Hacker News Reader

Comment by 627467 | Hacker News Reader

So, now, not only would law enforcement struggle at catching the criminal asking for ransom, they would additionally struggle to enforce the law on the victims

View on HN

No, enforcing this law on the victims would be much easier. The criminal is most likely in a foreign jurisdiction, and trying hard to hide their identity; the victim is in a local jurisdiction (otherwise, this law wouldn't even apply), their identity is known (on the jurisdictions I know of, companies must be registered with the government), and the government has a large amount of tools at their disposition to enforce a judgment (for instance, freezing and/or seizing bank accounts, or in extreme cases even suspending the company's registration).

Millions of dollars paid in ransoms don’t just disappear off the books. And if they did, that would be an entirely different problem, which is perhaps even more illegal than paying the ransom.

file it under Penetration Test

Ransomed company pays data recovery company, data recovery company pays ransom. I believe it is actually a common thing.

The ransomed company is in the clear. They paid for a legitimate service, it is in the books, taxes paid, all that stuff. They may even really think that they got their data back without a ransom being paid.

Less so for the data recovery company, but they can probably try to justify expenses by hiring "foreign cryptography experts", or doing "security research".

Yes, heaven forbid law enforcement perform work to enforce the law. That would be a terrible outcome.

In non-sarcastic words, I'm unsure what point your comment is trying to convey.

I assume they are referring to victims hiding their payments from the government. It definitely just looks like an additional ingredient in this wild goose chase.

It’s hard to get cooperation from a crime victim if cooperating is rewarded only with a choice between ruin through loss of his business and ruin through criminal charges. You’ll just see silence as people rationally seek to avoid ruin and fail to report the crime at all.

That is hard to do when the criminal is hiding in a different country. Russia is often accused of helping these criminals.

The point of my comment should becomes clearer if the first few paragraphs is read: the author thinks it's great idea to tell law enforcement to target victims through an hypothetical law he is proposing that would make it illegal to pay ransoms.

He's basing his opinion on treasury department decision to (seemingly) ban ransom payments to ransomware groups.

What he seems to be misrepresenting is: treasury department is not banning ransom payments. They are clarifying that payments (including ransom ones) to an entity on sanctioned list is illegal.

How does this translate to the rest of ransom requests seen in society is beyond me.

Are we setting up a precog unit to classify all people and entities in the world as sanctioned/non-sanctioned?

This law can't even be enforced because the criminal can easily generate a new addresse for every new victim.

Reply on news.ycombinator.com