I'm about done with articles that complain about cryptocurrency as a source of this "brand new problem"
Also why don't we talk about tax havens while we're at it?
Also why don't we talk about tax havens while we're at it?
I like cryptocurrencies, and I also work in information security and malware analysis. I acknowledge ransomware is a massive problem and that ransomware would be stupid to not use cryptocurrency. Technology isn't inherently good or bad; it just is what it is.
I think one of the main sources of the problem here is international law enforcement. The Russian government and security/law enforcement services have a pretty open agreement with cybercriminals: don't target Russian citizens and we won't impact your business. A lot of these organizations are now complementing the ransoms with harassment and blackmail, too, like threatening to release sensitive documents, directly harassing CEOs, etc. And some directly target health care facilities, knowing there'll be more urgency to pay up.
So if you're a Russian citizen, you have carte blanche to steal millions from people around the world, in an organizational structure that mostly resembles a kind of standard office job, with almost no anxiety that it'll ever come back to bite you (as long as you never travel outside of the country).
It reminds me a little of old-school naval piracy and privateering in many ways.
If you're in the US or UK or France or many other places and want to start a lucrative ransomware operation, there's a high chance you'll eventually get caught, so the risk of long-term imprisonment is enough to deter you even if easy millions may tempt you. If you have no moral qualms, great incentives, and nothing to deter you, the possibilities are limitless.
I'm not saying that all countries should extradite - just that they should at least make a good faith effort to cooperate with other countries' law enforcement and stop serious cybercrime like ransomware. Though I can understand why an "underdog" nation-state may want to have good relations with some talented criminals within their borders who they may be able to recruit or order around as needed.
That would be lovely, but I don't subscribe to The Economist.
Some commenters posted non-paywalled links below. Not sure of the legality, but I wish HN would/could automatically replace paywalled article links.
It's not just Russia but anywhere that is outside the reach of US court orders and extradition treaties.
>It's not just Russia but anywhere that is outside the reach of US court orders and extradition treaties.
Indeed. It just so happens that the vast majority of these ransomware gangs operate out of Russia and neighboring states. Probably in part due to the confluence of good technical education options, a huge population, and a government that permits the activity. (Not trying to say anything about Russia or Russians but just its government's policy. If it were the US that had this policy, I'm sure the biggest ransomware gangs would operate in the US, instead.)
Another thing that reminds me of piracy (and also EVE Online piracy, for anyone who's played that game) is the strict adherence to the basic pirate code of honoring ransoms so that future victims will be willing to pay. They're as ruthless as they can be before payment, but if the victim cooperates and pays, then they'll keep their word - they provide the decryption key, don't release any of their data, and mark them to not be targeted in future ransomware campaigns. It's solely about making as much money as possible.
I can't find a source right now and don't know for a fact how many do this, but I know I've read in at least one interview that a ransomware operator at least claimed they did this.
And regardless of what actually happens in reality - in my opinion, the most economically rational choice would be for all ransomware operators to do this (and to punish other ransomware operators who don't). In general, many of them seem to try to maintain a reputation of honesty and integrity, despite the obvious juxtaposition with the very immoral behavior. I wrote more about this here: https://news.ycombinator.com/item?id=27102646
Extradition is not a requirement. France, like Russia, will not extradite its own citizens, but you don't see so many criminal gangs operating out of France.
This is a pretty serious allegation, it might be considered terrorist activity depending on how you exactly define that. Same for attacks that intentionally target other critical infrastructure. Putting human lives at risk makes a very real difference here.
Here's a September 2020 interview with one operator: https://talos-intelligence-site.s3.amazonaws.com/production/...
>The actor appears to have a contradictory code of ethics, portraying a strong disdain for those who attack health care entities while displaying conflicting evidence about whether he targets them himself. This is probably representative of many adversaries engaged in illicit cyber activity.
>Hospitals are considered easy targets, making ransom payments 80 to 90 percent of the time during a ransomware attack.
When easy money's in front of you and there are no deterrents, the sole thing holding you back is your ethics, and given a large enough number of people, some are going to have very little in the way of ethics.
They're so brazen that many don't even care much about privacy. If there are no possible repercussions, why bother trying to conceal yourself?
>During our initial conversations, we shared what we believed to be Aleks’ identity and location based on our own research, which he confirmed.
The only analogy I can think of is if a smaller power constantly harasses a larger powers trade routes. Eventually America gets exhausted because we only know how to win a direct war.
They will exhaust us with this over time and continue building leverage. What are we seriously going to do? Goto war with Russia or China?
One is sanctions against specific individuals, which the US does do. So at least it's harder for them to participate in the international banking system.
And from my understanding, US law enforcement will often try to trick these cybercriminals to travel to a seemingly more neutral country (sometimes areas that are common vacation choices for Russians), where they'll get arrested after arriving. Some of them have gotten nabbed this way - notoriously Alexander Vinnik, the owner of BTC-e and launderer behind the Mt. Gox hack [1], though I'm not sure if he was lured there or just happened to be there. But as long as someone is smart enough to never leave the country, I think they're pretty much untouchable.
General geopolitical pressure and sanctions is probably the only viable option. Keep collecting evidence of the Russian government's permissive stance and bring it to the negotiating table. If enough pressure is exerted, they might eventually relent and actually start cracking down on the big actors.
If they could pressure Russia to permit extradition to the US for serious crimes, that deterrence would probably stop a lot of operations overnight. I doubt that'll ever happen under Putin, though. (And it'd probably be unpopular enough in Russia that I doubt it'll happen under Putin's successors, either.)
[1] https://www.justice.gov/usao-ndca/pr/russian-national-and-bi...
Russian's in general are pushed towards this idea that they want to be a "great power" on the international stage again, that this will fix their problems - it's certainly how Putin actively thinks. Of course it's never made any sense: Russia is huge. Domestically there's nothing it needs internationally to be a wealthy prosperous nation, and all it's problems are internal.
Hence the chaos: to Russian strategic thinking (that 70% isn't just "the people" its far more concentrated amongst the leadership), one way to be a great power is to knock America and the EU down and chaos suits just fine for achieving that.
Warm weather ports is one example
>And before you say cryptocurrency there’s lots of ways Western governments could intervene if they got serious.
I was definitely gonna say "cryptocurrency". I see absolutely no feasible way that any government could enforce things such that the only way a ransom could be paid would be traveling to Russia and paying the ransomers with gold bars.
I severely doubt any Western government is going to try to ban any cryptocurrency - even Monero. And if they try, enforcement will be extremely difficult.
No matter how hard they make it for a victim to pay a ransom or obtain the assets needed to pay a ransom, a sufficiently desperate victim and a sufficiently greedy ransomer will find a way to make it work.
Perhaps it could realistically help a bit if they threatened victims with prison time for paying ransoms, but in my opinion this would be pretty draconian and wrong - like threatening to imprison someone whose child is kidnapped by a cartel if they pay a ransom to prevent the child from being killed.
Sometimes the victims can be blamed for major negligence, but not always. And even when they are negligent, I don't think they should be punished or prevented from recovering their business in such an extreme way.
> Technology isn't inherently good or bad; it just is what it is.
Trolley-company isn't inherently good or bad; it just is what it is.
Those who write the history books and get to frame things for the future are always the representatives of the trolley company. But just because we have framed it this way throughout human history by using terms such as good, bad or neutral doesn't help either. I'm not saying that tech is bad I'm saying that saying any insinuation of presenting Tech as neutral from a moral (not legal) pov is problematic. Because if we use this by looking into the past then we must also acknowledge all the medical breakthroughs that were created during WWII. (I'm using a flippant point for purpose of illustrating just how problematic this statement is and we're not gonna find a solution by focusing on Technology because it's above all not a technical problem)
Especially people in security would be well positioned to think about this because of the bird-eye pov and adversarial thought that's required to analyse it. But perhaps it's not enough and we also need to integrate people from other domains (or at least stop being hostile to the social sciences as an "inferior science" ... because this is exactly the place where we don't see the forest because of the trees)
(I totally understand your point, but my understanding is that actually very little of medical significance happened to be learned from the human experimentation conducted by Nazi Germany and Imperial Japan during WWII, if that's what you're referring to. But for the sake of argument we can assume it did result in medical breakthroughs. Or if you're just referring to all the breakthroughs that occurred due to the pressure of the war, then that works, too.)
You're right, it's difficult to consider all technology as objectively neutral. If someone invents a device that lets any random teenager easily and cheaply release an aerosolized neurotoxin into a city center and kill thousands of people, it's hard to steelman the "it's the people, not the technology" argument in that case.
Philosophically, my post wasn't too rigorous or accurate. I think in the case of cryptocurrencies, though, there's enough of a balance of positive and negative that it's foolish to discard and vilify the entire concept, even if there are many uses (e.g. scams) that do deserve the critical reaction. If something has some positive utility to it, those always need to be kept in mind. Otherwise, all the politicians arguing in favor of banning encryption would have a much easier time, for example.
Let me try, though, because I think it's important.
Technology doesn't grow on trees. There are about two ways such a deadly device could be made available to a random teenager:
1. Accidental convergence of unrelated technologies. Somehow, it becomes cheap and easy to acquire a potent neurotoxin (an exotic animal or plant, perhaps?), tools to isolate, clarify and refine it (some toolkit from a chemistry lab?), a refillable spray can, a compressor, protective gear. A random teenager could then, technically, use all these to perform a chemical attack on a budget - if they knew how, and had a will to.
2. Turn-key solution. Somehow designs and makes widely available a device for cheaply release aerosolized neurotoxins.
In the first case, it's hard to blame any individual piece of technology involved. It boils down to the person willing to weaponize them, or one teaching others how to do it. Worth noting is that all the technologies mentioned (except maybe the neurotoxin itself) are already widely and cheaply available, and necessary know-how is part of high school chemistry curriculum - and I don't think anybody sees any real risk in this.
In the second case, the turn-key solution was explicitly designed with malicious intent - designed by someone who knew the end goal. Most likely commissioned by someone else, who also knew the end goal. Also made available to random teenagers by someone who knew what it is. That's at least three people with ill intent, without whom the technology would not exist (or it wouldn't be a threat). It seems to me that in this case, it's also the humans should be the center of focus.
With respect to real, instead of hypothetical, discussions about technological neutrality, I feel the constant focus on technologies and technologists in general is one big flock of red herrings - it exists to deflect the focus from the real problem, the people who commission and use these technologies with malicious intent.
Replace neurotoxin with chemical weapon and this is already a thing — I may be overestimating the industriousness of teenagers, but there is a toxic chemical a motivated teenager can make in two distinct ways using only things found in a normal kitchen.
Thankfully it was a rubbish chemical weapon even when deployed militarily in WW1, but it is a possibility.
easy? hardly. you only hear about the successful ransomware. The twitter btc giveaway scam is way more profitable, harder to detect, and easier than trying to code ransomware. People make 1 btc/day undetectable with giveaway scam
And you're right, there are certain kinds of scams that are possibly more lucrative for way less effort. A lot of these ransomware gangs started years ago when such scams weren't quite so lucrative. I wouldn't be surprised if many are pivoting into cryptocurrency-related scams and heists.
If you're ignoring effort, though, that one Twitter hack with the BTC-doubling scam made about $100k over a few hours, and that was with access to the top accounts on the platform.
According to a random Google search, a ransomware operator makes an average of $300k per company-ransoming. If you're getting 5 companies to pay you an average of that much per week, it's probably more lucrative than any giveaway scam, even if it takes a lot more effort and skill. And if you're getting more than 5 companies per week, it might be more lucrative than almost any kind of scam.
How do I know? Because the Russia is evil mentality. This comes from media in the US and lack of knowledge of History and geopolitics.
Let's take some History lessons:
Who sank the USS Maine? It was probably a false flag operation or the ship sank itself because of gas leak.We know it was not Spain, but it was used as an excuse to enter a war against Spain for taking Cuba and Philippines from them and committing genocide of at least a million people in the Philippines.
Who killed Rasputin? The British Government. Why? Because Rasputin was very influential in making sure Russia did not enter the WWI. Because they wanted Russia to enter they propagated all kinds of lies against him that even today remain and eventually killed him.
Who supported the Volsevisk revolution in Russia? The German Govertment so Russia would abandon WWI as they did after the Lenin coup.
Governments have always supported crimes when they benefited from those crimes, and that has not stopped in modern times.
I asked Reverte, an old war news reported who killed his friends and colleagues: https://en.wikipedia.org/wiki/Arturo_P%C3%A9rez-Reverte
He told me:"Half Russian secret services, half the US secret services"
In today's world, the US Government is behind way more crimes than Russia, because they are 10x or 20x more influential,specially after Berlin Wall's fall. Russia has the GDP of Spain.
The second biggest criminal is China, for the same reason. But US media loves China though.
Now when African activist that oppose a US multinational because gas or oil gets killed. Who do you believe is behind,Russia?
Who do you believe is behind when people is killed protecting the Amazon Jungle against the people that want to plant soy so Chinese pigs(and Chine that eat pigs) could be fed?
Who is behind all the chaos that is in north of Africa today. Who supported the war in Libia that made the Libyan army to infiltrate in all the Sahel.
Who supported the war in Syria? Afghanistan, Iraq.
How is that all those new weapons magically appear out of nothing?
That's the only thing I'm referring to, here; not anything else their current or past governments or any other country's governments have done or are doing.
SOURCE: Routers. https://www.reuters.com/article/us-offshore-wealth/super-ric...
BBC: https://www.bbc.com/news/business-40442595
Forbes: https://www.forbes.com/sites/kenrapoza/2017/09/15/tax-haven-...
Tax havens aren't a party to ransomware. This is just whataboutism.
We can talk about tax havens too, but that's a different conversation for a different time.
All I'm saying is that the way I see it, there's no correlation between wealth and affinity to crime.
This new technology also enables a degree of financial privacy that's a fundamental threat to civilization. It's... uhh... significantly less private than cash and (depending on the cryptocurrency used) often less private than bank wire. Never mind.
FTFY
Financial crime is one of those things that becomes less criminal as the scale gets larger or as one approaches influential political circles. Launder a hundred grand for a street drug dealer? Go directly to prison. Launder billions for drug cartels through major banks? You might get a fine and have to apologize.
https://www.buzzfeednews.com/article/anthonycormier/hsbc-mon...
Yes this last part is part whataboutism, but not without reason. 2008 proved that meaningful financial reform is virtually impossible. A riot is the last resort of the powerless.
The music industry railed against stuff like Napster and got literally nowhere in the grand scheme of things.
We are watching a repeat of history and apparently nobody learned a thing the first time.
Mostly due to superior products coming out (Rdio, Spotify) but given that a founder of Spotify was involved in the torrent community, don’t think it’s a crazy theory to say the legal pressure created product pressure.
The difference here is that TSLA is already accepting Bitcoin, and the financial sector is already building on Ethereum. So is it really going to be illegal or are there just going to be smoother experiences layered on top that the average user will flock to? Because I'm guessing, based on where we are, that it has to be the latter at this point.
Illegal use will be minimized by a new breed of middleman. It's not ideal, but it's right for the majority of people I think.
the Public simply is unwilling to pay $20 for a CD that maybe has 1 good song on it any more.
Other entertainment has been better able to resist this, those COVID has dealt a much needed blow to the value of Movies it is yet to be seen if this industry will recover.
Unauthorized distribution of non-music media is still very much alive and more popular than ever really. It is also becoming more popular since unlike the music industry the video industry is creating 10's even 100's of walled gardens, that are IP and Geographically locked to hold on to old outdated distribution models
I know many people that are growing tired of the "Which streaming service has the show or movie I want" which question that changes on a monthly basis, a Netflix may have it today, but Prime may have it tomorrow, then Hulu may get it later, as it leaves each of these platforms.
Most people subscribe to a single music service, however today you need to sign up to 3 or 4 or 5 Video services, that will drive more people back to unauthorized sources that are more convenient
Maybe it’ll be something similar where government or bank backed crypto becomes the only legal crypto, pushing what’s left even more to the margins.
Stopping crypto just seems like it would take pols committed to taking action:
* Attack mining nodes using cyber + military force
* Disallow transactions between USD + crypto in the US/Europe/Any other country that is willing to join or can be leaned on
On the other hand, as soon as you interact with money, there are well-established means to control money flows. If the banking system stop interacting with crypto exchanges, much like they're banned from serving cartels or countries under embargo, cryptocurrency will essentially go back to the fringe status it had a few years ago.
Sure, some people may still use it to buy pizzas. But it will essentially lose its interest when it comes to unregulated banking.
That kind of regulation may actually be a good thing when it comes to blockchain operations, or at least the few of them that can actually demonstrate a benefit in isolation.
For almost every other application, real money is more useable, convenient and reliable.
For others, I think it's totally untrue even from the start. It's actually usually a lot easier to launder USD than it is to launder something like Bitcoin or Ethereum, given every transaction is completely public and traceable.
Given paying with crypto is as easy as a QR scan these days once someone is onboarded, the other claim that you use, convenience, is about to go out the window: see venmo, PayPal, CB integrations. You might not be following the industry much though?
The problem with your approach here is I hear that, and then I think of HSBC opening a branch for the Sinaloa Cartel, laundering absurds amount of money for them, and no one ever going to jail.
If the reason not to use crypto is not to support crime, have you or your friends used HSBC, and did you advocate for them to stop? There are several other banks on this roster as well. Two wrongs != right, but I’m not the one saying stop using fungible USD that has for certain touched crime.
But why would you want to? In most cases, there's simply no benefit to using cryptocurrencies instead of real money.
Even if we could pay for our groceries, clothing, water, electricity, rent/mortgage, taxes, etc. with cryptocurrencies (which, for the most part, we can't) rather than real money, there's no compelling reason to do so.
Adoption reasons (and evidence) are fairly well known and proven in other parts of the globe that don’t have currency safety.
Fwiw Andreas Antonopolous’s content from early 2010s is good for working through this territory.
> The beauty of Bitcoin, from a detective’s point of view, is that the blockchain records all. “If you catch a dealer with drugs and cash on the street, you’ve caught them committing one crime,” Meiklejohn says. “But if you catch people using something like Silk Road, you’ve uncovered their whole criminal history,” she says. “It’s like discovering their books.”
https://www.sciencemag.org/news/2016/03/why-criminals-cant-h...
Tell me how you, the CFO of a small US city, would send $1M to Russia in 2006?
The world's problems are well-documented and fighting technological progress is a waste of time. We need capable law makers and regulatory bodies. None seem fit to the task.
If anything, we need more tax havens.
I would move my money to one if I could reap the benefits and I suspect people hate them only because they're not able to also do the same thing.
There are many reasons why someone might want to live in a place, despite the state there.
The state and the country/state/city/whatever are different things.
https://news.ycombinator.com/newsguidelines.html
https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sor...
Also, can you say I'm not being swindled if I'm spending nearly half my income on taxes?
The infrastructure argument is moot, too. Just look at US infrastructure crumbling to bits.
This is more of an intrinsic flaw of humanity than something that has an easy fix. Reality and the version in our minds don't align. Privatization isn't the answer: private companies let their infrastructure deteriorate to the point where it kills people all the time. We even rely on the government to prevent this, and get upset when they don't catch every case. Making the government go away, or underfunding it to the point where it's impotent, probably isn't the fix.
There isn't really an easy answer to society's problems. If there was, we'd have already implemented it. Now we have to deal with the hard problems, and we probably have to do that as a collective. The problem is too large for one benevolent visionary to magically solve.
Something that I think of one of HN's blindspots is the general inability to think past what one person can do alone. We sit in front of our computers and make stuff, then we go to work and make stuff that's almost the same, but it takes 10 people to do only 10% more. That's probably another intrinsic reality of the Universe -- to do a project twice as difficult takes maybe 10 times or 100 times as many resources. That's because communication scales poorly, like n! That's why every successful project management book tells you to cut scope; doing a harder project involves adding more resources, and adding more people to the project has dramatically diminishing returns. But the government can't cut scope, so they have to bear this communications cost. It looks like inefficiency, but it's more like an immutable law.
Keep this in mind while you pontificate about how having a society is akin to robbery.
"Sure the guy murdered a lot of children with poison, but let's not forget he also was the best ice cream maker in the neighborhood."
Are you comparing taxes to murdering children with poison and roads you drive on and schooling that you get to ice-cream? That is a bit of an oversimplification, don't you think?
This is a response to one possible reading of your comment.