I don’t think criminalizing the victims recovery attempt is the best way to solve this.

Compare this to a street crime: One might say that muggers would be deterred if it were illegal for their victims to cooperate; if you have to fight back instead of handing over your wallet. But, at what cost for the victims?

If we don’t think that companies are doing enough to protect their systems, then we should pass laws that require certain demonstrable standards at all times. We shouldn’t wait for them to become a victim before the law requires them to do anything. It’s too indirect and situationally unaware of a solution.

I think laws should be written so it’s easy to know when you’re in compliance, and easy to know when you’re not. “Don’t get hacked” is basically an impossible moving target, particularly for small organizations. “Follow these best practices” is a much more reasonable standard. And we already have government organizations that put together standards for this, all lawmakers need to do is cite them.

Companies could just use intermediaries, transfer the money to somebody that transfers it to the hackers. They could even do it fairly openly: They're not paying "ransom", they're paying a "consultancy fee" for assistance in dealing with the issue.

That's not to say it shouldn't also be made illegal or in some other way difficult to pay (they could, for example, ban crypto currency use for the purpose of paying ransoms, or whatever-- just tossing out ideas)

Banning ransoms alone isn't going to work. Companies already have liability for things like customer data breaches, and that hasn't eliminated them. We also need some sort of legal framework-- especially for large pieces of infrastructure-- for defining appropriate security procedures that must be followed. Also tie it to the ability to get government subsidies/grants etc. That's how it works in Higher Education: If colleges don't adhere to to DoE regs, they simply can't accept financial aid money given to students by the government. It's actually something that's audited with fines levied on a regular basis. Few schools if any ever lose the ability to get aid, but that's because the regs are enforced and fines are high enough to hurt.

Really though I don't think you can stop this completely. We might say "every company can afford to get security right" etc., but they won't: Some will barely even try, others will simply be unlucky and out of 3,000 employees, one will slip up. The nature of this sort of attack is that on defense, you have to be 100% successful all of the time or you're done, and always having a perfect record is not a realistic expectation for all organizations.

The problem is that for the hackers, this is a low risk, inexpensive, high reward process. As much as security has to improve, so does that equation. If there was a physical attack that shutdown the pipeline it would easily be labelled an act of terrorism, and these should be seen the same way, with the same level of resources used to go after anyone involved in these attacks.

If the colonial pipeline hadn't paid the ransom there would be pandemonium on the east coast as people were forced to ration gas. I don't see how that helps. As long as computers exist they will be hacked. Spending more on security can help but can't stop it.

Colonial Pipeline ended up restoring data using their own backups anyway. They paid $5 million dollars for a decryption tool that was so slow that their own IT team was able to restore service sooner.

https://www.bloomberg.com/news/articles/2021-05-13/colonial-...

The article says they used backups to help restore the system. That tells me that the backups weren't fully up to date, and that the missing info was worth 5 million.

Isn’t it already extremely difficult to know whether you’re committing a felony by paying a ransom? You’re sending millions of dollars in bitcoins to an unidentified group of known felons; if they are (or are affiliated with) a group dedicated to the violent overthrow of a government, then congratulations, you’ve just provided material support to a terrorist organization.

The US Treasury Office of Foreign Assets Control specifically warns about the legal risk you take by paying a ransom here: https://home.treasury.gov/system/files/126/ofac_ransomware_a...

“The [US government] is the world’s biggest terrorist organization.” –Noam Chomsky

Source: https://youtube.com/watch?v=vRbnPA3fd5U

The same could be achieved by banning the formal exchange of cryptocurrencies in the USA.

If you can't buy the coins, you can't pay the ransom.

All you get at that point is the right people using it to prosecute the honest people.

I think it would just give CEOs who want to do the right thing (and not pay) legal cover to tell the board of directors "Nope, not paying — the company is going to be shut down for a month. Deal with it, I'm not going to jail."

What if it was more than a month? What if it was.. permanent?

Then they totally failed at continuity planning, backups... a whole lot of things.

And it would give CEOs who want to do the wrong thing an avenue to destroy competitors under the table.

You could always hire a bunch of shadowrunners to destroy your competitor's computer system, but I don't know what that has to do with ransomware.

But hey, I guess you could use cryptocurrency to pay the runners.

This has always been true... and always been illegal.

All that guarantees is ransomware attacks morph into existential threats. You're locked out of your data with no recourse.