizens of some other countries allied with Russia, as well, but targeting and profiting from citizens and companies in America and Western Europe is explicitly allowed.)
If you're the FBI, there's absolutely nothing you can do about that if the ransomware operators never leave the country. You can try to lure them out of the country - and this does happen sometimes - but if they're smart enough to never leave, they're basically immune to all repercussions.
The Justice Department can publicly indict them, and they sometimes do, but they're just going to laugh at it; it simply increases their street cred and respect among their peers. "I'm on the FBI's Most Wanted lol." You can go after the infrastructure, but as long as the people involved are allowed to operate freely and continue to have lucrative incentivizes, it's only a minor annoyance at most.
So if the choice is presented as "do I not pay the ransom to reduce the chance of further kidnappings by some completely undefined %, or have my child harmed with nearly 99% certainty", who could ever chose not to pay it? What sort of mind gymnastics would you go through to justify not paying it in that case?
It’s like pollution or recycling. Why spend the effort and cost to do it if the benefit is only to future generations or society as a whole (ignoring the few who do it for their own sense of self-satisfaction)? That’s why we have things like penalties for pollution and carbon credits.
These people are externalizing the cost of their actions. At the very least we shouldn’t allow ransom payers to externalize the real cost of the ransoms to future generations and society as a whole.
Making ransom payments super illegal wouldn't stop them from being made. People(parents in particular) would absolutely try to find a way to pay the ransom anyway to save their children, no matter the consequences. Like I said in another comment - what kind of punishment would stop the parent of a child in danger from paying the ransom? Years in prison? Most parents would gladly make that trade to make sure their kid goes home. There isn't a punishment here that you can establish to absolutely eliminate ransom payments, and as I'm sure you can see - as long as *any" are paid, criminals will keep using them as a tool. So imho, any effort(and therefore money) spent on fighting the ransom payers is completely wasted time and money. Not paying a ransom does not reduce the chance of further kidnappings significantly enough to make it worth it, and I'm nearly certain you can't come up with a punishment harsh enough to scare people away from making the payments.
You can read what I wrote here about teh great firewall. https://news.ycombinator.com/item?id=27103646
"No more drugs" is not the goal, neither is "no more ransoms." The goal is to reduce the reward for ransoms so that it is disincentivized to some degree.
If our disagreement is on how to stop X to an absolute degree, then I would agree with you for all Xs that it would be impossible, whether X be ransoms or logical fallacies.
Come on. You would really make that decision if your child were kidnapped?
Also I'm not sure how the fine would even be decided to be effective? 3 years in prison? Would absolutely gladly trade it for the life of my child. Probably any amount of time in prison would be spent gladly in order to save your child. And once we start throwing ideas like life imprisonment(because really, can't go much higher than that) it would be struck down as not proportionate to the crime.
By this logic the Great Firewall of China is a massive failure because some guy, somewhere, was able to access illegal content from China. But that's not the case. It works quite well to control public opinion and it doesn't have to be 100% effective at blocking content to do so.
The same applies to disincentives to ransoms. Of course some people will still pay ransoms. But why let criminals have a monopoly on the market? The total ransom someone can pay is fixed by the market (basically how much your child is worth to you and how much money you even have, otherwise there'd be no ceiling on ransoms). Since the government is in on the action, the revenue from ransoms is split between fines/jail time/criminals. If the government's actions are decided ahead of time, and cannot be changed based on any single ransom attempt, then kidnappers will know that their potential income from ransoms will be severely cut, thereby disincentivizing ransoms by some degree. The degree to which it is disincentivized depends on how good of a competitor the government is in the market (enforcement/detection of ransom paying events).
> Also I'm not sure how the fine would even be decided to be effective? 3 years in prison? Would absolutely gladly trade it for the life of my child. Probably any amount of time in prison would be spent gladly in order to save your child. And once we start throwing ideas like life imprisonment(because really, can't go much higher than that) it would be struck down as not proportionate to the crime.
These are implementation details. If there is no ceiling to what you will pay/rob/steal/do then don't let the kidnappers out there know! But also, you'd be a massive liability to society assuming other people don't care about your kid as much as you do, since criminals can leverage you to a 100% degree. If they know this about you, they don't even have to estimate your net worth. They can get you to go rob a bank instead!
Which are what a plan is made of. If you live in a democracy and not a dictatorship, you have about a 0.0002% chance of keeping the parents of a kidnapped, murdered child in jail for more than a day for the crime of "attempted ransom paying" without you and your family becoming pariahs and being screamed at in public places, and your political party being annihilated from politics even after press releasing your expulsion.
It's not just the parents that would have to sacrifice.
I think you're right that imprisoning people for paying ransoms would probably decrease the probability that a victim would pay a ransom. And imprisoning people for blasphemy would probably decrease the probability that someone would take Jesus's name in vain. But I'm not sure how useful it is to discuss things like this. (And, for the record, I also think it's unconscionable that the US imprisons people for simply using drugs.)
And then there's the question of overall efficacy: it disincentivizes a lot of potential drug use, but does it also disincentivize drug sales? Does banning drug possession decrease the amount of drugs sold? I don't know. They could always just try to sell to more people than they otherwise would have.
Similarly, ransomers could just go for more of a spray-and-pray approach and ransom more victims per unit time to offset the fact that there's a lower probability that any one victim would pay. They could also hike up ransom prices to offset it, so that each victim is hurt more even if there may possibly be fewer total victims.
I think even if it did objectively, inarguably decrease the amount of ransoms - which I acknowledge is plausible - it'd still be completely unethical and an extremely terrible idea. But I'm not even sure if it would. We aren't exactly winning the War on Drugs by penalizing drug use, and I'm not convinced we're going to win the War on Ransomware by penalizing ransom payments. And even if we could win both those wars that way, I think it'd still be really fucked up and major governmental overreach.
There are a lot of issues with this idea, too, but I'd be more sympathetic to the ideas some others have suggested in this thread: bring back letters of marque and reprisal and provide some legal structure for American/European citizens to target international cybercriminals in certain countries and perhaps also take money from them and keep a percentage of the proceeds, etc. I'd be way more in favor of vigilante justice against perpetrators as a remedy compared to draconian punishments against victims. These people currently face absolutely no repercussions, so adding some repercussions may help deter them.
These situations involve complicated moral dilemmas, but thought experiments never take into account all possibilities, and at some point idealistic principles about the general problem have to give way to pragmatism about the immediate problem.
To give an extreme example, if someone had a button they could push that would end the world as we know it, and they demanded you pay them $1B or they'd push it, are you really going to argue that paying that billion dollars is the incorrect response because it would encourage future people with the ability to end the world as we know it to demand ransoms?
Well he wouldn't have been kidnapped in the first place if we disincentivized ransoms!
> To give an extreme example, if someone had a button they could push that would end the world as we know it, and they demanded you pay them $1B or they'd push it, are you really going to argue that paying that billion dollars is the incorrect response because it would encourage future people with the ability to end the world as we know it to demand ransoms?
Your example is indeed extreme. It posits a game with 2 players, the world, and the entity trying to end the world. In a 2-player scenario where you lose if you don't do some requested action then you would have no choice but to do it. However, in an n-player scenario where n > 2 and player "x" being the one wanting to win by ending the world, and assuming all other players can win by cooperating, then yes the world government should indeed forbid all players from paying the $1B ransom.
It's a well established fact that if ransom demanders know that ransom payers are subject to significant fines and penalties, their power to demand ransoms drastically diminishes.
Can't collect in cash? That's a-ok. Do me a favor and you get your kid back.
You are not talking a lick of sense. Crime finds a way. It always will. You can't tax law abiding people to invalidate criminal economic models. All you do us disadvantage the victims, undermine the legitimacy of your legal edifice by implicitly raising it above those it serves in importance, and completely do away with any semblance of sanity, and maximize tge cost in human lives exacted from the pool of the falsely accused and victimized. Game theory doesn't apply. Rational Actor Theory doesn't apply. Addressing crime via draconian laws doesn't work if you're at all interested in any State even nominally centered around the concepts of Freedom and Liberty.
And a Ransom tax? Do you want tax collectors tarred and feathered? Or are you just trying to ensure that any remaining credibility in the government is irrevocably lost? Taxes lend legitimacy to things. You're basically admitting that a ransom is even a valid transaction by enshrining it in your tax code.
Absolute madness.
This is a bizarre and emotive discussion, so I'm not sure how much more it's worth saying, but I will leave you with one final question. What law could you possibly make and what "severe criminal penalty" could you possibly impose that would be greater than the natural law that parents would do almost anything to protect their children and what a parent would suffer if they lost a child? I don't believe anyone could ever implement the policy you've been advocating effectively, and at that point, the entire deterrent argument collapses anyway.
This kind of punishing of victims is draconian, unethical, and, in my opinion, basically insane, in addition to being impractical and very difficult to enforce. In some cases the victim's negligence is largely to blame, but sometimes it isn't.
And even when they are negligent, I think threatening to imprison them for paying a ransom in order to remedy something that may upturn their entire life and cost them far more (financially and otherwise) than not paying is just ridiculous.
There should be some kind of accountability and regulation for negligence, and any company that's hit with a ransomware attack should be legally required to report the attack to authorities and disclose it to their customers, but I don't think you can or should punish people for paying ransoms. You should try to punish the ransomers, and the people who obstruct punishment and shield the ransomers (like countries whose law enforcement permits the attacks and extortion and whose financial industry permits the payment handling).