I wonder about whether governments could make it illegal to pay ransomware.
If a business from country X could not legally pay, then what would be the point of attacking any company from country X?
If a business from country X could not legally pay, then what would be the point of attacking any company from country X?
https://www.chicagotribune.com/business/ct-biz-ransomware-pa...
(Article) https://www.lawfareblog.com/ransomware-payments-and-law
(Podcast) https://www.lawfareblog.com/lawfare-podcast-how-can-congress...
The article is a bit long, but I think the most salient parts are:
> Consider, for example, Section 2339(B) of the material support statute, which makes it a crime for a person to provide material support or resources to a designated foreign terrorist organization. [...] But, at its core, it’s a ban on the giving of something of value to a designated overseas group. There is no exception in the law for circumstances like ransoms, though nobody has ever been prosecuted for material support in a situation involving, say, a kidnapping or hostage taking. So if Hamas or Al-Qaeda got into the ransomware business, it would already be a crime to pay the ransom—though it’s not clear whether the government would ever use its enforcement discretion to bring such a case.
> [big list of similar laws]
> Each of the aforementioned authorities is a piece of a legal puzzle that allows the government to target individuals and organizations in certain contexts. But these authorities are generally not well suited to be effective against current ransomware payments in general.
> Generally, most of these laws, like the FCPA, will not apply, because the offending party often has only a tenuous connection—or perhaps no connection at all—to a government official. Even if it does, a prosecutor would have to prove that the payer knew this, which seems improbable.
It seems to fall into this weird gap where it isn't clear if it is more like paying a ransom, paying for an IT service, or more like paying a bribe to continue doing business.
Corporate accountability is laughable. So just break the law, get your small little fine, accept no wrong doing, and move on.