A security expert argues that criminalizing ransom payments would end ransomware attacks. He uses a slot machine analogy: if ransomware stops paying out, criminals will shift to less damaging crimes like fraud. The money flow must be completely cut off, not just reduced.
Chapters
Why will criminalizing the paying of ransoms end ransomware attacks? Well, the answer is complex, but we can use an analogy to simplify it. And it really comes down to the fact that criminalization means you're cutting off the supply of money. But in understanding why that really matters and what's going to happen, let's take, for example, 2 slot machines, right? And if you have a group of people that are motivated to make money and they're offered 2 slot machines, slot machine number 1 and slot machine number 2, and they can play them for free and they get to keep their winnings. Okay, for slot machine number 1, it just happens to be easier to play and it pays out so much more than slot machine number 2, but both are available. Now, as the primary motivation for these players is making money, it's easy to recognize the fact that most people are going to be playing slot machine number 1. But this is where change then comes in. If something radically changes and slot machine number 1 breaks and is no longer paying anything out. It can still be played, but the players are told it won't pay out anything. And players, well, obviously they want to confirm it for themselves, so they keep playing a little bit and they do confirm for themselves that yes, no payouts for slot machine number 1. Now, here's the assumption, and I think it's pretty logical. The assumption is the vast majority of players, maybe even all of them, after realizing that slot machine number 1 just doesn't fulfill their goals of earning money, they will shift to slot machine number 2. And even though slot machine number 2 previously was less productive than number Number one, at this point, it's much more productive than a broken slot machine. This is the basic argument to criminalize ransomware payments because through criminalization, we can basically cut off that money. Okay? And you have to cut it all off. It's not about reducing it or, or anything like that. We got to sever that money flow. Now, cybercriminals who are behind the vast amount of ransomware, they seek money. That's their primary motivation. They're cybercriminals, and they can choose to conduct ransomware attacks like slot machine number 1, or they can do other types of cybercrime, including cyber fraud, theft, um, you know, credit card fraud,, data breaches and, and theft. And that's really represented by slot number 2. Now, if we outlaw the payments of ransomware, then the extortion payouts for ransom just stop. And there's a reason for that. I'm not gonna go into it in this particular video. I've got another video that actually talks about all the different complex reasons on why that absolutely will happen. But basically in this example, we're breaking Slot machine number one, it's no longer paying out. And we believe the majority of attackers will then shift. They will abandon ransomware and shift to those other cybercrime activities. And that's actually a good thing for us because it's less impactful overall. The damages tend to be more compartmentalized, and we simply have better security controls to manage that. So that's how we greatly reduce the risks of ransomware. And again, for those who would question why criminalizing ransomware payments would actually do such a great job at reducing the payments to them, there is a detailed explanation. I can put it in the notes section within the video. It is available. Thank you for watching. If you've got any other questions you want me to explore or talk about, if you've got any concerns, if you think the logic here isn't correct, it's false logic, false arguments, please call it out. This is all about having a productive discussion to figure out what the best solution is for us to address the risks of ransomware.
