Hacker News Reader

In the 80s Italy had a problem with kidnappings. An ingredient of the solution was freezing the assets of the relatives of kidnapping victims. The strategy worked.

In France, it’s illegal to pay ransoms too. So somebody impersonated a Minister, video-called a bunch of rich people saying somebody was kidnapped and asked them to pay the ransom since the government couldn’t.

They bilked a bunch of rich people out of 55 mln EUR:

https://www.bbc.com/news/world-europe-51842898

https://www.washingtonpost.com/world/how-scammers-used-a-sil...

> One way to break out of the prisoner's dilemma is to place an outside cost on 'defecting' from the socially optimal choice;

There might exist additional effective measures:

1. requiring by law that companies, hospitals and so on, do effective backups; controlling that this actually does happen and handing stiff fines to companies that do not.

2. the government acting as an insurance for damages in companies which fall prey to ransomware, covering their losses completely if they provide proof that they did not pay.

Also, there is an additional problem with ransom payments: As you cannot prove who is the recipient, how can you refute the suspicion that the company is not victim to ransomware but one of the company's owners is extracting profits without paying taxes? I mean, if you work as a cashier in a supermarket, you cannot tell your boss that somehow the money in the cash register got lost or that it was taken away by an armed robber which is not visible on any security video picture.

The counter-measure would be to put full regular taxes on profits on any kind of proclaimed ransom payment.

In practice, no one renounces their child or their intellectual property or important information (looking from the skin of companies), no matter how much you impose a thousand fines, only when the fines exceed the value of the person or information seized, you could be renounced to this, for example: to be fined a million dollars if you rescue your son.

But this is a stupid solution... Instead of punishing yourself for something that isn't your fault (or something you overlooked like not creating a backup, or, in the case of children, not taking good care of your son), well this problem can be prevented and the irresponsible punished BEFORE the tragedy happens. I propose that companies that do not have a backup of their information be fined, or in the case of companies (financial, social networks that do not want the information to be disclosed), regulate the security of their company or otherwise be fined. With this, he punishes himself BEFORE the tragedy and not AFTER.

If the fines come AFTER, the ransomware is not mitigated, the hijackers get what they want.

indeed.

however the single biggest area is when lower it companies choose to skimp and get pwned.. paying 50k is better than filing chapter 13 even if the govt charges you another 25k pound of flesh.

>the government announces loudly that they will fine companies more than their losses if they pay.

No, they do it to enforce sanctions, not to break out of the prisoner's dilemma. Criminals not connected with sanctioned subjects will happily continue their ransom attacks, now that the government has crippled their most capable rivals.

Or the sanctioned individuals just set up a new identity.

This is better described as a tragedy of the commons, not a prisoner's dilemma.

It isn't really a tragedy of the commons... what resource is being overused?

It is a collective action problem, which is really a type of prisoner's dilemma.

https://en.wikipedia.org/wiki/Collective_action_problem

It is not really a prisoners' dilemma. Who is the other prisoner?

You and I are both prisoners.

A prisoner’s dilemma doesn’t require actual prisoners; it was the first example of this type of problem, which is why the name is used for all sorts of problems with the same characteristics; namely, that there is some optimal outcome for everyone that could be reached if everyone chose a particular decision, but their is always an individual incentive to ‘defect’ and choose the other option.

I too usually interpret "tragedy of the commons" as "everyone does the thing even though everyone would be better of if no one did the thing"

You are exactly right about that, not sure where the down votes are coming from.

They aren’t right... it isn’t a tragedy of the commons, because it doesn’t involve the overuse of a shared resource.

https://en.wikipedia.org/wiki/Tragedy_of_the_commons

A tragedy of the commons is ALSO a collective action problem, but is not the same kind as what we are seeing here.

Yes I'm aware of that definition, and I still think it is a legitimate example of tragedy of the commons.

The commons here is an abstract one: it's the lack of incentive within a society to perform a kidnapping, which is a shared benefit/resource.

The family of the victim who decides to pay the ransom is taking from this commons (by decreasing the lack of incentive), making everyone worse off in expectation, in order to benefit only themselves and the specific victim they're trying to help.