Hacker News Reader

Comment by ikeboy | Hacker News Reader

We need to make it illegal to pay ransoms.

Paying a ransom is like defecting in a prisoner's dilemma: it benefits you at the expense of hurting everyone else who will be stuck in the same situation. Making it illegal just forces everyone to cooperate and is something everyone would prefer.

Should be possible to prosecute under existing laws: you're providing support to a criminal enterprise, sounds illegal already.

View on HN

This story provides a good counterpoint. What if doing so saves lives at a hospital who needs to get back online ASAP? A "saves lives" loophole?

Not to mention every law should first be measured on whether it is at all practical to meaningfully enforce. I guarantee there has been 100x more companies who've paid the ransom and didn't release a press release like this one did.

If a whole bunch of people are going to do it anyway quietly and the law isn't going to stop them, we're just going to occasionally double up the fines on the random businesses that get caught. While these endless ransomware hackings continue.

I'd much rather we spent public resources on prevention.

You're saving lives now but endangering future lives.

If no one paid the ransom, ransomware wouldn't exist. the more people who pay the ransom, the more incentive attackers have to create ransomware.

> If no one paid the ransom, ransomware wouldn't exist

Even if we made it illegal, it doesn't mean people wouldn't pay them.

> If no one paid the ransom, ransomware wouldn't exist

Even if we made it illegal, it doesn't mean people wouldn't pay them. It would just punish victims further.

Put another way, which would you rather do, indirectly kill people or break the law? This is the decision a hospital administrator would be faced with. I suspect that most people would see fit to disobey the law in this situation. It could easily be argued to be a legitimate case of civil disobedience.

I work in this space. Its probably not a matter of kill people, doctors in ER's don't really need a EHR to function and sometimes do without due to technical issues. The issue is that the hospital won't be able to bill without documentation.

> If no one paid the ransom, ransomware wouldn't exist

I guess you didn't read the second half of my comment where I suggest that will likely be idealistic and unreleastic.

Enough companies will still pay quietly to keep it going. I'd be shocked if they didn't.

If an individual is attacked, sure.

If you're attacking a public institution like a hospital and demanding many thousands of dollars... it's pretty hard to hide a payment like that. So if you outlawed paying such ransoms, those types of ransoms would stop.

Individuals would still be attacked and asked to pay a few hundred dollars, but such instances rarely put lives at stake.

Look at th health insurance industry and tell me a hospital can't sneak out a $50000 payment.

Governor Rick Scott of Florida stole a Billion dollars from Medicaid before he got caught.

Set a threshold where payments above that amount are illegal. Even a threshold at say, 25k or above will reduce the incentive to attack individual systems, and payments of that size are difficult to hide if everyone knows they're illegal.

The idea behind not paying is that it makes ransomware unprofitable and people stop doing it. A loophole for saving lives would cause ransomware distributers to target their attacks in ways that endanger lives.

It wouldn't need to work that way. If a law was past mandating that in 5 years paying ransoms would be illegal then companies would be forced to either invest or be held liable after that grace period.

Of course there could be an exception process that involves contacting LE first, paying the ransom, being fined and audited, and having to disclose a report online and in front of the entrances of the when, why, and how this occurred. Paying the ransom w/o going through this process could (maybe?) be treated as conspiring with the attacker (& since the identities of the attackers are almost always 100% unknown, some could legitimately have inside contacts anyway).

What if the malware changes a medical record (maliciously or accidentally), and the discrepancy leads to a lost life? Seems strange to hang lives on the word of criminals, if lives are really at stake.

>Not to mention every law should first be measured on whether it is at all practical to meaningfully enforce. I guarantee there has been 100x more companies who've paid the ransom and didn't release a press release like this one did.

Let's say you're the in C-suite of a hospital that's held for $1M ransom, and you want to pay. How are you going to send the funds without someone in finance/accounting finding out? Maybe you try to convince them to keep quiet? Such a transaction will almost surely generate a suspicious activity report from the bank. Are you going to try structuring the transaction? How are you going to hide that $1M defect in your quarterly/annual reports? Are you just going to hope it doesn't get noticed by the IRS or the accountants auditing your report? The whole thing is going to unravel because of how many people you need to be "in" on the criminal conspiracy, and the amount of noise it generates. If you're caught, the amount of papertrail you left behind (from literally every step of paying the ransom) would make it very easy to prosecute.

You could try laundering your activities to a third party firm that does "ransomware recovery" (ie. they take your money and pay the ransom for you), but I'd imagine that if paying ransoms were illegal, the activities of those companies would be closely scrutinized.

I 100% disagree. Sometimes it is the only way to get things back running. I understand its the organization's fault for not having backups. It would destroy some businesses, hospitals, schools if they weren't able to pay the ransom.

> Sometimes it is the only way to get things back running. I understand its the organization's fault for not having backups. It would destroy some businesses, hospitals, schools if they weren't able to pay the ransom.

That doesn't change the game theory dynamics that I pointed out above.

I bet you'd be singing a different tune if the life of someone you loved was at stake.

If someone I loved was in a hospital that might get targeted by ransomware, I'd prefer we adopt the policies that reduce the prevalence of ransomware.

This is assuming you can time travel. In reality, you have no idea what hospital your loved ones will end up at, nor whether they will (chances are they will not), nor what systems to protect in advance. On top of that, you would have to convince others that the investment is worth making.

sure, most people would. but the things a private individual would be willing to do under extreme leverage don't make a good basis for policy.

They surely would. However we generally try to treat being too close to a topic emotionally as a reason to distance someone from it, not to value their opinion more.

Judges don't recuse themselves because someone they know wasn't involved in the case.

I've been thinking the same thing, lately.

When Randsomware was a new idea and seemed to be primarily targeting individuals, it made sense that paying your way out should ultimately be legal. Any law against it would be difficult to enforce, so bad actors would still be incentivized to launch attacks, and only law abiding citizens would be hurt.

But now they're attacking banks, and hospitals, and cities. I have trouble imagining large hospital systems would be able to discretely pay hundreds of thousands of dollars illegally without anyone noticing—and if they did, it would be easy to prosecute.

Ergo, outlawing these payments should very significantly reduce the number of ransomware attacks against these large targets. If no one can pay, there's no incentive to attack.

> Making it illegal just forces everyone to cooperate and is something everyone would prefer.

Doesn't making it illegal just change the cost structure? The penalty for illegally paying a ransom in your proposed system would be simply to pay a fine. It's effectively how a rich person might look at a parking ticket for a premium parking spot - it might be cheaper for them to simply pick the illegal spot than to have to drive 2 miles away and call an uber to get to their destination.

I'd make it a crime punishable by prison in proportion to the amount paid, or perhaps require a multiple of the amount paid as a fine. If you need to pay 10X the ransom as a fine, then the ransom criminals can extract goes down by a factor of 10.

I’d be ok with it only if the ceo and the board are the ones going to prison and there’s a minimum mandatory sentence of (at least) one year with no possibility of parole or commutation or anything like that.

That just sounds punitive. The goal here is to deter ransoms and ultimately reduce the incentive for ransomware, not to be punitive.

To what avail? CEOs regularly make much worse decisions that create much more grave externalities (example - oil spills). There's much bigger fish to fry than for-profit hospital systems....

No offense, but this proposal is essentially DOA.

Creating oil spills isn't illegal and can't be if you want to get oil. Different scenarios.

As for size of fish, we don't go "why is theft illegal when there are murderers still roaming around?" We can have both be illegal.

My point is that we very rarely give criminal sentences to corporate executives in the US. This seems like an odd one to start with.

But doesn't eliminate hackers who do this type of stuff for the "lulz" (and if anything, makes it worse and potential a weapon for people who want to promote larger government). I understand the general premise of the proposal, but it's not a fool-proof check on game theory.

It doesn't completely solve the problem, no.

But the stories of hospitals and other entities paying non-trivial sums in ransom I would expect are mostly professional criminals, not hackers doing it for lulz.

For conversation's sake, what if the victim is a small/mid-size business where the entire business would be destroyed in the event their systems are not unlocked immediately? Do they choose between possible prison time or definite loss of everything?

Enforcing a fine relative to the ransom paid (and maybe relative to the "if we wouldn't have paid it" severity) is probably a good immediate start. This would at least galvanize businesses to improve existing security.

Small businesses would have been destroyed by all sorts of rules that have already been passed. Companies whose entire service was dumping asbestos in to lakes or companies who only managed to turn a profit by hiring child labour. Their owners had to choose between possible jail time or losing everything.

Every single thing done by a government, or really just any large player in the market place, is going to have small businesses that get flattened by it. That your entire company could be wiped out by changes in the marketplace, including laws, is one of the risks a person assumes when they decide to start a small business instead of working as an employee. They're earning their slice of the money pie in part by assuming that risk.

Can you prove you didn't pay?

There's also no guarantee that paying gets you your data back. Either because the random holders don't care, or because a white hat killed off some part of the ransom holder's communication channel.

Or because the malware author borked the decryptor.

https://www.bleepingcomputer.com/news/security/ryuk-ransomwa...

Sure, let use the DEA to enforce that law since they are already experts at persecuting victims.

How about instead the government proactively pentests and fines orgs for security violations,and uses the money to finance education, training, and security development?

Reply on news.ycombinator.com