It's the sort of thing you say publicly, but then privately you settle with your adversary.
Absolutism is never a useful tactic.
That sounds pretty absolutest.
This has nothing to do with that idea.
The reason the orgs paid the random once was because they had a severe lack of backup and other data safety protocols in combination with a vector to be infected (from all what we know, the latter is common and difficult to avoid): paying the ransom is likely their only choice to maintain the business.
It is not surprising at all that these orgs can and will be infected again, and will continue to show a lack in the security and data safety departments, and so they will continue to pay ransoms.
It's sort of an inverse survivorship bias: if you get infected once because you're susceptible, you're likely to get infected again unless you fix your susceptibility.
I would be totally fine with legislation making it illegal to pay in the case of ransomware attacks. Some companies might be completely destroyed by an attack that they can't pay off, but that is for the greater good of society: if criminals know companies have a low probability of paying since they're legally barred from doing so, they're less likely to target them.
Having US govt. on your ass should a decent deterrent.
Just take a look at how hard FBI came down on cartels and individuals who were involved in killing Enrique Camarena. Cartel leaders were arrested in Mexico and several individual in the US.
The US cannot really send special forces there without risking a massive escalation.
Also, the US and allies can enforce Russian AML laws as written on paper. If, say, the UK freezes all of Oleg Deripaska's assets there, Vova will absolutely get the message. We're not going to bring down the Russian government with military force for a million different reasons, but doing it with sanctions and prosecution is a totally different story.
But sending a spy to a software developers house and assassinating them probably isn't going to stop the problem - more people will spring up doing the same.
Russia has always been notoriously hard to spy on.
I would not be surprised if there was only a handful of well placed assets and most of the spying being done electronically.
https://threatpost.com/ransomware-hits-hospitals-hardest/162...
My opinion would be the hospital should open up to the police and accept their fate whatever the outcome. The gov./police makes the calculation of the impact of X people dying a very public way, the Y amount that is requested, and the ton of other wildcards (e.g. can we catch the gang now ? after the ransom is paid ? void the ransom some way afterwards ? limit the number of death in other ways ? what will the other victims take away fom this case ?).
At the end of it there should be a custom approach to that specific situation and not some blanklet policy application.
This also assumes a cooperative and somewhat decent police force, which might not be the case everywhere (but then I think we're screwed anyway)
In order for this to be a useful tactic, there needs to be no defection. The only way there can be no defection is if the legislature prohibits defection.
At that point, the hospital is on notice that they have to apply adequate security measures against this kind of attack. For instance, hospitals normally have power supplies that are capable of getting them through foreseeable blackouts. If they're going to rely on computer systems in the treatment of patients, they had better make sure they're secure. Right now, today, it isn't a surprise.
And the hackers are on notice that they are effectively killing the patients. The hackers are after the money. If the threat of death will get them the money, they're all for it. If it won't, they'll move on to a country where it does work.
The word 'terrorists', for one. It's mostly used to mean 'my opponents' these days.
What we are facing with ransomware is not insurrectionists or protestors, but gangsters. They make their living by stealing from people, cheating them, and threatening them. Many insurrectionists are honourable people that you can safely make a deal with. There is no gangster with that property.
Take backups, test the recovery procedure, don't make bargains with gangsters.
That's the theory. But much like war on drugs or TSA, whether its real-world outcomes match the theoretical ones is debatable.
https://www.newamerica.org/international-security/policy-pap...
https://cisomag.eccouncil.org/paying-ransom-is-now-illegal-u...
And then everyone clapped at the high-brow analysis.
You might even want to establish an isolated society, but if you try, good luck dealing with the IRS.
And on a purely primal level it's common to prioritize one's offspring over one's self. I think most cultures recognize this intuitively.
What a grand delusional statement, like the sibling comment here. It’s literally arguing moral superiority while ignoring pragmatic reality.
Maybe you watch a little bit too much television, but there are plenty of spouses out there who would, for example, not want their wife to die in childbirth if they had the option.
Not to go too sideways, but hostage (with humans, not data) situations are typically about other people. When you’re the target, it’s not your life on the line, but your loved/valuable ones. So you’re not defending just yourself, you actually have to care about at least someone else to have it happen to you. And some care about a lot more than just their loved ones, they’ll also think about their friends, family, sometimes the rest of the society.
Everyone is different and there is no absolute best, but let’s at least recognize it’s complex and there’s lots of ways to think about it.
One of them is you are ready to lose the hostage in the worst case scenario. That’s how the police sees it, because the society benefits more from being firm in individual cases than losing a few of its members that might not come back anyway.
That’s a hard one to swallow, hard enough that govs also sometimes can’t follow the mantra and just pay the ransom.
It’s crazy hard to get people to sacrifice themselves for the better good, it’s yet a bigger ask for corporations who already screw the public day in day out.