Paying Ransomware Should be Illegal

Ransomware must be stopped. It is one of the fastest growing aspects of cybercrime, and it's beginning to impact critical infrastructures of entire nations. Major businesses are falling to this, and huge numbers of consumers are being victimized. The criminals are fleecing these victims for insane amounts of money, often in the tens of millions of dollars. And with those kinds of rewards, it's understandable how criminals are flocking to ransomware distribution. Now, today we're gonna talk about a radical idea to be able to crush ransomware. We're gonna cover how that idea, which is controversial, may be gaining in popularity. And what it would take to enact, the biggest objections to it, and who really would be opposed to this idea. And that may surprise you. Now, ransomware is not new and cybersecurity products and services have unfortunately failed over the years to stop its rapid growth. It must be addressed. And the traditional methods simply won't be effective. Evolutionary tactics must give way to revolutionary measures. And there is a radical idea that strikes at the heart of ransomware, at the very motivation of the attackers, rather than attempting to erect obstacles to their methods. And the way you do that is by making the payment of ransoms illegal. Now, that means the victims wouldn't be able to actually pay the cyber criminals. And in that one move, that sets in motion a number of cascading impacts, which results in the attackers themselves abandoning ransomware as a means of making money. So instead of playing the offense-defense game, which we so often do in cybersecurity, or the whack-a-mole with vulnerabilities, or trying to go against the human behaviors of victims, we move in an elegant way to deny a criminal from the financial rewards that they seek. So I put a poll out on LinkedIn where many security, technology, and business professionals weighed in, and the results are interesting. Almost half of the people that, that responded agreed that outlawing ransoms was the best choice. Another 40% they weren't sure, right? They weren't sure where they stood on it. There was probably pros and cons on both sides. And a mere 11% really thought that, well, this is just too much. And so far, as of a couple of days ago, over 22,000 people viewed this survey, and there were many questions and comments and concerns. That I answered as part of this. So let's go through some of those things. First off, how would something like this happen? Well, the way it would really happen is lawmakers kind of have to unify against cybercrime. They have to be informed of the different options, evaluate it, and say, yes, this is what makes sense. And at the end of the day, they have to pass a law that says, You can't pay digital ransoms, right? You can't pay extortion. You can't directly support criminal activities because this is, this is direct financial support. This is aiding and abetting cybercrime. Now, there are many lobbyists out there and there are many people that say, no, no, no, we don't want to go this direction. We want to go a different direction. And we'll talk a little bit more about who might be in opposition to this in a minute. But a law like that doesn't go into effect immediately, nor should it. Instead, it would probably say— and I'm just using it as an example— uh, one year from now, um, that's when it'll come into effect. And from that point on, it would be criminal for any person or organization to subsidize cybercrime, to invest in cybercrime, to, you know, aid and abet the enemy, if you will, and directly support criminals. Okay, so that gives a year for businesses to understand, okay, I won't have this as an option, what should I do? And it becomes really part of the normal business risks that they have to evaluate and deal with anyway, right? Many companies have to deal with inclement weather, we have to worry about hurricanes, earthquakes, we're going to bake that in, or fires or, or whatnot. We're going to bake that in. And that is going to have to be part— cyber risk, right? Ransomware is going to have to be part of that. And the result out of that may very well be the company going, okay, well, we need to then invest to make sure that the chances of us getting impacted by ransomware go down and our ability to recover from it goes up. Okay, great. But giving the world, especially critical infrastructure and businesses, a year to kind of figure out what they want to do, that needs to happen. The second thing is, okay, after a year, basically you're abolishing all payments, and that means cybercriminals won't get paid. That means that there's really no money, no honey, no bears, that kind of situation where insurance policies wouldn't be offered to cover ransomware payments. You could still have an insurance policy to help with the recovery and everything else, but not to pay the bad guys. And if you think about it, executives— although you could do some back channels and, and pay it anyway— executives, they're there to take risks from in a financial manner. Right, for their company, their stockholders, shareholders, whatever. But when it comes to risking criminal penalties of them actually going to jail themselves, you don't see a whole lot of executives willing to do that. So with the criminal penalties there, basically you're eliminating almost all legitimate companies, including the support infrastructures like insurance and so forth. All the money, is drying up, or a vast majority of the money going to ransomware people are, are drying up. Now, cybercrime would be incorporated again as part of those normal business risks that the companies have to deal with. So it's still on the books, they still have to worry about it, but more than likely that's going to drive them for better prevention and response capabilities. Those are gonna be prioritized. And that actually has other benefits that drives much bigger benefits when you're more secure and you've got better trust with your customers and you're just doing better things. So there is some upside to that. Now, the measurable outcome here is without receiving the financial rewards and put yourself in the mindset of the cyber criminal, right? They're in it for the money. They want the easiest, shortest path and they want money. Right? Without receiving those financial rewards, well, the cybercriminals will be dissuaded to commit their time, effort, money, their resources, all their efforts in distributing ransomware because they won't get any benefit out of it. And even from an attacker's perspective, risk without reward, well, that's actually a great way to deter future attacks. Okay, so there are some downsides, and I've been talking with different people, and, and if you go out to the survey, you can see where people have commented and their biggest objections. Uh, let's hit the top of those. First off, you know, people say, hey, they're companies, it's their money, they should be able to spend it as they see fit. Well, wait a second here. First off, that's not always the case, right? The reality is that there's already laws on the books. So, for example, it's actually illegal in most cases, with the exception of this, I can't think of any other situation, to materially support and aid criminals. Laws are actually written to where you shouldn't do that. You can't do that for criminals or terrorists. You can't do business with embargo nations. Things like that. So the argument, well, it's the company's money, they can spend it any way they want to, that actually isn't true. And in most cases, it's illegal to pay for criminal acts. So this would be in line with everything else that we have out there to make sure that the common good is recognized and companies aren't just doing dastardly things and supporting other people being victimized. So that, I don't believe, is a good answer. It's a terrible objection because we already have rules in place for that. Okay. In addition, it actually makes really good business sense not to do that, not to fund the cyber criminals because again, they're undermining the common good and your customers are actually benefiting, right? Because if the bad guys get more money and they expand, they could be attacking directly your customers, your partners, your shareholders, your consumers. So in doing this, it breaks that downward spiral. Okay. The number 2 objection is no, no, no, don't outlaw paying the ransoms, just discourage it or say you shouldn't do it. But more importantly, buy more security. We need better security. We mean more products. Okay. Layering on more or buying more security, so forth, that plays into this arms race that we've seen before. And let me be very clear, the attackers are better suited to win. The defenders have to defend everything, right? The attackers only have to find one weakness to get in, then they win. And ransomware is a type of asymmetric warfare. Where the opposition, the attackers, they're more agile, they're more stealthy, and they main— they maintain the initiative of attack. So they get to decide who gets attacked, when, and how. And that's really tough. That's tough to defend all the time. The layering of more and more security, which gets more costly, it's tougher to manage, and it can even introduce more vulnerabilities, is not the way to go. It would be a war of attrition where the attackers— well, there's more of them, they have better collaboration, and they have a greater willingness to fail, and they can expertly avoid the technical controls by just targeting the people. And we've seen that time and time and time again, where even the companies with the very best, most expensive, heavily layered and armored environments still get victimized. And again, they just have to win once. So just layering on, slathering on layer after layer, it's expensive, it creates friction, it doesn't at the end of the day stop this, because that's what we've been doing up until now, and we know it hasn't stopped it. It hasn't even slowed it down very much. It still grows. Okay, in that scenario, if you think about it, the adding more security— the only benefactors in adding those more complex and new and sophisticated layers of security are the security companies. They need the justification for customers to buy ever more products and services. This helps them. It's not going to solve ransomware. It's not going to take it down. It's not going to slow it to the level that we need. It is evolutionary. It is a small incremental changes every time a new product comes out. It isn't revolutionary, which is what we need. We have to take the legs out from under ransomware. All right, the third objection that I hear all the time Small and medium businesses, they can't afford more security or assessing the risk. And the reality is they can't afford the ransoms either because the ransoms typically are a lot more than what a security program would cost. And if you think about it, and you have to kind of run the risk numbers, and I'll do it for you here in a second, this group, that basically accepts a lot of risk. We don't have money for security and we can't pay for ransomware, so we're just hoping it doesn't happen and we'll keep going day by day, crossing our fingers, hoping it won't happen. This group above all actually benefits the most for this idea, this idea that ransom— no ransoms will get paid. Now here's why, right? If you think about that company and they are just operating with high risk, right? They can't pay for security and they can't pay for the ransom. There is a certain level of risk that they are going to be attacked and ransomware is going to come in and destroy them. And by the way, industry metrics, depending on where you look at, uh, we see companies, small and medium businesses, go out of business within a couple of years after a major attack between 60 and 90% of the time. So it's a big risk if it happens, and they're just hoping it doesn't. But Okay, for that environment where they're just crossing their fingers, let's just say there's X amount of risk, right? We're not going to try and measure it. It's just X. Now, if everybody stops paying for ransomware, what happens is the number of attacks go down because again, it's undermining the actual motivation of doing attacks. Why would you do attacks if you're not going to get the benefit, right? Cybercriminals will go off to some other venture. So the total number of attacks, cyber attacks for ransomware, goes down in the future. So that ex-risk that they carry every day now, which is going up because more ransomware is happening, in this scenario where we outlaw the payments, that actually goes down. The likelihood of them being attacked goes down. So they actually benefit the most. So this is not a small, medium business. We're going to, you know, it's going to be terrible for them. Actually, they are the huge winners in this. Okay. So the fourth objective or objection to outlawing ransomware payments is that, well, the government should just stop them. Right. We've got government. We've got the military. Why don't they just stop them? Well, attacks can come from anywhere and they can target anyone in any number of ways. And just assuming that they can do that, well, it's not realistic. It would be like asking the government all at once to stop all spam, all phishing, all theft, all fraud, all vulnerabilities, all exploits everywhere around the globe. That's basically everything bad, right? Because all those methods, by the way, are used to propagate ransomware. So it's just not reasonable to expect that. And even if it were possible, it would be insanely expensive and oppressive because they would need access into all those endpoints and data and systems and everything else, and nobody wants that. And again, we have to take a different approach. And the government, by the way, they're also being victimized by ransomware. They can't even secure their own networks to the level that they want to right now. So, you know, it's, it's a very tough challenge. And those traditional approaches, they're not going to make a meaningful difference. They just won't. We have to take a different approach. Cybercriminals adapt very quickly, and rigid fortifications rarely last. Okay, the last of the objective— uh, objections, number 5: we should simply outlaw cryptocurrency instead. Well, crypto is the preferred method right now for for most ransomware, but it's just a tool. And although it is popular with the ransomware crowds because it's easy and, and, and fast and all those kinds of things, um, and it's popular with other fraud schemes as well, it's actually not the true problem. And so taking that out of the equation still leaves the heart of the problem, and extortion existed long before cryptocurrency, and it will afterwards even if you cut crypto out. If it were outlawed, the criminals would just move to another form of payment. And even right now, there are many fraudsters that use gift cards, um, or have people actually send cash through the mail, uh, using digital fraud or fund transfers and a whole bunch of other things. They will find a new way to get paid. That's just an obstacle that isn't going to stop the attacks. They will find a way. And as a side note, by the way, cryptocurrency may actually evolve to become one of the best ways to track organized crime. Plus it has so many other benefits to society, I won't even get into it. So anyway, Carving that out, not a good idea. It's not gonna solve the problem. It takes away all the benefits that it does provide, and the attackers will just find another way, right? They found another way before crypto, they'll find it afterwards. Okay, let's talk about who really doesn't like this idea, because not everybody would like a future where you can't pay ransoms. So let's quickly discuss who would likely not want payments allowed. Number one, the security products and services industry. Again, self-serving interests, and they wanna sell you more security products, and they want that escalating war where ransomware, a particular type of ransomware comes out with certain methods and they come out with a tool to fix it. 'Buy our tool.' And then the attackers very shortly adjust their methods and they come out ahead. Oh, security, okay, we're coming out with a new tool, a new process, a new version, upgrade. On and on and on. Security products and vendors, they win. If we outlaw it, now it's a different scenario. And they still win, we still need them. In fact, there's gonna be a lot more focus on proactive security, so that's good. But, you know, when I talk to a lot of security professionals, they're like, wait a second, that's gonna hit our bottom line. We don't want that. We want continual— they don't want to say victimization, but it's continual victimization. That fear and uncertainty and doubt drives sales. So we have to be careful when we're listening who's objecting, because if it's a security products vendor self-serving interests. Okay. The second group that probably wouldn't like this, cyber insurance companies. And again, there's self-serving interests here involved. They are making lots of money on ransomware insurance policies. And part of that, part of the selling of that is saying, we will pay the ransom, pay the premiums. And if you get impacted, we'll pay the ransom. And it's a great selling point. And if we move to this model to where they can no longer do that, nor will they, right? They don't want to violate the law and they don't want to be put out of business and they don't want to go to jail. That then changes their model. Now, cyber insurance will still be relevant and so will ransomware cyber insurance. However, it will be limited. It will be limited to, you know, bringing the infrastructure back up, getting recovery, things of that sort, but omitting actually paying the bad guys. So again, they're a little hesitant because, uh, that might impact my, my revenue model. The last group, cybercriminals. Again, self-serving interests here. They need victims to be able to pay. It is a crucial point because that's how they win. And consider this: criminals have a plan. They always have a plan. And if you follow along, you're gonna lose. That's part of their plan. So they want you to be able to pay. They need you to be able to pay. And they're gonna do everything they can to influence you. And if the government comes in and says, "No, you can't," That creates a big problem for them. And so far, we've been playing the cybercriminals' game. And no surprise, they are winning. We must take the initiative and we have to undermine the criminals' reward system. Ransomware must be stopped. I can think of no better way to undermine the growth of digital extortion tactics than to outlaw paying the ransoms. In doing so, it constitutes a direct financial support in aiding criminals. If you pay the ransom, you're paying criminals who can turn around and leverage that money to accelerate what they do, to improve, to scale out the continuation of attacks against more people and more organizations. And more critical infrastructures. There is no perfect, painless answer to ending ransomware, or at least crushing it. But I see this as the best option by far. Now I'm going to put a link to the LinkedIn poll in the description below. Please go out there, vote, uh, add your thoughts, your issues. And if you come up with a reason why this is a terrible terrible idea, put it out there. I want the opportunity to be able to answer you. And there's already a ton of great, great questions and answers out there. So I would urge you to read that as well. Thank you for watching. And if you like these cybersecurity videos, please click the like button and subscribe to the Cybersecurity Insights channel. I put out a video about once every week on various cybersecurity topics, risks, ideas, events, and best practices. And an occasional rant out there, but let's communicate and collaborate together. This is how we make cybersecurity strong in protecting the global digital ecosystem.