Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The push to ban ransom payments is gaining momentum

socket.dev

Post reply on HN
Print view View original

171–173 of 173 posts

Re: The push to ban ransom payments is gaining momentum

#171

Post by devilbunny »

lelanthran wrote: post #43
NoMoreNicksLeft wrote: post #25

Earlier quoted context omitted.

How could it realistically be enforced? Never mind whether it does what we want, can we even perform the action? Imagine that we send anyone who orders that ransom payment be made, or those who conduct payment are all sentenced to death by boiling them feet first in oil. Imagine that no judge or jury shies away from the punishment. Then imagine that there are 1 million of these crimes per year within the United State…

> How could it realistically be enforced? By the tax authorities, who are already looking at every payment a business ever makes anyway! > This is unenforceable. Only for amounts that come from petty cash, at which point you have effectively reduced the major financial motivation for such crimes anyway.

The tax authorities care what you list as an expense. If you aren’t a public company and don’t try to write it off as an expense/loss, they don’t care.

Re: The push to ban ransom payments is gaining momentum

#172

Post by banish-m4 »

EvanAnderson wrote: post #127
rjmunro wrote: post #86

Earlier quoted context omitted.

For Ransomware, Backups need to be offline, not necessarily offsite. I.e. there needs to be no possibility of the hackers corrupting or deleting the backups too. If your data is in the cloud, it's probably good to have an offline backup onsite - sometimes cloud providers delete your account: https://news.ycombinator.com/item?id=40304666

> Backups need to be offline... ...and tested on independent infrastructure. I worked with a financial Customer in the late 90s who, quarterly, sent a backup to an independent party for restore of the data into a freshly created application environment. They verified the backup with reproduction of key reports and random spot checks of data. It was impressive.

That's proper backup verification. At a minimum, restore to nearline temp storage. Ideally, backup and verify against hot storage SAN or FS volume snapshots.

For absolutely business-critical data, I would consider using multiple backup approaches and/or vendors. Shout out to Tarsnap as vital here that every commercial enterprise should use for essential customer, contract, and accounting data.

Re: The push to ban ransom payments is gaining momentum

#173

Post by trashtester »

iLoveOncall wrote: post #162
trashtester wrote: post #87

Earlier quoted context omitted.

> You could change that percentage to any amount and it wouldn't change a thing, So what you're saying is that the criminals could quadruple their demands, and everyone would still pay? I doubt it works like that. SOME high profile companies would still pay, but in many cases the threat would not justify paying 4x more. If we assume the criminals do not generally do much research on each company's ability to pay, but…

> So what you're saying is that the criminals could quadruple their demands, and everyone would still pay? No. There's a major psychological difference between paying 1M to criminals to recover your data and 3M to the government, and paying 4M to criminals.

If anything, I suspect many company leaders would see the 3M tax as a bigger incentive to refuse to pay than paying those extra 3M to the criminal.

At least the capitalists I've met tend to really HATE taxes.

Post reply on HN