Hacker News Reader

Comment by alias_neo | Hacker News Reader

I'm curious what the real goal is with demands like this.

Surely, given the size of the demand, it is beyond the authority of TSMC to pay up, even _if_ they wanted to?

I imagine governments and authorities with any sort of stake in what could possibly be done with such a sum of money (it's unlikely to be used for Good, right?) would have an oversized say in whether or not they are allowed to pay it?

Is there recent precedent for ransoms of this size being paid?

What kind of data could they actually have "stolen" that's worth TSMC paying up $70M, rather than just writing it off?

View on HN

TSMC is the largest semiconductor manufacturer in the world and they have technology and manufacturing processes literally no one else has. As of right now their market cap is roughly $500B. Surely they hold information that's worth more than $70M.

Yeah, but that info isn't in this dump.

Most of it probably isn't even on paper but in the minds of their top employees.

If that's true those employees could be kidnapped for a high ransom...

Institutional knowledge is more akin to the ship of Theseus. Good companies know this, after all, even super knowledgeable employees sometimes look the wrong way when crossing the street.

You would need most of the people. One high level person is meaningless. Sure you can say "Dave" knows everything, but any smart company knows Dave could retire, or die at anytime and so the important stuff he knows is spread among a bunch of other people. Often it is also written down, just not in an easy format.

That's a much higher bar than hacking into some computers. And also, as people pointed, unless you are wholesale kidnapping enough people to fill a prison, it doesn't work like that.

I'm aware of their position; The info in this dump is probably worth little not nothing, but, the interesting conversation to me is whether even if someone did get some of their secret sauce, could they really build another TSMC, or even something similar?

Sure, given a billion dollar budget, few years to work, and a legal environment that lets them use those stolen secrets. It can't be done cheap, overnight, or where the legal environment doesn't allow it. Really only China, while plenty of places have smart engineers, the rest cannot get the rest together (and if they tried it would kill their economy).

Note that TSMC depends on other companies for various parts. Without those they need even more money and time to duplicate it all. There is nothing they are doing that you can't hire engineers to duplicate. They figured it out, so anyone could. However it isn't easy, we could be talking about hundreds of billions of dollars.

A billion dollars is not enough. The cutting edge tech for euv lithography isn’t even TSMCs.

TSMC does not have secrets that put them ahead. It’s all about the culture of operations efficiency and just being first to invest in actually implementing cutting edge tech.

The lithography is one of the technologies needed that if they can't get can bump this up to a lot more than a billion dollar. It can still be duplicated, but it will take more time and $$$.

Hell no.

ASML is the only company that sells certain equipment needed for photolithography. These machines are physically large and sell for hundreds of millions of dollars. Their export is regulated by multiple governments and international treaties. There are intelligence agencies tracking every single one of those machines and ensuring they don't fall into the wrong hands.

This is just one fatal flaw with the plan.

> they have technology and manufacturing processes literally no one else has

What, not even ASML that literally sells them that tech?:) No need to over dramatize.

I mean maybe but that is completely unrelated to what OP is asking. He's questioning whether they would have the ability and the authority to move that amount of money to a criminal.

> Surely, given the size of the demand, it is beyond the authority of TSMC to pay up, even _if_ they wanted to?

Think again. Companies try to hide it really well but million-dollar ransoms are paid all. The. Time.

Likewise with insurance payouts for kidnapping ransoms

A friend of a co-worker works for a contracting agency with services including incident response for data ransoms. He says their go-to tactic is to haggle with the ransomers to bring the ransom down to some fraction of what the customer paid them and then implying to the customer that they cracked the key.

Assuming the security consultant and the ransom gang are even distinct people at all. IT Sec is such an incredibly shady industry.

That's what Garmin ended up doing. The group had sanctions, so they had to pay a British company.

https://www.theverge.com/2020/8/4/21353842/garmin-ransomware...

Yes, though in the case I am most familiar with, making the payment was a big deal because the hackers were in a sanctioned nation, which makes sending payments there illegal. If I recall correctly they went through some intermediary but still made the ransom payment. Which goes against all of the annual import/export corpo training, but I guess they found a loophole.

TSMC has most desired technology and knowledge of our time

It is modern equivalent of "rocket science" decades ago

Seriously. They might be the most valuable organization in the world to target for this sort of thing.

Absolutely not. Read “the chip wars”. It does a good deep dive into the relationships of all of these companies.

TSMC is amazing but they didn’t invent nor build the EUV lithography machines that enable their processes.

Youre right

I tend to write this about whole semico, but this time I went just with TSMC, but it isnt fully correct

For bigcorps, the ransoms are often 20-30 million USD. One of these is probably paid every few days. TSMC can easily pay 70 and might.

TSMC had 70+ billion USD in revenue last year. There’s plenty of data worth 70 million dollars to them

Sure...but not the data that was stolen. This data might be equivalent to the employee handbook for all we know...everything states that it has nothing to do with their advanced technologies.

It's more about preventing business disruption.

> the size of the demand

It's not even 12 hours revenue for TSMC.

Or about a full day of profit with an operating margin about 50%.

My point is more about what could be done with $70M in the wrong hands; that's the bit I imagine authorities that might move to block a ransom pay from happening would care about.

So much of the world's wealth is already in the wrong hands. What's a little more?

I know right. Thats why UK and swiss provide safe heaven for dirty money in order to keep it away from criminals.

Reply on news.ycombinator.com