Hacker News Reader

Comment by makeitdouble | Hacker News Reader

“Never negotiate with terrorists” is a simple and clear mantra, and as most clear and simple concepts it hides a lot of assumptions.

One of them is you are ready to lose the hostage in the worst case scenario. That’s how the police sees it, because the society benefits more from being firm in individual cases than losing a few of its members that might not come back anyway.

That’s a hard one to swallow, hard enough that govs also sometimes can’t follow the mantra and just pay the ransom.

It’s crazy hard to get people to sacrifice themselves for the better good, it’s yet a bigger ask for corporations who already screw the public day in day out.

View on HN

The US government has negotiated with the Taliban (a formally designated terrorist group) for prisoner exchanges.

https://www.bbc.com/news/world-asia-50471186

The "don't negotiate with terrorists" is itself a negotiation tactic meant to lower the attack surface of any entity.

It's the sort of thing you say publicly, but then privately you settle with your adversary.

Absolutism is never a useful tactic.

Yes, but getting your opponent to believe you will take an absolute position is often the most useful tactic.

> Absolutism is never a useful tactic.

That sounds pretty absolutest.

I absolutely never always disagree, most of the time.

Everything in moderation, especially moderation.

Never negotiate with terrorists is only a thing because it puts you in a stronger negotiation position.

And it's just posturing. I'm sure the US negotiates with groups it labels as terrorists through backchannels.

Literally every government says this publicly, and then negotiates privately.

> “Never negotiate with terrorists” is a simple and clear mantra, and as most clear and simple concepts it hides a lot of assumptions.

This has nothing to do with that idea.

The reason the orgs paid the random once was because they had a severe lack of backup and other data safety protocols in combination with a vector to be infected (from all what we know, the latter is common and difficult to avoid): paying the ransom is likely their only choice to maintain the business.

It is not surprising at all that these orgs can and will be infected again, and will continue to show a lack in the security and data safety departments, and so they will continue to pay ransoms.

It's sort of an inverse survivorship bias: if you get infected once because you're susceptible, you're likely to get infected again unless you fix your susceptibility.

I think that mantra does work here.

I would be totally fine with legislation making it illegal to pay in the case of ransomware attacks. Some companies might be completely destroyed by an attack that they can't pay off, but that is for the greater good of society: if criminals know companies have a low probability of paying since they're legally barred from doing so, they're less likely to target them.

It has from a certain angle: For society/the internet as a whole it might be better for no one to pay the ransom at the cost of some of them perishing. The ransomware attacks would become unprofitable and would eventually stop. But to assume any organization wouldn't pay the ransom if its survival depends on it is obviously unrealistic.

I mean couldn't government pay the ransom and then go great lengths to track the suspects and send special forces after them? Surely US govt. has the ability to track almost anyone.

Having US govt. on your ass should a decent deterrent.

Just take a look at how hard FBI came down on cartels and individuals who were involved in killing Enrique Camarena. Cartel leaders were arrested in Mexico and several individual in the US.

It appears that some of the major ransomware gangs are operating from Russia and are tolerated by the government, as long as they don't hit domestic targets.

The US cannot really send special forces there without risking a massive escalation.

No, but the people operating in Russia like to travel elsewhere, and do.

Also, the US and allies can enforce Russian AML laws as written on paper. If, say, the UK freezes all of Oleg Deripaska's assets there, Vova will absolutely get the message. We're not going to bring down the Russian government with military force for a million different reasons, but doing it with sanctions and prosecution is a totally different story.

When they do US gets them. That happens from time to time, if you watch the news, you notice there are guys caught periodically who thought it's time for a nice vacation in Spain resting from their criminal activities... only to be picked up in the airport. However, the smarter ones stay put inside Russia and those are hard to get.

Best example was when VW's Oliver Schmidt was arrested in Miami as he was changing planes. He was in trouble from the emissions fraud scheme.

Yup, for example that credit card frauder who went to the Maldives..

I'm sure the US has hundreds of spies and personnel in Russia at any point in time.

But sending a spy to a software developers house and assassinating them probably isn't going to stop the problem - more people will spring up doing the same.

We might not though. We don't even have a main diplomat there.

Russia has always been notoriously hard to spy on.

I would not be surprised if there was only a handful of well placed assets and most of the spying being done electronically.

That introduces a scale problem. Even for the US.

When they hit a hospital, what is the hospital supposed to do? Not negotiate, for some "greater good" and let patients die?

https://threatpost.com/ransomware-hits-hospitals-hardest/162...

I am sure an IRL hostage situation alrrady happened at an hospital, so we could have the answer in a variety of cases.

My opinion would be the hospital should open up to the police and accept their fate whatever the outcome. The gov./police makes the calculation of the impact of X people dying a very public way, the Y amount that is requested, and the ton of other wildcards (e.g. can we catch the gang now ? after the ransom is paid ? void the ransom some way afterwards ? limit the number of death in other ways ? what will the other victims take away fom this case ?).

At the end of it there should be a custom approach to that specific situation and not some blanklet policy application.

This also assumes a cooperative and somewhat decent police force, which might not be the case everywhere (but then I think we're screwed anyway)

They’re supposed to back up their data and set up proper contingencies. By failing to do so, they are already putting patients lives in the hands of the encryptors.

Yes. Of course they were supposed to do so, then. But they didn't, and now they've been hit. Now, in the real world, what are they supposed to do: pay, or hold out and let the patients die as punishment for the hospital's mistakes?

> Of course they were supposed to do so, then. But they didn't, and now they've been hit.

In order for this to be a useful tactic, there needs to be no defection. The only way there can be no defection is if the legislature prohibits defection.

At that point, the hospital is on notice that they have to apply adequate security measures against this kind of attack. For instance, hospitals normally have power supplies that are capable of getting them through foreseeable blackouts. If they're going to rely on computer systems in the treatment of patients, they had better make sure they're secure. Right now, today, it isn't a surprise.

And the hackers are on notice that they are effectively killing the patients. The hackers are after the money. If the threat of death will get them the money, they're all for it. If it won't, they'll move on to a country where it does work.

Let the patients die. That’s on the hackers hands, not the hospital. Additionally, you’re making a huge assumption that the hackers are willing to escalate themselves to mass murders, which is a big leap most criminals aren’t willing to take.

"“Never negotiate with terrorists” is a simple and clear mantra, and as most clear and simple concepts it hides a lot of assumptions"

The word 'terrorists', for one. It's mostly used to mean 'my opponents' these days.

What we are facing with ransomware is not insurrectionists or protestors, but gangsters. They make their living by stealing from people, cheating them, and threatening them. Many insurrectionists are honourable people that you can safely make a deal with. There is no gangster with that property.

Take backups, test the recovery procedure, don't make bargains with gangsters.

I don’t think this mantra was ever anything more than a meme. LE always negotiate, this mantra is designed to just better their negotiating position

> because the society benefits

That's the theory. But much like war on drugs or TSA, whether its real-world outcomes match the theoretical ones is debatable.

https://www.newamerica.org/international-security/policy-pap...

From another comment, it looks that mantra will become law in the US

https://cisomag.eccouncil.org/paying-ransom-is-now-illegal-u...

Isn't that just applying existing sanction law to ransomware?

It’s not really about sacrificing people for the greater good. Negotiating has high externalities that include future murders. Like all externalities, the involved people don’t give a shit.

> who already screw the public day in day out

And then everyone clapped at the high-brow analysis.

Until your own child or spouse is held hostage or sequestrated. You will negotiate.

Taxation works exactly like this.

You might even want to establish an isolated society, but if you try, good luck dealing with the IRS.

From the perspective of the individual, there is no greater good than defending one’s self.

Hardly. There are many philosophies that argue that the greatest good lies with how we interact with the other.

And on a purely primal level it's common to prioritize one's offspring over one's self. I think most cultures recognize this intuitively.

I’m not arguing philosophy. I’m arguing how absurd the statement “it’s crazy hard to get people to sacrifice themselves for the better good” is, as if OP would sacrifice his or herself for anyone here they didn’t know.

What a grand delusional statement, like the sibling comment here. It’s literally arguing moral superiority while ignoring pragmatic reality.

Maybe you watch a little bit too much television, but there are plenty of spouses out there who would, for example, not want their wife to die in childbirth if they had the option.

If you don't see the chasm between "people should sacrifice themselves for the greater good" (which I'd generally disagree with, particularly if you're not defining what the greater good is) and "there is no greater good than defending one’s self" then I can't help you.

I tried to put it in a neutral way, and I think it’s a far from a black and white issue.

Not to go too sideways, but hostage (with humans, not data) situations are typically about other people. When you’re the target, it’s not your life on the line, but your loved/valuable ones. So you’re not defending just yourself, you actually have to care about at least someone else to have it happen to you. And some care about a lot more than just their loved ones, they’ll also think about their friends, family, sometimes the rest of the society.

Everyone is different and there is no absolute best, but let’s at least recognize it’s complex and there’s lots of ways to think about it.

What an absurd statement, to just say unequivocally, ignoring the plenty of philosophies and ethical systems have disagreed entirely with that.

Yeah, totally absurd. Would you sacrifice your life for the strangers on this forum? Let me guess, no? Huh, wild.

Wait, so you think that defending anonymous strangers from the internet is an exhaustive set of circumstances where one might risk their life?

Oh, of course.

There are people who would.

Yawn.

Reply on news.ycombinator.com