Hacker News Reader

Comment by 0x53 | Hacker News Reader

I should be against the law to pay a ransom for data.

Ransomware becomes a death sentence to the business if this were to apply, which the US has no appetite for. We even let critical infra out from improving their cybersecurity [1] [2] [3], because it is expensive and hard. The asymmetry of cybersecurity makes effective defense challenging for even the most resourced orgs [4]. You have to win every single day, against social, phishing, auth/identity, and vulnerability attacks throughout the stack. They only need to win once.

(head of infosec, holds tabletop exercises with legal counsel on a cadence as part of ransomware insurance requirements)

[1] https://www.cybersecuritydive.com/news/epa-rescinds-cybersec...

[2] https://www.epa.gov/system/files/documents/2023-10/action-me...

[3] https://www.epa.gov/system/files/documents/2023-08/2023.08.0...

[4] https://arstechnica.com/security/2023/09/hack-of-a-microsoft...

“We do not negotiate with terrorists.” - Richard Nixon

Does it work? Depends on who you ask. https://www.chathamhouse.org/2022/01/we-do-not-negotiate-ter... says that individuals (in the case of corporate ransomware - corporate entities) end up paying and not reporting the kidnapping:

“Historical evidence from Colombia and Italy shows that outlawing ransom payment has various adverse consequences.

Where ransom payments are illegal, victims’ families have no state support, while reporting of the kidnapping goes down and understanding of its prevalence is diminished.”

It's a crime in Japan to pay protection money to Yakuza. It seems to be working. They are a shadow of their former selves.

You can mitigate adverse consequences. Punishments for child kidnapping used to be severe, but then abductors would just kill the hostage since they had little more to lose. Today's sentences are next to nothing to encourage surrender.

Doesn’t the existence of a ransom “out” put a cap on how much money/seriousness a company willingly puts into infosec? Why would a company invest $22M into security if they can just pay criminals when they get owned?

If ransom was off the table, maybe they’d be motivated to actually secure their data? I don’t know—I’m not in infosec. It’s probably not that simple.

Correct. You calibrate your budget to your risk appetite (board/C-level tolerance, industry specific compliance requirements, civil considerations, etc). Every company puts a budget on how much they're willing to spend, as resources are finite. Even the US DoD has a budget, there are limits. We risk accept what we deem within our risk tolerance, or too expensive to derisk.

I think on HN, there is this belief that you can use incentives to force organizations to have perfect security, which does not exist. Employees are human, people make mistakes, budgets constrain staffing as well as control implementations and operations; there are simply limits to what you can do. You can use policy and incentives to encourage good/best behavior, but failures will still occur. The goal is attempts at desired outcomes, measuring those outcomes, and iterating; not 100% success (as that is impossible).

> how much money/seriousness a company willingly puts into infosec? Why would a company invest $22M into security if they can just pay criminals when they get owned?

Because it's not a one-time cost. If attackers know you have weak security and deep pockets they will persist.

Or simply make exchanging bitcoin for anything of value illegal. It makes extortion of all kinds too easy, and company data is just the tip of the iceberg.

I was in Italy recently, and saw articles about the epidemic of kidnappings there in the 70s. It won't be long before organised crime figures out how to use crypto to bring back the glory days.

Killing bitcoin would shut down an enormous illegal economy overnight. And stop the crazy electricity consumption at the same time. Maybe you can help me here, but I'm having difficulty thinking of a single real downside.

> shut down an enormous illegal economy overnight.

Despite not owning any Bitcoin, I find it quite comforting to know that there is a currency that exists outside of the purview of a central bank or a government that can devalue or outright take the accruement of my labor on a whim.

Then what's stopping the criminals from going back to good ol' wire fraud like in the 90s and 2000s?

PS. All of the smart ransomware groups are not demanding payments with Bitcoin anymore, they are using another cryptocurrency called Monero. It turns out that Bitcoin is actually traceable by governments via its public ledger, but Monero is a private currency that can't be traced, hence why the IRS posted bounties some time back to encourage people to break Monero's obfuscation.

The only gangs that are still demanding Bitcoin are the less-educated and savvy ones.

Can't they receive the money in Bitcoin and then run it through Monero to "clean" it?

Monero can be de-anonymized relatively easily.

source?

Oh yeah.. there were no ransom business before Bitcoin.

Policy is quite far from that: ransoms are even tax deductible.

Are there no legal consequences for knowingly paying money to a known criminal group based in Russia? What about the existing OFAC sanctions?

I don't really think companies do KYC on ransomware groups. The government just does not prosecute it.

Hiring bounty hunters to hunt down the perpetrators should also be tax deductible then.

The stories I've read about these ransomware companies are wild. They have whole customer service departments to help you easily pay your ransom. They operate like a legit business.

I'll make an exception for payments with tracable money made on behalf of the fbi.

Or better yet pay to Ukraine who is at war with the governments allowing this.

I would agree, except I don’t think it would keep people from paying regardless.

You'd end up with a bunch of shady "data recovery" firms that may or may not be related to the ransomware crews.

Reply on news.ycombinator.com