Hacker News Reader

Comment by ars | Hacker News Reader

The US should make it illegal to pay ransom, with a penalty of prison for anyone paying a ransom or authorizing payment.

The purpose of the law is that now ransomware gangs will be less likely to target US companies because companies are unlikely to risk paying them.

View on HN

It's maybe already illegal[1][2].

That doesn't stop companies from paying for it. If you're a hospital, you're weighing breaking the letter of the law with killing a bunch of people.

[1] https://www.gma-cpa.com/technology-blog/paying-ransom-on-a-r...

[2] https://cbs12.com/news/cbs12-news-i-team/hospital-ransomware...

Paying ransomware is not in any way illegal in the United States. Making payments to sanctioned entities (ransomware or otherwise) is. If companies go to their insurer, etc, they will probably get help to do the compliance to check to see if the payment requested would go to an OFAC sanctioned entity or not.

Is the duty to make sure you know you aren’t paying to a sanctioned entity, or is it to not know whether or not you are?

Given the sources of many of these attacks, one should reasonably assume they are likely to be doing business with a sanctioned entity, right?

There isn't necessarily a way to know who you are actually dealing with. Maybe in some cases there might be some information to figure this out to some degree. But normally the only information that is certain is where the payment is going. Which is just a bitcoin wallet address.

If you aren’t a hospital, you are helping the ransomware gangs amortize the cost of their R&D. Thus directly helping those who hit hospitals, and, as a result, contributing to those deaths.

No I did not pay a ransom, I paid a 7 figure consulting fee to a cyber security company not based in the US, who somehow magically resolved the issue for us...

— If you don’t give me 10k$, I will tell the authorities that you have paid a ransom of 100k$. — Ok, here’s the money. — Thanks. If you don’t give me 10k$ more, I will tell the authorities about our previous deal.

That's stupid. If you don't actually pay them, there would be no evidence of you paying them. Their case would hold absolutely no water.

There are instances where that doesn't make sense. For example, there was that plastic surgery office that got hacked a couple weeks ago. I get why they think it's better to at least try to prevent such private information from getting out. making it illegal to pay the ransom means that every patients' medical history and pre/post op photos would be leaked. That's a nightmare.

Reply on news.ycombinator.com