Hacker News Reader

Comment by pdkl95 | Hacker News Reader

  It is always a temptation for a rich and lazy nation,
    To puff and look important and to say: --
  "Though we know we should defeat you,
      we have not the time to meet you.
    We will therefore pay you cash to go away."

  And that is called paying the Dane-geld;
    But we've proved it again and  again,
  That if once you have paid him the Dane-geld
    You never get rid of the Dane.

  It is wrong to put temptation in the path of any nation,
   For fear they should succumb and go astray;
  So when you are requested to pay up or be molested,
    You will find it better policy to say: --

  "We never pay any-one Dane-geld,
    No matter how trifling the cost;
  For the end of that game is oppression and shame,
    And the nation that pays it is lost!"

https://www.poetryloverspage.com/poets/kipling/dane_geld.htm...

We've known for hundreds (thousands?) of years that paying ransom only encourages more demands for ransom in the future. The solution to this is backups and improved security. I know that's expensive. Pay that cost now or continue paying more dane-geld proving over and over again that you are a mark that will pay.

> or, increasingly, to prevent them from being leaked

Why did high-risk data exist in the first place? Maybe stop gathering so much risky data.

View on HN

Imagine for a moment that, despite all the precautions you yourself take, a clever crook manages to lock you out of some important files and demands a ransom. What do you do? It's easy to say cost is no object, but what if no amount of money, even far exceeding the cost of the ransom, can recover your files?

The attitude that people who are hacked should have taken better precautions and should fend for themselves is a big part of what makes us soft targets to cybercrime. Imagine if we treated murder this way. "Oh, sure, he was killed, but he was walking down the wrong street at the wrong time of day. He should have known better! Let's start an educational initiative to make sure other people know what streets they shouldn't walk down at night!"

We must expect the state to do a competent job of protecting citizens from cybercrime but, in most jurisdictions, governments do not devote adequate resources to this task. That needs to change.

New technology and inadequate response from governments is what has created this bonanza for a new kind of criminal.

Paying any sort of ransom should be illegal with severe criminal penalties. If that means that some businesses or people are ruined then so be it. That would be an acceptable cost to reduce similar attacks against others in the future.

Well, fortunately you don't get to decide that.

Also imagine how well this would go - your child was kidnapped, but now you have to go to prison because you had the gall to make sure they go home safe.

Like, I get your point, but it's one of those armchair social science ideas that can go into a cabinet full of really cool and really obvious ideas that won't ever be implemented in reality.

If you pay the ransom you’ve doomed future children to be kidnapped as well.

Future kids aren't your kid though. It is human to be self-interested.

If we can agree the act is in self-interest, and we can agree that society has a role to play in disincentivizing certain self-interested actions that harm the greater good, then we can agree that society should apply those disincentives to ransoms.

The problem with this logic is that not paying the ransom doesn't guarantee future children not being kidnapped, but it nearly guarantees your own child being killed.

So if the choice is presented as "do I not pay the ransom to reduce the chance of further kidnappings by some completely undefined %, or have my child harmed with nearly 99% certainty", who could ever chose not to pay it? What sort of mind gymnastics would you go through to justify not paying it in that case?

My logic is most people would put themselves first at the cost of the greater good. So if it is well established logically that the greater good is for everyone to cooperate and not pay ransoms then it needs to be enforced for everyone.

It’s like pollution or recycling. Why spend the effort and cost to do it if the benefit is only to future generations or society as a whole (ignoring the few who do it for their own sense of self-satisfaction)? That’s why we have things like penalties for pollution and carbon credits.

These people are externalizing the cost of their actions. At the very least we shouldn’t allow ransom payers to externalize the real cost of the ransoms to future generations and society as a whole.

Yes, but like I said right at the beginning it works fantastically well as a sort of armchair theory. Same way we can sit here and say that drugs should be super illegal and the penalty should be death, voila, no more drugs, right? We know this doesn't work.

Making ransom payments super illegal wouldn't stop them from being made. People(parents in particular) would absolutely try to find a way to pay the ransom anyway to save their children, no matter the consequences. Like I said in another comment - what kind of punishment would stop the parent of a child in danger from paying the ransom? Years in prison? Most parents would gladly make that trade to make sure their kid goes home. There isn't a punishment here that you can establish to absolutely eliminate ransom payments, and as I'm sure you can see - as long as *any" are paid, criminals will keep using them as a tool. So imho, any effort(and therefore money) spent on fighting the ransom payers is completely wasted time and money. Not paying a ransom does not reduce the chance of further kidnappings significantly enough to make it worth it, and I'm nearly certain you can't come up with a punishment harsh enough to scare people away from making the payments.

> no more drugs, right? We know this doesn't work.

You can read what I wrote here about teh great firewall. https://news.ycombinator.com/item?id=27103646

"No more drugs" is not the goal, neither is "no more ransoms." The goal is to reduce the reward for ransoms so that it is disincentivized to some degree.

If our disagreement is on how to stop X to an absolute degree, then I would agree with you for all Xs that it would be impossible, whether X be ransoms or logical fallacies.

Under a consequentialist point of view, yes. But, in my honest opinion, consequentialism is a completely flawed and unfair way to judge actions.

I totally disagree. I consider myself a consequentialist, and I absolutely think the net positive utility would come from paying the ransom and rescuing your child. The problem isn't consequentialism but merely an insufficiently nuanced analysis of potential actions one could take and their potential consequences.

Judging actions is like saying dooming children is good, or bad.

So you need to sacrifice your own child's life for being so stupid as to get abducted and kidnapped in order to hypothetically decrease the probability that hypothetical future kids may be kidnapped?

Come on. You would really make that decision if your child were kidnapped?

I wouldn’t make that decision. No one would. Which is why it must be made for them… kind of like car insurance.

It would work about as well as banning abortion - of course it would still happen, just outside of the view of the law. Like, come on. If the life of your child was on the line, you wouldn't figure out a way to pay the ransom even if there was a potential for prosecution later?

Also I'm not sure how the fine would even be decided to be effective? 3 years in prison? Would absolutely gladly trade it for the life of my child. Probably any amount of time in prison would be spent gladly in order to save your child. And once we start throwing ideas like life imprisonment(because really, can't go much higher than that) it would be struck down as not proportionate to the crime.

> It would work about as well as banning abortion - of course it would still happen, just outside of the view of the law. Like, come on. If the life of your child was on the line, you wouldn't figure out a way to pay the ransom even if there was a potential for prosecution later?

By this logic the Great Firewall of China is a massive failure because some guy, somewhere, was able to access illegal content from China. But that's not the case. It works quite well to control public opinion and it doesn't have to be 100% effective at blocking content to do so.

The same applies to disincentives to ransoms. Of course some people will still pay ransoms. But why let criminals have a monopoly on the market? The total ransom someone can pay is fixed by the market (basically how much your child is worth to you and how much money you even have, otherwise there'd be no ceiling on ransoms). Since the government is in on the action, the revenue from ransoms is split between fines/jail time/criminals. If the government's actions are decided ahead of time, and cannot be changed based on any single ransom attempt, then kidnappers will know that their potential income from ransoms will be severely cut, thereby disincentivizing ransoms by some degree. The degree to which it is disincentivized depends on how good of a competitor the government is in the market (enforcement/detection of ransom paying events).

> Also I'm not sure how the fine would even be decided to be effective? 3 years in prison? Would absolutely gladly trade it for the life of my child. Probably any amount of time in prison would be spent gladly in order to save your child. And once we start throwing ideas like life imprisonment(because really, can't go much higher than that) it would be struck down as not proportionate to the crime.

These are implementation details. If there is no ceiling to what you will pay/rob/steal/do then don't let the kidnappers out there know! But also, you'd be a massive liability to society assuming other people don't care about your kid as much as you do, since criminals can leverage you to a 100% degree. If they know this about you, they don't even have to estimate your net worth. They can get you to go rob a bank instead!

> These are implementation details.

Which are what a plan is made of. If you live in a democracy and not a dictatorship, you have about a 0.0002% chance of keeping the parents of a kidnapped, murdered child in jail for more than a day for the crime of "attempted ransom paying" without you and your family becoming pariahs and being screamed at in public places, and your political party being annihilated from politics even after press releasing your expulsion.

It's not just the parents that would have to sacrifice.

And yet here we are imprisoning people for simply using drugs. Whether you agree that's good or bad it should be obvious that criminal penalties for drug use at least disincentivize a lot of potential drug use.

Sure; criminal penalties for criticizing the government disincentivizes a lot of potential dissent, too. Works well in China.

I think you're right that imprisoning people for paying ransoms would probably decrease the probability that a victim would pay a ransom. And imprisoning people for blasphemy would probably decrease the probability that someone would take Jesus's name in vain. But I'm not sure how useful it is to discuss things like this. (And, for the record, I also think it's unconscionable that the US imprisons people for simply using drugs.)

And then there's the question of overall efficacy: it disincentivizes a lot of potential drug use, but does it also disincentivize drug sales? Does banning drug possession decrease the amount of drugs sold? I don't know. They could always just try to sell to more people than they otherwise would have.

Similarly, ransomers could just go for more of a spray-and-pray approach and ransom more victims per unit time to offset the fact that there's a lower probability that any one victim would pay. They could also hike up ransom prices to offset it, so that each victim is hurt more even if there may possibly be fewer total victims.

I think even if it did objectively, inarguably decrease the amount of ransoms - which I acknowledge is plausible - it'd still be completely unethical and an extremely terrible idea. But I'm not even sure if it would. We aren't exactly winning the War on Drugs by penalizing drug use, and I'm not convinced we're going to win the War on Ransomware by penalizing ransom payments. And even if we could win both those wars that way, I think it'd still be really fucked up and major governmental overreach.

There are a lot of issues with this idea, too, but I'd be more sympathetic to the ideas some others have suggested in this thread: bring back letters of marque and reprisal and provide some legal structure for American/European citizens to target international cybercriminals in certain countries and perhaps also take money from them and keep a percentage of the proceeds, etc. I'd be way more in favor of vigilante justice against perpetrators as a remedy compared to draconian punishments against victims. These people currently face absolutely no repercussions, so adding some repercussions may help deter them.

And what if your child, who you save at that time, goes on to be an elite police officer specialising in child kidnappings and saves dozens of later children's lives without paying ransoms?

These situations involve complicated moral dilemmas, but thought experiments never take into account all possibilities, and at some point idealistic principles about the general problem have to give way to pragmatism about the immediate problem.

To give an extreme example, if someone had a button they could push that would end the world as we know it, and they demanded you pay them $1B or they'd push it, are you really going to argue that paying that billion dollars is the incorrect response because it would encourage future people with the ability to end the world as we know it to demand ransoms?

> And what if your child, who you save at that time, goes on to be an elite police officer specializing in child kidnappings and saves dozens of later children's lives without paying ransoms?

Well he wouldn't have been kidnapped in the first place if we disincentivized ransoms!

> To give an extreme example, if someone had a button they could push that would end the world as we know it, and they demanded you pay them $1B or they'd push it, are you really going to argue that paying that billion dollars is the incorrect response because it would encourage future people with the ability to end the world as we know it to demand ransoms?

Your example is indeed extreme. It posits a game with 2 players, the world, and the entity trying to end the world. In a 2-player scenario where you lose if you don't do some requested action then you would have no choice but to do it. However, in an n-player scenario where n > 2 and player "x" being the one wanting to win by ending the world, and assuming all other players can win by cooperating, then yes the world government should indeed forbid all players from paying the $1B ransom.

It's a well established fact that if ransom demanders know that ransom payers are subject to significant fines and penalties, their power to demand ransoms drastically diminishes.

Well he wouldn't have been kidnapped in the first place if we disincentivized ransoms!

This is a bizarre and emotive discussion, so I'm not sure how much more it's worth saying, but I will leave you with one final question. What law could you possibly make and what "severe criminal penalty" could you possibly impose that would be greater than the natural law that parents would do almost anything to protect their children and what a parent would suffer if they lost a child? I don't believe anyone could ever implement the policy you've been advocating effectively, and at that point, the entire deterrent argument collapses anyway.

Simply increase the cost of the ransom. I don't think it's necessary to make it even a criminal thing, it could just be a tax: Ransom Sales Tax. Of course if you try to pay under the table then it'd become a criminal tax avoidance issue.

No it doesn't. It just changes form. See money laundering and the mob.

Can't collect in cash? That's a-ok. Do me a favor and you get your kid back.

You are not talking a lick of sense. Crime finds a way. It always will. You can't tax law abiding people to invalidate criminal economic models. All you do us disadvantage the victims, undermine the legitimacy of your legal edifice by implicitly raising it above those it serves in importance, and completely do away with any semblance of sanity, and maximize tge cost in human lives exacted from the pool of the falsely accused and victimized. Game theory doesn't apply. Rational Actor Theory doesn't apply. Addressing crime via draconian laws doesn't work if you're at all interested in any State even nominally centered around the concepts of Freedom and Liberty.

And a Ransom tax? Do you want tax collectors tarred and feathered? Or are you just trying to ensure that any remaining credibility in the government is irrevocably lost? Taxes lend legitimacy to things. You're basically admitting that a ransom is even a valid transaction by enshrining it in your tax code.

Absolute madness.

The people who do have the power to decide that, the FBI in the case of live children and the Department of the Treasury in the case of ransomware, have in fact decided that these payments are illegal for precisely these reasons. Kidnap for ransom is effectively no more in the states, due to the FBI's high rate of solving these cases. If crimes using computers were taken seriously, we might have a chance at actually reducing their rate as well.

>If crimes using computers were taken seriously, we might have a chance at actually reducing their rate as well.

They often are taken seriously. The problem is most of the ransomware gangs operate out of Russia, and Russian law enforcement permits the activity if Russian citizens aren't targeted. (There may be a short blacklist for citizens of some other countries allied with Russia, as well, but targeting and profiting from citizens and companies in America and Western Europe is explicitly allowed.)

If you're the FBI, there's absolutely nothing you can do about that if the ransomware operators never leave the country. You can try to lure them out of the country - and this does happen sometimes - but if they're smart enough to never leave, they're basically immune to all repercussions.

The Justice Department can publicly indict them, and they sometimes do, but they're just going to laugh at it; it simply increases their street cred and respect among their peers. "I'm on the FBI's Most Wanted lol." You can go after the infrastructure, but as long as the people involved are allowed to operate freely and continue to have lucrative incentivizes, it's only a minor annoyance at most.

We could issue letters of marque and reprisal. Basically, if Russia won't prosecute their cybercriminals the US will permit cyber crime against Russian targets.

If a cartel kidnaps your child and says they'll be killed if they don't receive a ransom payment within 72 hours, guess that's goodbye to them, then?

This kind of punishing of victims is draconian, unethical, and, in my opinion, basically insane, in addition to being impractical and very difficult to enforce. In some cases the victim's negligence is largely to blame, but sometimes it isn't.

And even when they are negligent, I think threatening to imprison them for paying a ransom in order to remedy something that may upturn their entire life and cost them far more (financially and otherwise) than not paying is just ridiculous.

There should be some kind of accountability and regulation for negligence, and any company that's hit with a ransomware attack should be legally required to report the attack to authorities and disclose it to their customers, but I don't think you can or should punish people for paying ransoms. You should try to punish the ransomers, and the people who obstruct punishment and shield the ransomers (like countries whose law enforcement permits the attacks and extortion and whose financial industry permits the payment handling).

That's very easy to say from a highly ordered country with effective law enforcement and a strong tradition of low violence. Other countries, much less so. There are many in the world (I live in one) where if you're "asked" for a ransom payment because a family member was kidnapped or as a threat against your business being burned to the ground, your only even partly decent chance of escaping the situation in a way that minimizes tragedy is to simply pay. Anything else, including going to the thoroughly useless, corrupt police, will mean that whoever you love enough to sell your house for will die, or something you spent years building is destroyed. Avoiding future incidents is something you'll think carefully about afterward, but paying is the first and usually only choice for saving a life or property. Ponder that in the context of how you would feel with your own family before giving flippant, simplistic absolutisms.

I almost got murdered in Africa, the general consensus is that this is expected behaviour for night time and I was at fault. For what it's worth I agree with that...

Cybercrime isn't so much crime as a basic reality of these systems. The level of policing we'd need is a ridiculously high cost in comparison to improving the public infrastructure that is computer security.

Wow if you don’t mind me asking, what happened and how did you get out of that situation unscathed?

This is not a status quo people should accept. It is a problem and it should be fixed.

Is this a proposal that we should make no effort to mitigate crime until we can eliminate it altogether?

We should avoid real world analogies. That's how we got into the culture of throwing people in jail for reporting a security bug (why were you snooping around on my property!) and stuff like "you wouldn't download a car".

The specific problem with the murder analogy is that governments have effective ways to reduce local crime. You can't do anything similar for stuff happening on the internet. Criminals come from all over the world.

Even if you can get every government to agree, not all of them have the resource to implement any effective form of deterrence. It also seems like the solution will be way worse than the problem. You either firewall yourself off from the world (what china does) or add so much spying that you can always catch the "bad guys". I can't think of any other solution. If we want a free internet, we just have to accept some are going to abuse their freedom to do bad things and deal with it.

> The specific problem with the murder analogy is that governments have effective ways to reduce local crime. You can't do anything similar for stuff happening on the internet. Criminals come from all over the world.

Extradition for murderers is incredibly common, as are cross-boarder fraud investigations (look at the case of Frank Abagnale) so tracking down people internationally isn't a new thing.

IMHO there should be a separate, encrypted-only, ID-required network for "serious internet business". Keep the free and open part open and free (and semi anonymous), but have another area which is more controlled. I'm not saying this would solve all problems, but I think it would help.

im sure chinese would agree

Not sure why you think the way China does it has to be the only way it can be done. It's exactly like shouting "COMMUNISM!!!!" at every social policy idea. Get a grip.

The idea that an "ID-required" network would do anything to slow down bad actors is downright hilarious.

You can already do that with VPNs. Businesses already heavily leverage them, and consumers are generally not interested in the hassle. You'd also have to be careful with the implementation. If one computer can be connected to both networks (and it sounds like they'd almost have to be), hackers will bounce their connections of someone else's computer. C&C traffic comes in via the insecure connection and out via the secure connection.

It would probably hamper script kiddies, but it's not going to do much in the face of a targeted attack. And even a semi-motivated script kiddie could probably buy a service from a botnet to route their traffic onto the secure network.

> "Oh, sure, he was killed, but he was walking down the wrong street at the wrong time of day. He should have known better! Let's start an educational initiative to make sure other people know what streets they shouldn't walk down at night!"

There's nothing inherently wrong with that. It is a fact that violence often can be avoided. This doesn't absolve the criminals of their guilt but it does mean people can learn to recognize danger signs and avoid many instances of violence. When faced with warning signs that a situation is developing, a lot of people feel like something is a bit off but they proceed anyway because they think they're just being paranoid.

Punishing people after the fact does nearly nothing to help victims. It doesn't undo any trauma, it doesn't bring the dead back. Avoiding violence is always the best option if possible.

"New technology and inadequate response from governments is what has created this bonanza for a new kind of criminal. "

Just what government response would be appropriate here. From where I sit, government already meddles way too much in this area.

"Oh, sure, he was killed, but he was walking down the wrong street at the wrong time of day."

It is an odd comparison, but also very apt. You are at fault for walking South Side Chicago, while waving wads of hundred dollar bills looking like a mark. Just because it is illegal to take from you, does not mean it is not stupid to flaunt your idiocy around.

This sounds a lot like a victim blaming to justify the existence of a technology which intentionally seeks to make transactions like these easier.

The victims' only mistake was the way they underfunded their IT security. It's not a small mistake though, and the financial losses of the victim itself can in certain cases easily be dwarfed by losses of people who got their data exposed.

It's more than that, though. Many of the modern ransomware gangs are filled with talented, dedicated attackers who specifically target certain companies.

You could invest a ton into security, have a competent security team, follow best practices, set up lots of security appliances and software, have lots of analysts monitoring and responding to alerts and actively hunting for threats and writing custom SIEM rules etc., and there could still be one small mistake that lets a sophisticated attacker in.

As the adage goes, the defenders have to win every time and the attackers only have to win once. A group of sufficiently motivated, dedicated, resourceful, and talented attackers who face zero risk of any sort of repercussions will very likely get in if they put enough time and effort into it.

This isn't just old-school ransomware that merely tries to infect as many computers as possible in general and just happens to land on a corporate machine and automatically spreads from there. These are trained, experienced red teams manually targeting companies and everyone who works at them. In many cases the victims do indeed have poor security, but a company doesn't necessarily need to have poor security to fall victim to ransomware.

There is no need to justify it. Cybercrime is a relatively small price to pay compared to the value provided by private cryptocurrencies. Their usage by criminals is actually a great way to see if they really work.

> Cybercrime is a relatively small price to pay compared to the value provided by private cryptocurrencies.

Which is what exactly? Speculation? And...

Destruction of this really annoying planet we live on!

  1. Store any amount of money easily and securely
  2. Transact quickly, easily, cheaply, globally, limitlessly
  3. Nobody knows your balance
  4. Nobody knows transaction amounts, senders, receivers, history
  5. Nobody knows about anything you do
  6. Nobody can randomly freeze your assets
  7. Nobody can move those coins without the key

Have you ever had your money taken away from you? My country suffered through hyperinflation in the 90s, the government got desperate and just froze the bank accounts of everybody. The amount of disruption this caused is legendary.

It doesn't matter how much energy it consumes or how much crime it enables. If it allows us to escape government stupidity it's more than worth it.

I mean roughly each of those points doesn’t apply to every major crypto. But also no, I’m properly invested. You get to escape government stupidity into the open arms of criminals and scammers. Out of the frying pan and into the fire so to say [1]

It’s like replacing the local police with the Sicilians. They even have a comparable customer service policy, i.e. SFYL.

[1] https://ag.ny.gov/sites/default/files/2021.02.17_-_settlemen...

> roughly each of those points doesn’t apply to every major crypto

Monero currently has all of these properties.

> You get to escape government stupidity into the open arms of criminals and scammers.

This is does not justify sacrificing everybody's financial privacy and independence. The police should track the criminals via other methods. They shouldn't be able to surveil everybody's transactions at all times or freeze people's accounts over the slightest suspicions until they prove their innocence. It's better to let some criminals escape than suffer these injustices.

> This is does not justify sacrificing everybody's financial privacy and independence.

Agree to disagree haha. Financial records are private unless revealed to authorities in a 4th-amendment compliant probable-caused based warrant. Seems like the right place to draw the line.

> The police should track the criminals via other methods.

Why? I mean it's pretty easy with basically every crypto other than Monero, and Monero is basically Narco-dollars, which are unlikely to find any acceptance.

> They shouldn't be able to surveil everybody's transactions at all times or freeze people's accounts over the slightest suspicions until they prove their innocence.

You mean... probable cause? And offer due process to resolve? Some would argue that's the foundation of the criminal justice system.

> It's better to let some criminals escape than suffer these injustices.

You're just subbing one kind of criminal for another.

Gold is for the mistress -- silver for the maid --

Copper for the craftsman cunning at his trade."

"Good!" said the Baron, sitting in his hall,

"But Iron -- Cold Iron -- is master of them all."

https://www.poetryloverspage.com/poets/kipling/cold_iron.htm...

ransomware is full disk encrpytion but you dont know the key. this is hard to do with modern bios settings. Upgrading to windows 10 makes ransomware much harder to install.

Do you have more info on what Windows 10 does WRT ransomware?

I was shocked when I heard a ransomware expert at a security conference tell everybody to just pay the ransom. Shocked.

What else do you do? If you don’t have a backup and need the stuff, you’re out of options.

Maybe he/she has an alter ego who does ‘research’ into ransomware in the middle of the night </conspiracy>

But it's the right answer for an individual org in that situation.

Of course the correct answer for everyone, in the long term, is to have backups and not pay.

In my opinion, even then the cost of not paying may still be far, far higher than paying. A reply to the parent: https://news.ycombinator.com/item?id=27102599

If your options are 1) company is ruined and has to shut down temporarily or permanently, with much higher total costs than the ransom payment, or 2) pay the ransom, of course you're going to pick option 2.

Backups aren't necessarily enough. Sure, a lot of companies don't backup. And sure, a lot of companies backup but keep the backups on network shares that the ransomware can reach and encrypt. And sure, a lot of companies keep isolated backups which aren't encrypted, but which are missing the past few days of production data.

But even if you have a perfect backup solution up to the minute before the attack occurred, you'll still be coerced to pay. These ransomware operators are general extortionists - they manually target specific companies and come up with the most impactful threats to pressure you to pay.

They screenshot all of the sensitive documents, emails, IMs, trade secrets, and PII they've gathered and say they'll post it online and mail it to every local, regional, and national press outlet, every company you partner with, and every customer email they've harvested. (And they do indeed make good on this threat if you don't pay by a deadline.) They call all your executives every hour of every day and target their personal devices. They might SWAT your executives' houses.

If you don't have backups, the overall, reputational, and financial cost is probably way higher than the ransom payment. But even if you do, it still might be higher than the ransom payment. Even if you really want to take the moral high ground and inform your customers, partners, and the media of your choice and that you won't negotiate with terrorists or whatever, all of the damage (especially to your reputation and trust) may still be so extreme that you have to shutter your company.

I don't think you can fault someone for paying the ransom when they're being explicitly targeted by sophisticated attackers and when so much is at stake.

I totally understand the logic, but from a standpoint of "paying just encourages more of it" it shocked me to hear it from a security researcher.

If people like him are telling you to pay, then people are going to pay, which will just create more and more and more attacks.

I'm not an expert, but I do work in information security and I personally would tell people to pay, too. I strongly believe there needs to be a way to reduce the frequency of and counter these attacks, but I don't think banning ransom payment is the way.

Off-topic, but I really hate this poem - it's a geopolitical equivalent of "Why don't they eat cakes instead?"

Many small and weak nations are barely clinging on for survival by any means necessary - they cannot afford to not pay Dane-geld, and I think they'd appreciate not being mocked as a weakling by someone born to the British Empire.

Kipling is a "Dane" pretending that how his country got that way is because of its moral superiority and toughness, which makes it's own demands for geld justified by the burden of maintaining its flawless character.

"As ransomware has grown, so has the industry promising to protect firms from it."

In the aggregate, there may be more money being siphoned off businesses by offering "protection" as a service than from ransom demands.

Reply on news.ycombinator.com