https://www.theverge.com/2020/8/4/21353842/garmin-ransomware...
For the TSA it is illegal to collect the information, but apparently it is not illegal for the outsourced companies.
Also, in Garmin's case it was not illegal for Arete IR to offer the service of ransomware negotiation.
It seems to me data collection is illegal, so TSA doesnt do it directly -- the problem is that TSA intends to collect, and knowingly (and provably?) works around it, but is not being punished for it.
Nevertheless I think they are doing a bad thing, because you can rest assured that this collected data won't get deleted, possibly even sold to 3rd parties.
I wonder if it's kind of a "it's small fry, and these businesses are getting their data back, we'll turn our backs to it unless it's actual violent terrorists receiving ransom money" sort of thing.
Middleman: OK, hand us the encrypted data and 125% of whatever the ransomeware is asking.
Middleman: Outcome A: Here's your data back. Outcome B: We were unable to get your data back, here's your full refund.
It takes legwork to establish intent, which is why justice is never carried out very quickly.
No.
> I wonder if it's kind of a "it's small fry, and these businesses are getting their data back, we'll turn our backs to it unless it's actual violent terrorists receiving ransom money" sort of thing.
1. It's difficult to believe that organized crime isn't involved in at least some ransomware schemes.
2. Is it illegal to pay protection money?
Still it's a pretty weak loophole bypass.
What laws would it violate?
I see what you did there. Well played.