Re:Instructure Pays Ransom to Canvas Hackers
by Hizonner on Tuesday May 12, 2026 @01:39PM
(#48111569)
... except that "policies" don't cut it. Criminal penalties for paying are what you need, and not just for payments to specific designated entities, either. The executive making the decision to pay has to have a real fear of personally spending time in actual prison.
[ Parent
| on HN ]
Re:Instructure Pays Ransom to Canvas Hackers
by cortesoft on Tuesday May 12, 2026 @04:15PM
(#48113870)
A criminal penalty is a form of policy
Re:Instructure Pays Ransom to Canvas Hackers
by Hizonner on Tuesday May 12, 2026 @09:51PM
(#48116912)
... but not the form of policy they actually have.
Except for payments to specifically sanctioned organizations, the policy is "we'd really rather you didn't do that, but whatever".
The specific sanctions don't cover most of the groups, either, and even when they do cover the group who got paid, you can't necessarily prove the people who got paid were the ones on the list. And there may be a scienter requirement even then; I don't know.
Making a list of specific criminals you can't pay is just stupid. No ransoms, ever, period, or it's da slammah.