Hacker releases PII on Las Vegas-area students after officials don’t pay ransom | Hacker News Reader

Hacker releases PII on Las Vegas-area students after officials don’t pay ransom

wsj.com

29 pointssizzle56 comments

Presumably the school district doesn't really care about its students' PII being released. I mean, they might feel a bit bad, and all else being equal they'd prefer not to have it released, but no one's going to lose their jobs or their funding just for that.

So the enforcement mechanism here has to be through the courts: some student or students will sue the district for negligence. Paying out millions of dollars in legal settlements is something the district will care about, and might cost someone their job, so it's a good stick for the hackers to use if the district would lose such a lawsuit.

What's the case law like here? Are they likely to lose?

...millions of dollars of taxpayer money.

>"Paying out millions of dollars in legal settlements is something the district will care about, and might cost someone their job"

I'd bet this is something the voters will care about, but it's likely to be attributed to some 'innocent mistake', 'communication error', or 'server misconfiguration'. The school district won't lose any revenue, and I doubt anyone will get fired. Maybe a contractor will get scapegoated.

People on HN complain about how reckless private companies are with their data, but bureaucracies are even less accountable.

Parents/students do not have a private right of action under applicable federal law (FERPA). The US Dept of Education could theoretically hold the school district to account, but that would be extraordinary (speaking of the current context, but also historically).

It's against the law to pay the ransom. So damned if they do, and damned if they don't.

I supposed it may light the districts' ass to get good security, but if you don't know what good security looks like, how are you supposed to know?

USA has a good number of security frameworks. Collaborating with a more advanced education institute (for guidance) and setting a programme/project would be possible if they wanted (or now to prevent the shitshow from happening again).

Any uni that has undergone similar project will have the project charter, resources, skills, timelines, lessons learned (the whole project folder).

Where there is a will there is a way. And I believe thay many organisations DO know that they operate on low/bad security, they just prefer to roll the dice and use the budget for something else..

I track US public school cybersecurity incidents and this represents a change in tack for ransomware attackers vis-a-vis schools. Clark County (Las Vegas) is only 1 of 3 school districts since the start of the school year compromised with ransomware alongside the exfilitration of student/employee data. The others include Fairfax County (VA) and Haywood County (NC). Overall, I count 35 instances of ransomware (K-12 districts) for all of 2020; 15 of those publicly disclosed since August 1, 2020.

https://k12cybersecure.com/map

PS The latest incident, with commentary from the district superintendent: "Got to work this morning, powered up my computer and the first message I got was you’ve been encrypted. Basically, you know, the same old thing…you’ll have to pay us in bitcoin, we’re holding your data ransom, you need to contact this email address."

https://www.kalb.com/2020/10/02/cyber-incident-affects-avoye...

How long will it be until we realize cryptocurrencies are causing problems?

But how will we pay ransomware authors (while expending 620kWh and creating 107g of electronics waste per transaction [1]) if we don't have cryptocurrencies?!

Oh no wait I see the problems.

[1] https://digiconomist.net/bitcoin-energy-consumption

Do the major crypto runners work towards being more energy efficient, or do they not care at all? Maybe they already sponsor the development of new nuclear power plants.

They work toward making it more energy efficient (by using more optimized miners), but it only results in faster miners, not less electricity consumption. Kind of like how processors of today are several times more efficient than processors a few years ago, but they still have the same TDP.

They cannot make it more efficient because the algorithm adapts to become less efficient. Miners design new hardware and throw out their old hardware as quickly as they can to try and stay one step ahead of their peers, but their peers catch up, the algorithm de-optimizes and the game begins again.

CPUs are able to do more with the same TDP each revision, Bitcoin can only perform the exact same 7 transactions per second no matter how much faster the underlying hardware gets.

That site makes only a back of the hand assumption about how much energy use is a renewable or clean source.

My work with large miners - who all rely on clean or reducing pollution by using unused energy - and the economics of all miners would say that 75% of all mining is renewable energy.

You would therefore have to divide all their problem metrics by 50-60%.

Regarding "e-waste as much as Luxembough", is that really a lot? I don't actually know what to compare that to, all I see is "gasp a country!" and no quantitive metric compared to say any other industry or even other jurisdiction's use. With that in mind, I also am not sure it is accurate. Bitcoin e-waste doesn't really result in more machines, it results in the same amount of machines being replaced and doing more. This is because the economics has already pushed people to renewable energy sources, and the people that can already have. People that are just catching on are using people's "wasted" machines and mining with those.

Ah the source you ask? All the private details about my clients. Hm, yeah not going to happen, there might be a few press releases, and there might be a few court documents that have nothing to do with mining but normal business disagreements in companies that do mine.

The balanced answer is that this is something to remain vigilant about. Nations mining at a loss and printing currency to do so will absolutely not care about the power cost or source, and this is where we are headed. The private sector is not capable of doing this as uneconomically as that site suggests, pay attention as that site's assumptions are intertwined with facts. Just notice where they don't have any facts and be willing to balance that with other accounts like mine.

What is "unused" energy and why is crypto a better use for it than charging a battery or pumping some water up a hill?

> You would therefore have to divide all their problem metrics by 50-60%.

Do you mean the metrics would be doubled or halved?

> Bitcoin e-waste doesn't really result in more machines, it results in the same amount of machines being replaced and doing more.

I don't follow. If hardware is being used for crypto it isn't being used for something else. This must either push up the cost of hardware or simply add more to the total amount in the world.

Hardware has a limited life so crypto must contribute to e-waste. Why is it appropriate to attribute the hardware usage to non-crypto workloads but not crypto? What's the difference?

There is a lot of energy that is at the source of generation which looses efficiency to getting to residential or commercial areas. This energy is wasted. In many forms of energy generation the result is pollution. Crypto mining is unique because it is the first thing that requires no infrastructure. These are heavy computational services that don't need heavy internet infrastructure as mining is not bandwidth intensive and even satellite latency is good enough to submit the hashes. Its better than other use cases because those other use cases were more expensive than throwing pollution into the atmosphere simple as that.

The entire story that crypto is “taking away” is wrong when it is giving in more cases than not because its the only economical way to mine.

This goes hand in hand with the e-waste fallacy. The hardware doesn't go obsolete if the power costs are low enough, and at the remote power source it is low enough. There is a robust trade of “obsolete” hardware from people that have higher power costs to people that have lower power costs.

Is new single purpose hardware being created for a purpose you don't respect even when confronted with new information? Yes. Is the impact overblown and oversimplified? Yes. Should you make sure the reality doesn't turn into the imagined nightmare? Yes. Remain vigilant, just have more accurate arguments so you know what to watch out for.

Are you suggesting crypto mines are colocated with power plants and make up for their energy use with gains in transmission loss? Couldn't a DC in a power plant do some other low bandwidth task instead? Why is crypto a unique "low bandwidth" application?

Again, even if the hardware has a longer life due to "cheaper" energy why is crypto uniquely suited to take advantage of this?

> Is new single purpose hardware being created for a purpose you don't respect even when confronted with new information? Yes. Is the impact overblown and oversimplified? Yes. Should you make sure the reality doesn't turn into the imagined nightmare? Yes. Remain vigilant, just have more accurate arguments so you know what to watch out for.

This kind of cryptic condescension raises red flags for me. If you have information please share it. I am capable of making up my own mind without being talked down to.

Its unique in that it is profitable and all the infrastructure is right there, yes, they are co-located with the energy sources and this will increase. The only roadblock has just been old energy and commodities decision makers being confused about the word bitcoin until they see revenue and sustainability graphs.

Other things just aren't profitable and didnt satisfy anything for the energy provider.

And again, nobody is looking for other things just for the sake of proving that something else can use less energy because there isn't a problem. Computers with no* emissions are reducing emissions and adding a use for energy that was not otherwise going to be used. It is literally the opposite of the story being peddled by pointing at the amount of power being used. This wasn't available beforehand, it isn't important to anyone if “unique” is too strong of a word or not.

*its annoying that I can perceive someone will argue that instead of the rest of the point.

There’s no such thing as magical unused energy that for the first time in history can only be harnessed thanks to the magic of blockchain. You can colocate so many useful things with power supplies, like electric metalworks.

The mining incentive structure and automatic deoptimization of the algorithm mean that there’s a constant arms race to build faster hashing hardware that lasts a few months and then gets thrown out without improving the performance characteristics of the underlying system. 7 transactions per second costs 620kWh and yields 107g of garbage. Each pair of transactions is like chucking your phone out the window and powering a home for 45 days. Do you see how shameful that is?

A Tesla gets 4 miles per kWh, so each pair of transactions - where you scribbled down an IOU into a big multiplayer excel sheet - consumes as much resources as driving round-trip across the United States and throwing your iPhone out when you get back.

The crazy thing is there's frequently a big overlap between the crypto enthusiasts and people who you know, believe in global warming and recycling.

> And again, nobody is looking for other things just for the sake of proving that something else can use less energy because there isn't a problem.

And I bet global warming isn't real either huh? I mean those oil companies aren't looking for alternative sources of energy because there isn't a problem.

The reality is economic incentives beat rationality pretty much every time hands down.

Transactions doesnt mean “transfers”, it means “database operations”, one type of which is a transfer. Other types of which can include a transfer. So these systems are facilitating many more transfers within their transaction limit.

Just a nuance.

Mining does reduce pollution for oil companies. Its low infrastructure demands and longer than you expect shelf life does utilize power that was being unused or wasted. This is the crux of your argument and it is not accurate. You got here because you decided you dont like how that power is now being used after misunderstanding that it wasn't being used, and I dont care.

> Mining does reduce pollution for oil companies.

It is 100% additive. It doesn't reduce pollution for oil companies, at all, in any way. Certainly not when you take into account all the oil consumed to build and deliver all the mining hardware that's turned over to the tune of 12.31kT per year.

Fine say you're right. Show me a single study, a single article, a single write-up from a reputable source that shows bitcoin reduces pollution for oil companies.

> Its low infrastructure demands...

12.3kT of waste per year means a lot of infrastructure relative to what it provides which is basically nothing.

> ...and longer than you expect shelf life

Shelf life?

> ...does utilize power that was being unused or wasted.

No. If that power wasn't being squandered on a multiplayer excel game, it would be used for productive things. The same power cannot be used twice.

> This is the crux of your argument and it is not accurate. You got here because you decided you dont like how that power is now being used after misunderstanding that it wasn't being used, and I dont care.

It is massively, overwhelmingly less efficient than traditional banking and the generated waste and wasted power is purely incremental. If that entire transaction volume moved to traditional rails, the incremental power required to support it would probably be ~one guy on a stationary bike's worth.

VisaNet alone can handle 65,000 transactions per second. 7 is 0.01% of that.

For perspective, bitcoin would require, if scaled linearly, 123 Megatons of e-waste (triple the entire world today put together). It would require 700,000TWh or 23X the entire world's output of electricity. It would also emit 333,000 megatons of CO2. More than 10X the entire world's current output. Just to replace VisaNet. Of course it's physically incapable since even wasting that quantity of resources, the total transaction count would still be 7.

There's no world in which you can rationalize away that it's drastically, overwhelmingly, mind-blowingly less efficient.

Reputable enough article? There are alot of miners doing the same thing and most don’t talk about it for good reason. This allows your view of the world to continue unimpeded

https://www.bloomberg.com/news/articles/2019-12-06/why-bitco...

In case you can’t access bloomberg here it is over amp

https://www.google.com/amp/s/www.bloomberg.com/amp/news/arti...

One of your other points that I choose to respond to: The energy use doesn’t scale linearly to transaction activity and is not a prerequisite to the function of a proof of work network

I think there is enough information here to alter your lecture so I’ll wait and see. The rebuttal that I predict will be based on the size is the mining operation in the article, so just assume there are bigger ones doing the same thing.

The solution is to stop gas flaring -- that carbon is still getting emitted into the atmosphere, that solves nothing. If it gets turned into power it could be used for something productive, at least.

> The energy use doesn’t scale linearly to transaction activity and is not a prerequisite to the function of a proof of work network

That's just a nice way of saying the bitcoin network cannot scale, intentionally so. Scaling is antithetical to proof-of-waste. At some point you run out of resources to waste.

Can you elaborate on the carbon hitting the atmosphere part?

It is being converted to power for the onsite computers instead of being flared away. How is that not better than the immediate flaring

> Crypto mining is unique because it is the first thing that requires no infrastructure.

That could not be more wrong. It requires piles of infrastructure: energy generation, transmission, cooling for miners, miners themselves, and so on.

> The entire story that crypto is “taking away” is wrong when it is giving in more cases than not because its the only economical way to mine.

Literally if people stopped wasting a country of power, generating stations would go offline.

> This goes hand in hand with the e-waste fallacy. The hardware doesn't go obsolete if the power costs are low enough, and at the remote power source it is low enough. There is a robust trade of “obsolete” hardware from people that have higher power costs to people that have lower power costs.

Absolutely not a fallacy. People literally throw out old miners and replace them with new miners to get a leg up on their peers. This is the waste. You can't pretend this away. 107 grams worth per transaction.

> Regarding "e-waste as much as Luxembough", is that really a lot?

Yes.

One global industry having as much output as one of the tiniest countries in the world? Not even a tech heavy or very dense tiny country?

There are simply stronger arguments to lean into...

It's not a global industry, its a 7 tps data store. You can replace it all with a single DynamoDB table.

There's no way to "shut down" Bitcoin. Cryptocurrencies are a new technology that we have to learn to deal with.

There's no way to "shut down" Bitcoin

Sure there is. Just make it not possible to convert Bitcoin into real things. If it can't be turned into money or candy or online gaming tokens or electric eels and remains virtual, then what's the point?

You wind up driving it underground, but it will still have value because you'll still be able to buy things with it on the black market. Given our past experience with the war on drugs, I'd expect this to make the situation even worse, e.g. by creating a whole new class of criminals.

Hm.

Isn’t a sufficiently underground crypto currency vulnerable to interference?

Yup, a black market swaps government for organized crime. Cartels would be incentivized to dominate the network.

"Just make water not wet." Bitcoin is money, and there will always be people willing to trade it for something else, like candy, other money, gaming tokens or even non-virtual things. Several of these things are enabled by technologies like DEX's and Cross Chain Swaps. OTC trade desks are not going away either. The problem is equivalent to shutting down any and all trade/commerce between anyone at any time. Good Luck with that!

If Bitcoin's critical mass is ever shrunk enough that a single party can execute a 51% attack against the currency, someone will, and the currency will quickly cease to exist as an asset or tradeable currency.

If the US and China crack down on trading houses and currency conversion (aka ban them) there's not enough mining happening elsewhere in the world to keep the chain safe.

On the contrary, if it ever shrank to an extent that posed an existential threat I think it is almost certain that a different consensus algorithm (such as proof of stake) would be adopted.

There's no telling how the legalities surrounding crypto currency will evolve but I seriously doubt that it will ever disappear.

>If the US and China crack down on trading houses and currency conversion (aka ban them) there's not enough mining happening elsewhere in the world to keep the chain safe.

Getting such a ban in place would be the hard part. If US banned bitcoin, I'd imagine US's enemies would sponsor bitcoin exchanges/miners just to piss off the US. Also, considering that miners be located literally anywhere and only need a modest amount of bandwidth to operate, shutting down clandestine mining operations would be very difficult. See: all the illegal drug labs/grow ops around the world.

Even if you ban legitimate usage of cryptocurrencies, it will still have value underground for criminal activities as a settlement mechanism between criminals (Bitcoin/Monero seems easier to move than bags of physical cash).

This happened - a mining group approached (and possibly passed) 51%, so they directed some of their miners to other pools because they didn't want to devalue their earnings.

Anyone with that much mining power has a huge financial incentive to keep the golden goose alive.

The invisible hand perspective is that cryptocurrencies help putting a price tag on insecure systems.

Before cryptocurrencies were widespread ransomware used vouchers such as PaySafeCard to get paid. Tech support scams use gift cards to get paid.

I'm not convinced that banning cryptocurrencies will 1) significantly curb ransomware activity nor 2) that it's worth banning a tool with legitimate use that's valuable in certain countries with unstable economic situations (there are valid, non-nefarious reasons for why you'd need to move money without your government's approval).

> Before cryptocurrencies were widespread ransomware used vouchers such as PaySafeCard to get paid.

Really? You're suggesting this happened on the same scale? So how many hospitals got hacked like this with PaySafeCard? How frequently did these occur? Nothing's changed since cryptocurrencies came along?

> Tech support scams use gift cards to get paid.

That's why nobody even mentioned tech support scams.

Not all all of them support non-interactive transactions.

Mimblewimble based coins require an interaction between payment sending wallet and payment receiving wallet, making them unsuitable for ransom payments.

Here's a different suggestion: how about schools get enough civet security that her don't leak their students' information? Whether hackers can demand a ransom in crypto currency or not doesn't change that the school district made their students' personal information vulnerable.

If the school feels that they cannot handle cyber security at such a level then use a typewriter for students' personal information. Once this information gets out there it can't be unreleased.

Edit: I do concede that crypto currencies probably increased the amount of ransom attacks on systems. I also think that security in systems that don't contain any PII probably isn't as important and these attacks do affect them too.

https://archive.is/9CD63

Yowza - I have several friends who were affected by this :(

As a reminder, if you have kids - freeze their credit!

https://www.nerdwallet.com/article/finance/child-identity-th...

At this point, I feel like frozen credit should be the default.

There's an entire industry out there which benefits from the fact that credit is easy to access, even if it exposes people to risks of fraud & identity theft.

If banks' interests were aligned with their users (or legislation forced them to) the whole credit history system would be replaced by something more secure & less prone to fraud.

At this point, as a non-American, i feel like you people accepting to have a credit rating system is ludicrous. It's fundamentally broken, has been exposed multiple times, requires gaming to work in yiur favour ("open a credit card as soon as you can, pay little things with it and pay it off immediately to beef up a good score") and brings nothing to you, the people.

For comparison, in France, the national bank keeps a record of all loans anyone has taken. When you apply for a new loan, the bank will check with the national one your history, and decide based on that to lend or not, and inform the national bank of their decision. I suppose Americans can be afraid that "the government" will know their loan history in such a system, but it's not like they can't currently ask and het that information, and they're still more trustworthy than commercial companies that don't care about you ( their clients being banks and companies) or your data beyond their sales.

But it's not like anyone on the US would dare to destroy a profitable industry.

Do students and families have any legal action to take? The school failed to protect personal information under their watch.

If I was a parent, I would be livid.

Still the right thing to not pay up. If nobody pays they will give up eventually.

Make sure that you have good backups. So you can laugh at their demands.

Backups are an essential part of the solution. However, for this case, one also needs the infrastructure, on isolated standby, to automatically revert every impacted device asap to stop the bleeding.

Didn't a company with backups recently pay because they realized restoring would take months?

"nobody pays"

This will likely require criminal penalties to enforce.

Which will never happen when 1) some law enforcement agencies themselves got affected and 2) as long as the ransom is less than the cost of recovery there's always the possibility for the payment to be done "underground" and off the books.

Even if you have good backups, you're still vulnerable to blackmail about public disclosure of data you're required to safeguard, just as in this case.

Paying up doesn't save anything, they still have the data and can release it anyway.

Reply on news.ycombinator.com