Hacker News Reader

Comment by ukoki | Hacker News Reader

How is it even legal to pay ransoms? Surely this is transferring money to criminal enterprises. If it is not illegal it needs to be made illegal.

View on HN

As I understand it, it is indeed illegal in most countries.

What happens in practice is the victim hires a 'data recovery specialist' company, provides them the encrypted files, and ask them to decrypt them with their magic algorithms. The data recovery specialist coincidentally is paid a little bit more than the ransom. The specialist then contacts the hackers, pays the ransom, decrypts the files, and provides them back to the victim. Specialist, victim and maybe also law enforcement do their utmost best not to ask/explain how exactly the files were decrypted, citing e.g. trade secrets or an accidental key leak in the malware.

The data recovery specialist generally hires a contractor, who hires a contractor, who ... , so ransom money trail passes trough plenty of jurisdictions to darken the trail.

Any sources on that?

Certainly not 100% of cases but very common:

"As ransomware attacks crippled businesses and law enforcement agencies, two U.S. data recovery firms claimed to offer an ethical way out. Instead, they typically paid the ransom and charged victims extra."

https://features.propublica.org/ransomware/ransomware-attack...

What if ransom is paid but the attackers do not fulfill their end?

This is possible of course, but it would reduce the willingness of people to pay bribes generally. Also I guess it might cause the victims to take more desperate measures, possibly get more attention by law enforcement somehow.

Always a good question. A group of security people with experience in the scenario was trading about it on a conference a while ago. I far from knew everyone in the group.

Always a risky answer, of course, especially from some random person on HN. But in this case, it makes sense, and a 'long arm', international treatment is a general solution for powerfull entities needing to break a law.

I don't think you'll find anyone going officially on record as breaking the law, however. Most companies won't even let it leak they're a victim.

So the data recovery specialists are providing money laundering as a service (MLaaS)? ;)

it is.

depends on jurisdiction, but if the ransoming organization is a sanctioned entity, it may be considered an illegal sanctions violation.

for instance, the US OFAC has issued this statement warning companies to not pay ransoms: https://home.treasury.gov/system/files/126/ofac_ransomware_a...

royal mail is in the UK, but the UK has its own sanctions regime with similar penalties.

edit: the UK OFSI has issued a similar warning this month

https://assets.publishing.service.gov.uk/government/uploads/...

The prospect of a world in which victims are transformed into criminals is profoundly dystopian.

Such laws run the risk of fostering a climate in which individuals frequently transgress established legal boundaries, with the authorities given free rein to target anyone they please on a whim.

This would inevitably lead to a breakdown of the rule of law and a culture of lawlessness that would imperil the rights and liberties of all citizens.

"Preventing large monetary transfers to organized crime inevitably leads to a culture of lawlessness and imperils all citizens" is certainly an interesting take, I'll give you that.

The alternative is a moral/philosophical claim that there are no situations where dealing with organised crime is acceptable.

This is patently absurd, as there exists not only situations where its reasonable but an imperative to deal with organised crime.

Such as?

Hackers gaining control of air traffic systems and threatening to shut them down or threatening to open dams during peak monsoon season?

Hackers gaining control over the space station and not only threatening the lives of the crew but also threatening to send it back to earth targeting a high population area.

That's weird. It's like saying it should be illegal to give your wallet to a mugger.

It’s more like the mugger already has your wallet, but says they’ll give it back if you make a $1000 donation to their criminal organization, going around normal law enforcement.

I’d guess that’s also illegal, but IANAL.

It is not very similar I think — in a mugging the “don’t pay” downside is violence, possible death. In a ransomware situation, the victim is basically making an economic decision — is the cost of losing their files greater than the cost of the ransom.

The cost of dying is basically infinite, the cost of paying the ransom can be shifted up and down with fines until it is high enough to disincentivize paying.

I don’t know. A mugger could make other threats too that aren’t direct bodily injury or death. It could be “pay me money or I’ll burn down your restaurant” (that’s more like a protection racket than a “mugging”). That’s pretty similar to the threat to one’s livelihood that many of these ransomware attacks constitute.

Yeah, that’s more of a protection racket. Mugging is essentially by definition backed by the threat of violence I’m pretty sure. Possibly a bluff of course!

Sure, that would be fine if the govt. is willing to help cover the loss of business. This is not without precedent, like 2008 and 2021 bailouts.

Should we also make it illegal to get mugged? Make it a crime to be murdered?

Making the payment of ransom illegal just means you never hear about ransoms again.

In general you are allowed to do something illegal if your life is in danger. That is if I'm kidnapped I'm allowed to pay what is otherwise a bribe to go free.

So we should make getting mugged illegal, so long as the law is clear that the illegal part only applies if you have a reasonable way to get away from the mugging without paying. I'm not sure how you can be mugged and yet have a reasonable way to get away without paying, I leave that question to the reader.

You don't turn victims of crimes into criminals as well. This shouldn't need to be said.

> I'm not sure how you can be mugged and yet have a reasonable way to get away without paying, I leave that question to the reader.

What if you're skilled in hand to hand combat? Or what if you're familiar enough with firearms to notice the mugger's weapon looks fake? Would you then be legally required to attempt to fight back? Would a judge need to estimate your probability of dying, and if it was under some threshold you would be punished for not attempting to fight?

While ridiculous, I bet it would probably result in less muggings...

It's also orders of magnitude cheaper to just restore from backup.

I can't imagine their S3 bill is above 80 millions...

That's not how ransomware works. They typically wait 3-6 months before making the demand, your backups will contain the infected files.

Crazy that none of the major companies hit by ransomware haven't thought of that...

Why would it not be legal? If I was a hacker, the existence of a law prohibiting businesses from paying cyber ransoms would not deter me. If a company wanted to follow the law and refused to pay the ransom the hackers asked of them, the hackers could follow through and delete or irreparably corrupt their files. The potential upside, that they pay the ransom, is significant, while the downside, that they don't, doesn't mean much. They'll just keep probing for targets. What are they gonna do? Arrest them? In all likelihood, they're hiding behind multiple VPNs, working from a virtual machine, from a country without an extradition treaty.

The argument seems implausible as it assumes that hackers would persist in deleting data, whereas in reality, they would probably shift their focus to other targets such as private companies that lack similar prohibitions. It is unclear what incentive they would have to continue hacking public companies if they cannot profit from that?

> It is unclear what incentive they would have to continue hacking public companies if they cannot profit from that.

The intent would be to put pressure on national legislatures to repeal laws that make paying ransoms illegal. Smart ransomware groups don't care about targets that can't afford to pay. So any "inability" to pay is either the result of stubbornness or a law, both of which can change if enough pressure is applied. Of course, the solution is for businesses to harden their systems enough to resist these sorts of intrusion in the first place.

Company pays Cyber Insurance which contracts 3rd party in Panama/SA/Israel to pay the ransom and report back the decryption key.

Completely legal.

Note too that the threat of the law may be enough motivation to stop payment. Insurance in particular is already starting to look at how hardened your IT systems are as part of your coverage.

If paying ransoms become illegal in many countries, it would be very hard to find targets willing to break the law and pay ransom, making it less attractive of an attack.

Companies and people pay bribes all the time. But since it's illegal to it's kept secret.

True - but if it's made directly illegal it will still have some effect on the number of victims willing to. It won't solve it, of course.

I don't think this is correct. There is very little cost, and risk, in conducting ransomware attacks. So even the odd chance of finding a target willing to break the law and pay up would be worth it. And in the long term, black hat groups could put pressure on national legislatures to amend the law by following through on their threats and deleting or releasing the files they've encrypted. One can imagine a not so far fetched scenario where entire industries are held hostage by a small group of anonymous individuals demanding to be paid or else, and legislatures capitulating and amending the law, because the alternative, to lose - lose, as in, complete bankruptcy - entire industries and corporations would be too costly in comparison. Black hats could even compel legislative changes by credibly threatening to compromise the personal data of politicians themselves.

I think this is a little far-fetched - I'd like to believe something (legislator comes clean, fed govt investigates more thoroughly as it is a direct threat to our democracy, etc) would stop that from happening. Worse has happened, though.

I do believe that if the "market" for victims shrinks, naturally the number of ransomware attackers will shrink - sure, ransomware is "easy", but perhaps there's easier cybercrime to be committed with better odds. (I'm not sure how likely this is - I bet the ransomware scene is nowhere near saturated)

Surely it would still depend on the normal economic calculations of the involved parties, like the penalty for paying a random, the likelihood of getting caught paying a ransom, and all the existing calculations like the value of the data to the victim, the penalty and risk of getting caught for the ransomers themselves, etc. You don't just get to say "making it illegal will destroy the incentive to do it," and if it doesn't work you can't just keep increasing the legal penalties until it starts working.

This is true. It is a financial decision. The costs options are:

* pay enough in IT to run an up to date, secure system

* pay enough in ransom to get your files

* eat the cost of losing your files

Adding a possible fine to the middle one means the cost of the top and bottom ones can be higher. Either non-paying option makes the business of running ransomware schemes less viable.

Reply on news.ycombinator.com