Arguments Against Criminalizing Ransomware Payments

Ransomware is a tough global problem to address. It's a technical pandemic impacting the digital ecosystem and all the people connected to it. If we want to end ransomware, we have to act. It will not simply go away. Strategies must be evaluated so we can move in a deliberate way. To stop ransomware from growing into a terrible menace that impacts everyone repeatedly. This is an endeavor where we face an intelligent and highly motivated opposition. We must think strategically with careful forethought to attain our goals. As a cybersecurity strategist, a CISO, 30-year industry veteran that has pushed the boundaries of digital security, I've looked at a number of different options and I've come to two conclusions. First off, there is no easy, painless, friendly way of undermining this rising global threat. Every solution comes at a cost. There are risks and undesired side effects. Ridding ourselves from the risks of ransomware will take commitment, collaboration, and effort. And secondly, of all the options, only one has the desired long-term benefits that we're seeking to undermine the risks of ransomware attacks to the point that they're really no longer a serious cybersecurity risk to anyone. And to accomplish this goal, we must unequivocally stop the flow of money to attackers. That's key. And the only way that we can make that happen, truly consistently make that happen, is by criminalizing ransomware payments. I discussed this idea in great detail in another video, and I'll put it in the link I'll put a link to it in the description below. Understandably, people have doubts, concerns, fears, and disagreements against such a radical move. Today we will be addressing the collection of arguments against criminalizing ransomware payments in hopes we can come together in identifying a good path forward to end ransomware. In this presentation, I will cover over a dozen different arguments against criminalizing ransomware payments. These have been collected over time as I've been engaging my peers and the industry, exploring different options. These are the common concerns that repeatedly emerged from those discussions. I've marked the time and jump points for different arguments in the description field to make it easier to jump, well, directly to the various arguments that might be of interest. Now let's get started. Now, very briefly, uh, I've talked about all these aspects in previous videos, but this is an important foundational piece. There are many aspects we have to kind of look at. The fact that ransomware is significant, that the attackers are intelligent adversaries. So a single move won't work. The fact that ransomware is not just a problem for a single company, it actually impacts, well, governments, organizations, companies, businesses, individuals. And when things like critical infrastructure get hit, it actually can impact an entire nation or society. And ultimately we need to do something. The status quo of how cybersecurity normally works just doesn't address ransomware. Ransomware has grown staggering amounts even in the face of cybersecurity innovation over the past several decades. And when we look at what we would consider a success criteria, any solution, any path that we look at or evaluate really needs to deliver against a number of different requirements: effectiveness, timeliness. It has to be affordable. It has to be usable. And sustainable over time, especially given how the attackers, those intelligent attackers, will adapt. And lastly, I cover this again in one of the other videos, when we talk about criminalizing ransomware, it kicks off a whole chain of events, and that's what's really important. It's not just about making paying ransoms a criminal act. No, that just starts the chain reaction that ultimately ends in the attackers abandoning ransomware as a legitimate means of satisfying their desires of gaining money. And that's what we want. We want the cyber attackers to stop launching ransomware attacks. You know, the premise about criminalizing ransomware is it does all of that, it kicks off this domino effect, and that it does satisfy all the success criteria. And in a bold move, also saying, hey, it's the best of all the options that we've seen thus far. Ransomware has been on my radar for several years. As a strategist, I've been looking at it for quite some time, communicating with the industry and working with organizations to understand and and advised that this is going to get much worse. And I still hold that position. It is going to get much worse than it is right now. And in the past several months, I've been exploring different options and having great conversations with cybersecurity professionals, risk professionals, you know, government people, law enforcement. And again, no solution is easy, perfect, or friendly. They all come with costs. And through those conversations, many arguments bubbled up that tended to come back again and again and again. And these were the primary concerns. You can see a list, there's more than a dozen of them, and it's easy to kind of group them into 3 different areas. The first grouping is really around, hey, it's just not going to be effective. It will not stop ransomware, right? We can't pass a law, we can't enforce it. And I've talked a little bit about this again in other videos, but we're going to go through each one of those. The second area is about the victims. We are, in essence, putting a law in effect that says the victims cannot pay their attackers. And it seems almost unfair. Why are we, why are we penalizing the victims? There's many questions around this. And, you know, whether it's fair to small and medium businesses, you know, what's going to happen to critical infrastructure, all those kinds of things, all valid concerns. We're going to talk about all of those as well. And lastly, many people come up and say, oh no, that's not the right way, this other path, this other solution is better. And when we dive into it and start tearing that apart, and seeing how that evolves over time, and whether that really meets the success criteria. We find no, they really don't, and it becomes kind of an enlightening discussion. So we'll cover these as well. What is important for all of us before we dive into that is to understand this has a purpose, and our purpose is to find the best solution. We want to get rid and end ransomware. That's what we all want. The bad guys are victimizing the entire world and they're not going to stop. So we need to act. And in order to act, we have to act with forethought. We have to be thinking about these things ahead of time and make the very best decision. So if we think of it as a, as a process starting up on the left-hand side, We have to ask ourselves, you know, does this strategy of criminalizing ransomware as a start, does that solve the problem? Does it meet that success criteria? If it doesn't, well, let's stop talking about it, right? It, it's not what we need. Let's move on to the next one, right? If it does, great. Let's ask ourselves, is the solution better than the problem over time? Right, we don't want to create more issues than what we're solving. The cure cannot be worse than the disease, because if it is, we need to stop. That's not the right answer. But if it isn't, if the solution makes things better, and as part of the requirements it has to make it a lot better in fact, then great, let's move on. Let's move on to the next question, and that next question is is the solution we're looking at, is it better than all other competing solutions? When we truly look at the logic and how this is going to flow over time and how it meets the success criteria, is this the best solution? If it is, we're done. Let's go implement it. Let's get behind it and make it a reality. If it's not and there's a better solution, well then let's all get behind that better solution. Right, but we have to act. Inaction is what fuels the bad guys doing bad things, and we can't wait. We have to start moving on this because it will take time. No solution is a snap of the fingers. They all have a certain lead time to even start having positive effects. So we need to start working on this now and implementing a solution now. And again, the goal is we're not going to find a happy or perfect solution. It does not exist. We have to choose the best of what's available to resolve the problem of ransomware. That's where we're headed in this discussion. Okay, with that, let's dive in to the first grouping of arguments, and it's around criminalizing ransomware payments. They simply won't be effective. That's the theme here, and we've got 4 different areas that we're going to touch on. And let's jump into the first one. The first one is, hey, it's not possible to enact such a law. And I've run into this several times, and well, that actually isn't true. Yes, Congress actually does have the ability to pass such a law. Many legislatures actually in the states are also exploring laws for their states to outlaw ransomware payments. So yes, It is absolutely possible for us to pass a law that starts this, this desired chain reaction. In fact, there's already a precedent. There's, there's already a law that covers this to a certain extent. The US Treasury's Office of Foreign Assets Control actually made it illegal to pay ransoms when the attackers are considered, well, threats to the national security. And taking a look specifically at what that says, and you can read it right here, basically they say, hey, you cannot— it is prohibited from doing transactions, right? Financially supporting or helping out or anything like that, directly or indirectly, these entities. And they could be persons, they could be organizations that are blocked, right? It could be entire countries. That are trying to undermine US interests, and they have a list that they maintain. So there's already a law in place. What we're talking about is simply expanding it to say, hey, guess what, all ransomware are undermining the strength and integrity of the country, critical infrastructures, victimizing people, you know. So in answer to, can a law be created? Do— can we? Absolutely. Absolutely. So let's dispel that right now and move on to the next question. In this one, it's, hey, a law like that outlawing the payment of ransomware, it can't be enforced. Well, actually, no. And let's set this up. First off, we've got national and state law enforcement authorities, and they do have the legal responsibility and the agencies to investigate and prosecute criminal acts. So we've got the infrastructure in place. We've got the courts to be able to figure out guilt or innocent, things of that sort. But let's kind of take a step back first, because the reality is, once this gets enacted, most business leaders, because if it's a crime and they can be held accountable, put in jail, they're not going to be paying it. Most companies, believe it or not, yes, want to follow the law. No. Executives don't like going to jail. There's a small group that, that, you know, do criminal acts themselves or willing to do that, but by and large, most companies are not going to do this, right, if that's the penalty. So in general, there aren't going to be a whole lot of offenders. And to really reinforce this, right, it is really only going to take a few examples. To be prosecuted. Not many, in fact. And that will again reinforce in the minds, hey, yeah, we're serious. Yes, there is a risk of doing this. Yes, it really is a criminal crime. And if we go back a little bit in history and we look, look at the Sarbanes-Oxley regulations, which could put a chief financial officer or executive officer in jail for falsely reporting their numbers In the first 4 years, there were only 63 convictions. And we see across the board, it affects everyone in the United States. All companies, um, you know, within jurisdiction of a certain size are— have to follow this, and they do. We see all the big companies adhering to Sarbanes-Oxley, and that's all it took. So again, when we think, oh, well, we were going to have to arrest every single— or no, number 1, there's not going to be many. And number 2, it's just going to take a few examples. And if we look at the complexity, how tough is it really to detect if things, things are going to go on? Because we're also hearing, oh well, you wouldn't know if a company is impacted. Well, actually you do. It's very easy. And the reason is you're going to have whistleblowers. If you are impacted at your company and you see the screen come up that says your files are locked, and you're talking about it at the water cooler, lots of people are going to know. If an organization does then pay the ransom and get that key, right, and this is a very long-digit kind of number or tool that takes technical insights to apply to decrypt those files. Now you've got these IT folks that have to be involved, and they're going to wonder, where did this magical key come from that you can't really derive yourself, again, it's going to be kind of obvious that somebody broke the law and paid for it. And when it comes to whistleblowers, right now in the US, whistleblowers can receive a 30% reward. Think about that. Some of these, these ransoms are in the tens of millions of dollars, and they're only going up. That's a great financial incentive to be a whistleblower. And every executive has to think about that. Yeah, it's really easy to detect. Somebody may mention something because they may get several million dollars and I go to jail. Executives don't want that risk. They are hugely averse to their personal freedoms being locked up in jail. They just— they're not gonna do it. And that's why this does need to be criminal in nature. And also, investigations in this kind of situation are pretty straightforward. Doing financial transfers from business accounts, especially of that size, or even if you break it up into smaller amounts, it's pretty easy to track. And on the back end, if you're passing that money through cryptocurrency like Bitcoin, guess what? It— there's a permanent public record to be able to trace that. Bitcoin is not truly anonymous, it's only pseudo-anonymous. All the transactions can be seen. And when you're looking for the transactions from a business to transfer US currency to some type of cryptocurrency and then pushing that cryptocurrency out to some other accounts held by the attackers, it's really easy to track. So investigations really won't be that tough and it won't take that long. Again, all this puts the right pressure in place to make sure that people are following the law, which they will. The other thing is, if somebody does go down this path, imagine if you're an executive and you decide, okay, I'm not gonna tell— I'm just gonna pay this to the extortionist. If you put yourself in the extortionist's shoes, they first off infected you with ransomware and you were willing to commit a crime to pay them, and you paid them. The next step is to go, now I'm going to extort you again, and if you don't keep paying me, I'm going to report you to the authorities and you're going to go to jail. And you're dealing with an extortionist. This is what they do. They will see this as a perfect opportunity to continue to exploit and, and extract money from these who do break the law. Again, executives, when they realize that, that this is— there's no good ending to that story, they simply will comply with the law. So we won't really have to enforce much to get the overall benefit, to kick over that first domino and start that chain reaction. Okay, the next one in this section is the argument that it won't seriously restrict the flow of money to the cyber criminals, to the ransomware attackers. And it absolutely will. And I've got another video that talks about why, why the attackers will actually shift away But if you can imagine the billions of dollars flowing— soon it'll be expected to be trillions of dollars— that are flowing to the attackers, most of that now is actually coming from government organizations, big businesses, um, victims that have a lot of money. Again, we're seeing ransoms in the tens and sometimes hundreds of millions of dollars that are being asked for. And if we look back in the history of ransomware, ransomware actually started with going after individuals. And what the attackers realized is individuals, they don't really have that much on the line and they don't have that much to spend. So the ransomware amounts were small, they didn't get high payments around it. You know, locking someone's family pictures, it's a pain, but nobody's going to spend tens of thousands of dollars to get them back. So they moved to businesses, and these businesses did have the money, and they did have legal contracts, and they did have customers and worried about the reputation. And so they were willing to pay. So there's a— there was a natural evolution to target and continue to target businesses, organizations, even government agencies. That's where we are now. And if those stop, a huge chunk of the paychecks and going to ransomware, then disappears all at once. And again, law-abiding citizens, small business owners, so on and so forth, they're not going to choose to commit a criminal act like this and put themselves, their business, and everything else, their family, all in jeopardy. No. And those businesses that do, and those businesses that do consider breaking the law, Again, they need to understand that the extortionists are just going to keep extorting them now. Now they're going to threaten to report them. And oh, by the way, you paid in Bitcoin. They can point to the exact transaction that you sent them and provide that to the law enforcement authorities unless you keep paying month after month after month. So again, there's really no good ending to this. There's no win. It's a no-win situation. So people aren't going to do that. Now, there will be some very technology-savvy individuals that will want to do it themselves. They think they can keep it quiet. They think they can mitigate the risk. They may try, but that's going to be very, very small. And what we're talking about here is taking the bulk of the money away from the cybercriminals. To force them away from ransomware. And so even if there is a tiny fraction, it's not gonna undermine this overall strategy. It's okay. Moving on to the last one in this particular section, and it's the argument that it won't be effective in reducing the risks, and it will. Once that money flow stops, then the attackers will absolutely shift to other types of cybercrime that will bring in money. And I've got a specific— it's a very short video talking exactly why this will happen. And, you know, attackers, they're just like you and me. They want the path of least resistance. The majority of attackers are cyber criminals, which means they're motivated by personal financial gain. They want the money. They don't care. They're not really out to destroy you or the world. They just want your money. And so it doesn't matter whether it's threatening you to, you know, expose the data publicly or lock your files that you won't get them back, or It doesn't matter. They'll do whatever they need to do in this case to get the money. But if they know they're not going to get money from US companies, they will very quickly move to other targets, really targets in other nations, right? Why would they waste their time attacking targets they know are not going to pay? They're going to allocate their time towards targets that will. And it goes back to the Willie Sutton principle. Willie Sutton was a famous bank robber, um, and he was asked by, uh, by reporters, you know, hey, hey, Willie, why do you rob banks? And although he was misquoted, basically the answer was, well, that's where the money is. And so if you remove that as a motivation, there's no reason to attack. They will go where the money is. Cybercriminals follow the money wherever it is. You take away that, that likelihood of getting any money, then they won't attack. They will go somewhere else. They will do different types of attacks, different targets. So we're applying that same basic principle that has held true since the dawn of time, right? We are using the motivations and intentions of the attackers against them to get them away from ransomware. So yes, this will absolutely be effective in reducing the risks. It's not if, it's really a matter of how long will it take. That's the greater question, but yes, it will reduce the risks. So let's jump to the next section. And this section is all around the concept that this path, this decision to criminalize payments, you know, to ransomware for ransomware, it's really impacting the victims, right? The victims are already infected with ransomware, and now we're saying you can't pay. This penalizes them. Well, yes and no, and we'll get into that because this is a really important section that people are worried about, especially with small businesses or organizations that don't spend a lot of money. And, you know, we want to be sensitive. We don't want to hurt victims even more, but we have to look at the greater good. The first one in this is it's a stance that says, well, the victims— and it could be businesses or individuals— it's their money, therefore it should be their choice to pay. Well, actually, when we look at laws within the United States or anywhere else, they exist for the common good. And there's many examples where we tell people what you can't pay, buy, support, invest in because it's against the common good. And paying ransomware, well, it empowers those attackers, and those attackers take that money and expand what they do. They scale out. They're able to innovate and develop more capable attacks and cause more harm. Paying ransoms is fueling even more ransomware that could come back to that same victim, but also their neighbors, their community, their state, the entire nation, and cause more and more and more damage. So paying ransomware undermines the common good. And ransomware is very, very, very profitable. It's in the billions right now. In fact, some ransomware groups, based on what we can track, are making close to a billion dollars a year. Some of these ransoms are getting into tens and approaching hundreds of millions of dollars for a single target, and that's a big payday for them. That also attracts more entry-level criminals, criminals that don't even have technology skills. They don't need them. Ransomware as a Service is established to bring in lots of entry-level affiliates, is what they call them, to help spread read the ransomware, and they get a slice of the profits. So this continues to grow as long as it's attractive, and that exacerbates the problem. Now, we should not be allowing— and this is a philosophical debate— but we should not be allowing companies to fund cybercrime because it is getting so big and it is making it worse for everybody. And they're also attacking critical infrastructure. So the money that the last person paid may be funding the takedown of the electrical grid or damaging water supplies or food distribution or healthcare. Again, it undermines the common good, and we have to understand the ramifications. When these companies, when these victims or individuals pay ransomware, We have to understand where that money is going. That is a resource, it's an asset, and it's going to fund cybercrime and more harm. It's harming everyone. So we have to stop it. It's against the common good. So it should not be the choice of victims to pay and support criminal activities. Number 6: This would force some victims out of business. Okay, yes, it could, but there are things we can do to minimize that risk. And if we take a step back, right now we know ransomware is growing. It's growing between 200% and now I've— the latest data I've seen is 700% per year. And that doesn't even explain the big picture, the bigger picture, because that's just how much money they're bringing in. The bigger picture is how many people are being impacted. Look just in the last 6 months, in the last year, how many cities, how many hospitals, uh, how many, uh, you know, different, uh, critical infrastructure, utilities, power, water, uh, food distribution, fuel distribution, All those kinds of things have been impacted. The number of people and the impact to society has skyrocketed, and it's not going to go down because the attackers know if they target those critical things, they're most likely going to get paid and they can increase the amount. So this only gets worse over time if we do nothing. Now, as part of this overall plan, yes, a law would be instituted, but there would be a grace period of about a year. And that would allow organizations to take the proper measures, right, to evaluate their security posture, to put in controls. And they should be doing that anyway, but this gives that extra push. The— and because they know they won't have this as an option, they know they won't be able to buy cyber insurance to pay the ransomware, uh, you know, in the event they get infected. So this is an extra push to drive them to industry best practices, and that actually helps against other types of attacks as well. So at the end of the day, this makes everybody much, much stronger and better to resist and recover from all different kinds of cyberattacks, not just ransomware. When we come out of this process, once the law's in place, What we see is instead of a rapidly increasing amount of ransomware attacks, we see a dramatic decrease in the number of ransomware attacks. So overall, again, the risks to businesses over time goes down significantly. This is an advantage, not a disadvantage. Right now, there are fundamental security capabilities and disaster recovery business continuity processes and tools and solutions that can really help organizations respond and recover. So this is not the only option. There are many other options and steps that businesses can do, and businesses have to deal with, well, normal risks anyway. There are normal business risks they have to deal with, competition, and markets, and customers, and all sorts of things. Once the law is in place and this one option, is removed, no longer available, they have to deal with it like any other business risk. They need to find the right option for them and investment and, and move forward. And good companies do that. The companies that don't do that, they may not be in business anyway for many other reasons. So again, this isn't a wide swath— we're gonna see massive numbers of businesses go under. No, that's not it. In fact, paying is not even a good option. The option we're removing is probably one of the worst things you can do anyway. The metrics that we're seeing right now is the vast majority of companies don't get all their data back. Many of them just get, you know, half or less, and we see a huge percentage of them get reinfected again. This becomes a bigger and bigger problem. Plus, they're sued, there's lawsuits, there's all sorts It's a mess. So it's better to go down this path. Some, some businesses may go out. It's gonna be a small number, and they're all gonna have the opportunity for a year or more to prepare for this one option, which isn't very good to begin with, for this one option to be taken off the table. Number 7, this This action of criminalizing paying ransomware is unfair to small and medium businesses because they simply can't afford security. And this is what I hear. I hear many people talk about this in the industry. Oh, well, the big companies and government agencies, they can afford it, but what about the small little mom-and-pop store? They can't— they're gonna be unfairly impacted by this. And actually, it's the reverse. Out of everybody, it's the small and medium businesses that actually benefit the most. Okay, think of it this way. If you're a small or medium business and you don't have that much money to spend on cybersecurity— get it, it's the reality— This actually helps you the most because we know ransom risks, ransomware risks are going up dramatically every year. So every year, regardless of the size of your business, the risk of being impacted by ransomware goes up. However, once we implement this and when we look at those chain of events and coming out of that, we know that the number of attacks, instead of going up every year, actually dropped down. The goal is an over 95% reduction in attacks. So that means your risk of being attacked with ransomware almost disappears, and you didn't have to spend a dime. You didn't have to buy additional security products or more insurance or anything else. You actually get the benefits, right? The group benefits of this better than anybody else. So the con— you know, the, the reality is this is really SMB-friendly because the overall risk of ransomware, they go down significantly for everybody. So good news for small and medium businesses. Okay, number 8. The argument is this removes a critical option for organizations, especially when they need to stay in business if they're impacted. Okay, again, we've talked about this, that paying first off is not a good idea. It's not smart. We see, um, almost all the companies not recover all their data. We see a huge amount of companies only recover partial amounts of their data. We see companies, more than half, get reinfected in a very short period of time with ransomware again. And it makes sense because from an attacker's perspective, if they, you know, infect, let's say, 100 companies and 5 of them pay, or 10 of them pay, doesn't matter how many. You've now made the list. They know you're a potential paying target. They're going to prioritize you moving forward again and again and again because they know you've already paid. So they're going after the easy victim, the easy bet. So again, paying is not a good option. It just simply is not. It's better to address this holistically so you don't have to be put in that position. So the option it removes really isn't that good to begin with. And we've seen some of the bigger companies— so for example, uh, one of the oil pipeline companies that got impacted, they actually did have backups. They didn't test them very well, so the recovery of those backups was taking a long time. And so they opted to pay tens of millions of dollars to get this decryption key and software, only to find out that it was no faster. It also took a long time to decrypt and get these files back, and not all the files were going to be recovered, and there's still issues. Plus, they paid all this money, and on their— they're now on the preferred list It's just a bad decision all the way around. And as we talked before, even if this law gets passed, there will be a grace period, right? I'm expecting at least a year, maybe 18 months, that gives the opportunity for all these businesses to, to institute other measures, right? Quality backup and recovery capabilities, better protection, better hygiene. Again, that will lend themselves to a stronger cybersecurity posture against other types of attacks and help them in that window of time where there will still be attacks before they drop off. Okay, so no, this does not remove a critical option for organizations. The grace period allows for other capabilities and options to be instituted, and this option that we're removing is not a good option to be to begin with. Number 9, the argument here is criminalizing ransomware payments would create too great of an impact to our country, to regions, because of critical infrastructure systems going down, right? And they wouldn't be able to come up quickly, you know, in— as if they were able to pay. Again, number one, uh, pain is never a good idea because you're not going to get what you think you're going to get. You're not going to get all your data back, most likely. You're probably only going to get part of it back, um, and it may come with extra things, uh, that the attacker has put in there, backdoors, so that they can reinfect you. You're also going to be a primary target moving forward for every ransomware attacker out there. As soon as the world knows that you're willing to pay, that's where all the attackers are gonna go. They're gonna try and compromise you to get money again and again and again. Uh, the grace period we've talked about also allows critical infrastructure and these kinds of things that we all rely on to evaluate their security posture, uh, bolster it, apply best practices, reorganize if need be, put in improvements. To help mitigate the risks. And again, all of that increases your overall cybersecurity hygiene that helps you against other types of cyber attacks as well. So this is a good long-term investment that needs to happen anyway. And what we're talking about when we see that arc, right, the chain of events that happen once the law is in place and once the grace period is over, We do see a blip and increase as attackers will truly test the system. But once they realize, yep, people aren't paying, they will migrate very quickly away from US companies and targets because they'll know they're not going to get paid. They're not going to waste their time. They're going to start attacking more in Europe and in Asia, in other places that will pay. So that window of time is actually really small before we start seeing the benefits of attacks dwindling, right, going down very quickly to a huge extent. And the success criteria that we talked about from an effectiveness perspective is at least 95% of those attacks disappearing. 95% of the risk of being attacked goes away. That helps us moving forward, because if we don't do something, we are going to see more and more and more attacks against our critical infrastructure systems, and we're going to experience that downtime much more. So yes, there might be a small blip where we have to muddle through, but overall, very quickly, it gets much better over time, and the risks of critical infrastructure attacks go down significantly. Now, they will still be targeted for other types of cyber attacks, but when we talk about ransomware, that we're, you know, the goal is to take that off the table. Moving on to the last section, and the arguments in this section is really about, although this solution of criminalizing ransomware will set off a chain of events that will get us to where we want, right, which is ending ransomware. Uh, there are other better solutions out there, and these I'm very interested in. I have dove into all the different ones, all the different ideas people have brought up, because I think it's important. We need to, to pick the very best strategy, and we have to look at the logic. We have to look how it unfolds over time the very best we can, put it to peer review, and for all of us to go, yeah, you know, option A is better than option B, or option B is better than option C. So this is important. Now, the first solution is we just need to build better security, better solutions, better products. Well, that is the norm. That is the status quo we're in. And ransomware has thrived in that status quo. In fact, all the major cybersecurity companies have ransomware products, services, solutions, and it doesn't really matter. It hasn't stymied the massive growth and the impacts from, from ransomware. It's grown. Ransomware has grown in the face of cybersecurity innovation. This is not going to help. There is no indication— and by the way, there's no magic black box out there. There is no, not one, you know, special software or product that we can develop that will magically get rid of ransomware. It doesn't work like that. And we've seen that for all sorts of different cyber, uh, cybercrime and issues, trying to address it from a technology perspective defensive simply doesn't work. It doesn't. It can reduce the risks in some areas, but, you know, the attackers really have an unfair advantage. If your security, your success is predicated on the fact that you prevent all attacks, you prevent an organization, every attack that's trying to get ransomware, and you prevent them all, whereas the attackers, for them to win, they just need one of those attacks to win. And then they're getting bucketloads of money. They're swimming in money. So if we want to stop that flow of money, we have to move to a strategy that will be effective, 95+ percent effective. That's what we're shooting for here. And unfortunately, security products and services, because of the rapid change in the environment and new technology is constantly being developed and innovated and embraced that isn't as secure and we have to add things on to. There's so many vulnerabilities out there. This just isn't effective. And after talking with even security companies and service companies and so forth, they agree. Yeah, we offer it, we know that we can help. I've talked with some companies that say, "Oh, we're 100% effective," and they're absolutely not. It's a sham. There is no security solution that is 100% effective, and a lot of these attackers are going after the social engineering aspect. Most ransomware, by the way, is, you know, infected in an organization by using some facet of social engineering. So it isn't even the technology, right? It's attacking the wetware, the people. So again, this is just not effective, and it's not affordable. These are expensive features and services and they impact organizations' bottom lines. It's really expensive. And to do this, to develop these and continue to develop, it takes time. Even if we had some great breakthroughs, it would still take time to roll all that out, to get everybody covered. Yeah, it just doesn't work. And we've already talked about sustainability. The bad guys will evolve very quickly. They adapt. They're very, very smart and they're now well-funded. They can spend a million dollars to buy a zero-day vulnerability and just exploit that, right? It, it makes financial sense. Spend a million dollars for vulnerability and infect 100 targets that are going to pay you $10 million each. You're making money hand over fist. And we've empowered them because we pay them. So this is not a good solution. This is the status quo that got us to this situation, and it will not solve or meet all the success criteria. The next one is, well, let's target cryptocurrency. Cryptocurrency is the evil thing, and if we just get rid of that, then ransomware— we take care of ransomware. This is absolutely false. In fact, I hear this most often from people who have a different agenda. They just don't like cryptocurrency and they're using this to try and vilify it. So let's break it down. First off, cryptocurrency is a tool, uh, and it's the preferred tool— not the only tool, but it is the preferred tool for ransomware. Why? Because it's a really effective tool. Cryptocurrency is great at a whole bunch of different things in the financial industry., one of which is easily transferring funds. So it's the preferred tool, but ransomware has been around for a decade before cryptocurrency was even invented. And so yes, ransomware was there. Uh, attackers can use other methods. Cryptocurrency is not the root cause. It's just one of the efficient tools they're using. If you were to take that away, just at the snap of a finger, the attackers would adapt. They would just use different tools, right? And we, we even see that in other types of scams and frauds. They're using everything from gift cards to shipping cash to using money mules and, you know, all sorts of different things. So no, getting ripped rid of cryptocurrency will temporarily impact their efficiency, but they will adapt. They absolutely will. And the downside is, or the reality is, it's really not plausibly effective to try and get rid of a decentralized public cryptocurrency. There's not a single company or organization you can go to say stop using this or shut it off. It's decentralized, so there's no real good way of turning it off anytime soon. And we've already talked to the fact that across time the attackers will adapt. They've done it in the past. There were other payment mechanisms that, that they went to and they were removed because they were centralized, so it was easy to do that, and they were all criminal. Okay, great. And they adapted and they're still here. They're still thriving. They will continue to adapt. We cannot underestimate that. And I think most importantly in this argument is cryptocurrency actually is hugely beneficial. It is transformative. And I hear unfortunately from people saying, oh, it was designed for criminals. No, that's actually not true. There's a white paper out there that talks about the reasons why it was created and that it is pseudo-anonymous. It's not anonymous. Some people think, oh, it's bad guys use it because it's completely anonymous. No, it's actually not. It's pseudo-anonymous. It actually helps law enforcement to be able to see, you know, once they identify a malicious account or an illicit account, they can look, then look and track every single transaction that was ever done. This is finding the criminals, you know, red ledger. It actually helps law enforcement once they get to that point. So no, there are millions of people around the world that are using it. It is instituting financial services to those who are unserviced and unbanked around the world. It's extending financial services and financial security to them, and it's continuing to grow. A good percentage of the US population actually uses it. And again, many people will spread rumors, oh well, it's only, it's only illicit transactions. Actually, there's good data on that. It's less than 1% of of transactions are tied to illicit activity, and that's far less than even cash. So no, all the things that you're hearing there, take a look. Cryptocurrency has actually— can provide tremendous benefits, uh, and it is that next revolution. And there's going to be friction with the, the old school, but we don't want to remove those tremendous benefits of people around the world that are using crypto for good. Legitimate legal reasons. So we don't want to throw the baby out with the bathwater. Outlawing cryptocurrency won't be effective. It's definitely not timely. We wouldn't be able to do it anytime soon, and it's not sustainable, and it will impact— it will create unnecessary friction by removing all the benefits there. And attackers, they will just adapt. So this is not a good solution. The next solution is to say, okay, well, let's do a partial ban, right? Some industries can pay, others can't, or some companies can and others can't, or if so many people are going to be impacted, then they can. We'll put in special circumstances. And it's that human desire that we want to find a compromise. Unfortunately, And this is important. This is the worst possible idea. This will actually cause ransomware to increase in impacts. It will have the opposite effect. Now I need you to think about this from the position of the ransomware attacker. Okay. If you have a group of victims that suddenly say, We're not going to pay you unless you can cause a certain amount of damage, impact a certain number of people, or hit these special circumstances. As an attacker, what are you going to do? That now becomes your objective. Every attack you do will try and hit those goals because then you know you can get paid. So this actually gives an aspirational goal of to cause more harm to the attackers. We do not want to do this, and this doesn't satisfy the criteria of throttling back, of, of removing the money flowing, this river of money flowing to the attackers, because it's still going to be there and they're just going to fight over it, right? There will still be a good amount of money flowing and We don't want that. If we really want to discourage them from any type of ransomware, we have to sever that. We have to stop that money flow. So any type of compromise, partial or special circumstances, it undermines the entire strategy here. It uplevels the damage, and it is the opposite of what we want to happen. So no, it's not effective. No, it's definitely not going to be affordable because the damages are going to skyrocket. It will create friction for everybody involved, and it's not sustainable. It just won't work. This, out of all the ideas, it sounds like, oh, middle ground is always a good— this actually is the worst of all ideas. Number 13. We should use law enforcement. We should empower them, fund them. They should just go after the bad guys. They can get the bad guys, they're done, right? Bad things stop. Well, unfortunately, what we're talking here is the number of people involved in this is just too big. The number of attacks are just too great, and it can be one person in the middle of Sub-Saharan Africa with a cell phone that is able to get, you know, send a malicious link to a victim in the US, a company, and if they click on it, they're infected, right? You know, anybody can participate, especially when we talk about ransomware as a service, and you've got these non-technical or entry-level criminals that can participate in ransomware without any, you know, technical skills. When we look at the next billion people joining the internet, many of them are going to be from companies— or from countries that have a very low per capita income. Half the world, more than half the world, makes less than $20 a day. As they're joining the internet, they're looking for opportunities to make more money. And something like ransomware, where you don't have to have any skills, you can do it over a cell phone, you can participate in ransomware as a service. And even if you just get one win, right, you're going to be making vastly more money than you would in a month. It's going to attract those people. So the scale here is too great, the attackers are too well funded, and again, they don't have to win every attack. They only have to win a tiny fraction of them to still be successful. Investigations generally are pretty difficult because attribution in the digital world to figure out who's really attacking you, that's near impossible. That can take months or even years, and sometimes you still don't know. Many of the attributions that we hear that are correct, it's because we have other data outside that helps support that, right? So this is This is unreasonable to say we would, you know, oh, just, you know, throw law enforcement some money, put that burden on their shoulders. It's, it's not really going to work that way. There's too many attackers. There's too much crime going on. It's too difficult. The amount of resources would be unthinkable, and it's slow, and you're not likely to recover funds anyway, right? Victims aren't going to get their money back. And attackers, they're constantly getting better, and in reality, they're better funded than the law enforcement. Cybercrime— think about this— cybercrime several years ago exceeded the total amount of money than illicit, all the other illicit crimes out there in, in the drug field, right? So all illicit drug use around the world and those infrastructures, criminal infrastructures, Cybercrime brings in more money than illicit drug manufacturing distribution. That's how profitable this is. So law enforcement at this scale doesn't really stand a chance. They really don't. So this isn't effective. It isn't going to be timely. It certainly won't be affordable. There'll be tremendous friction for very little gain. And there will be lots of frustration in, you know, expecting law enforcement to achieve something like this. It's just not realistic and it isn't fair to them. It won't be sustainable over time. Along those same lines is there's a certain subset of people that say, well, we've got the best best military in the world. Put them on this task and it'll be done. There's problems with that. First off, the military, it's not designed to protect from this type of asymmetric warfare. Um, it's better suited towards enemies in other tanks, in uniforms that they can identify with clear borders and objectives and everything else.. And right now the military, it doesn't operate as law enforcement. In fact, it could be very caustic for a military to police their own population. And that's why there's— well, there's laws against that. There's a Constitution that talks about separation of what the military does. And in fact, a lot of these attackers, they're outside of our country. They're in other countries. And again, it's really tough to identify them. There are tremendous numbers of them. They're well-funded, and you know, you know, the next billion people, how many of those are going to jump on to this? The military doesn't have— as great as it is, this is not what they're designed to do. This is not what they would be successful at. Even if you put them in charge and said, oh well, you know, put firewalls everywhere, all within the United States and our borders and everything else, and have them look at all of our systems It would require unbelievable access of the military into all of our systems, our phones, our data, our computers, our companies, everything, to even try and do something like this. It would be oppressive. So no, it wouldn't be effective, certainly not timely. The amount of time it would take to, to try and even figure out what this enemy is like and to characterize them and understand all the different things that they can do and will do. Certainly wouldn't be affordable and not sustainable. This type of asymmetric attack— attacks is not what our military is designed nor has a history of being successful over long periods of time. So those are The most common arguments that I've encountered in talking about why people feel criminalizing the payments of ransomware, which sets off a chain reaction, isn't a good idea. This is the first thing that comes to mind, and then we have a conversation typically about these different scenarios and issues, and we unfold what it would take, and whether it meets the success criteria. And typically the conclusion comes back is, yeah, these ideas, they don't hold water. These other solutions aren't better. None of them satisfy the success criteria. Penalizing the victims, that kind of idea, actually it's helping them. It's, you know, a small amount of impact now for a tremendous long-term reward of not having to worry about ransomware, right? So, you know, it's not about penalizing the victims, and it certainly can be effective. Again, I talk about this in other videos and, and go through each of those steps in that chain reaction. But it really comes down to, if we can stop the flow of money to the attackers, they will move on to other activities that bring in money. And those other activities, whether it be credit card fraud or data theft or things of that sort, we're better attuned from a security perspective to manage those risks. And most importantly, those types of attacks don't impact millions of people for a single attack, right? When the City of Atlanta was attacked with ransomware. It affected the services that it provided to millions of people in and around that city. Millions. When we had the pipeline attack that then put people into a panic and they started panic buying fuel and there was fuel shortages and lines and everything else on the East Coast. Impacting millions. So we want to push them to other criminal activities, right, that will still get them money, but we can better control that. That is a better option than allowing ransomware to grow leaps and bounds and impact entire nations and the global landscape of the digital ecosystem. And getting back to why we're all doing this, we need to act. And so the questions remain: does this strategy solve the problem? Yes. Is this solution better than the problem over time? Instituting that you can't pay ransomware, is that a better solution? And, and those ramifications that it has in the short term versus all those long-term impacts and damages to critical infrastructure and countries and businesses? Yes, the solution is better, right? The cure is better than the disease. And then we get to the last question: is this particular solution, is it better than all others? So far, it is. Now hopefully there is even a better solution out there, And that's why we're talking about this. And hopefully that's why you're listening to this as well, because together we can all work to find the best solution. And if this is the best solution, let's go make it a reality. Let's crush ransomware. It's going to take some time. It's going to take, you know, 2 to 3 years, even at this pace, but we can get it done. And if there's another solution that's even better, great. Let's get behind that and institute that. As long as it meets the success criteria. But the worst thing we can do is nothing. The attackers win, they grow stronger, they get better. We lose, and we lose big if we do nothing. So we need to act. So the goal here is not about finding some magical, happy, perfect solution. We have to choose from what's available to us, given the severity of the problem of ransomware, and we have to act to institute it. Ransomware is a significant and growing issue, one that we have to address because the consequences are continually growing and they will get significantly worse over time if we don't act. Now, there is no perfect, easy, friendly, happy solution out there. We have to make some tough choices. We have to identify the best path forward. And our options— again, there's no wonderful, perfect option that we have. So there will be challenges. There will be some impacts. We have to deal with those if we want to avoid a much, much bigger problem. And the way we do that is we have to communicate, we have to be open, we have to collaborate, we have to figure out and think purposely about what we want to do, what we want to accomplish, and how it will get there. We have to roll forward the clock and see what options will actually deliver what we need. Because at the end of the day, we want to make ransomware no longer a significant cybersecurity threat that we have to work with. So thank you for watching. Please join the conversation, reach out to me, leave comments. I want to know your thoughts. And if you've come up with a better idea, one that we haven't covered here, please share it. Let's explore it because we need to find the best option. And if outlawing, criminalizing ransomware payments is the best, so be it. If a different option is better, let's explore it, validate it, and go with that. But we cannot do nothing. Inaction is our greatest enemy. So take a stance, join the fight. Let's contribute and work and collaborate together to find the best path forward to end ransomware.