11–20 of 27 posts
Earlier quoted context omitted.
Nothing like blaming the victim. What's next arresting people for handing over their wallet at gunpoint?
Seems like a matter of game theory strategy vs. tactics. If everyone were to fight back against muggers, it seems like there would be fewer muggings. But tactically, it might be best for an individual to hand over the wallet.
Earlier quoted context omitted.
Nothing like blaming the victim. What's next arresting people for handing over their wallet at gunpoint?
The victim fails to be just a victim when they actively contribute funds to a criminal enterprise. The gunpoint analogy is a poor one; being coerced by physical violence is one thing, being coerced because you lost your files (and don’t have backups) is another. It’s a horse of a different color.
How in the world would we enforce this?
How do we enforce every other law? If the authorities get wind of someone paying a ransom, they could investigate and then decide to prosecute if they discover that it was highly likely that a ransom payment was made. For the specifics of ransomware payments, for public companies, which line items does that amount get attributed to on the quarterly reports?
That means less potential profit for ransomware makers, less incentive to make ransomware, and less money to fund ransomware development.
Earlier quoted context omitted.
I am not a lawyer and entirely just guessing. I am probably wrong but if people are paying money to organized crime then perhaps it could be interpreted as aiding and abetting organized criminals using corporate funds and thus maybe possibly the government could use the existing Racketeer Influenced and Corrupt Organizations Act (RICO) of 1970. Or maybe not. Maybe a question for lawyers that have litigated RICO cases…
Nothing like blaming the victim. What's next arresting people for handing over their wallet at gunpoint?
LLike they would care about their victims facing legal consequences. If they don't pay, nuts to them. If they pay, I get money.
LLike they would care about their victims facing legal consequences. If they don't pay, nuts to them. If they pay, I get money.
LLike they would care about their victims facing legal consequences. If they don't pay, nuts to them. If they pay, I get money.
Yes, obviously they don't care about the legal consequences for the victim. The goal is to make them think they won't ever get paid due to the threat of legal consequences on victim, and therefore they wouldn't bother doing ransom in the first place (which is pretty unrealistic imo).
The victims won't pay because they don't want to go to jail. If no one pays—or even if people pay much smaller amounts that are possible to hide—there isn't an incentive to launch ransomware.
Earlier quoted context omitted.
Yes, obviously they don't care about the legal consequences for the victim. The goal is to make them think they won't ever get paid due to the threat of legal consequences on victim, and therefore they wouldn't bother doing ransom in the first place (which is pretty unrealistic imo).
Why is this unrealistic? The victims won't pay because they don't want to go to jail. If no one pays—or even if people pay much smaller amounts that are possible to hide—there isn't an incentive to launch ransomware.
My assumption is that the cost to find victims and make the request is low enough and that number folks that will still pay regardless of the law is high enough to make it it worthwhile for the bad guys.
Best case, it lowers the profit margin for the bad guys. Meanwhile, the victims face being punished even worse.
LLike they would care about their victims facing legal consequences. If they don't pay, nuts to them. If they pay, I get money.
Businesses won't pay if their executives think it may cause them to go to jail.
Yes, many big businesses may stop paying since the executives don't want to go to jail. Realistically if they are that big they can probably come up with a legal argument to justify the payment though within the mess of exceptions that would have to exist if this became a thing.
In the end the bad guys are just going to adjust to target smaller companies that would be under the radar for being caught paying.
In the end it doesn't really matter what the dynamics of it end up being. If it pays off to ransom, it will still happen, and I think there will always be a way to make it pay off for quite a while.
The only real solution is better security that makes it unprofitable to even attempt to breach a company that makes a random possible.
Threatening legal consequences for the victim is a very sideways way to go about achieving the goal of deterring the bad guys.