Ransomware and the Ransom Problem

All right, good. This thing is finally working back on another, uh, I guess I have to call them like episodes now or something. I'm supposed to be somewhat professional in this, but, uh, talking on the Dr. ZT thing, I've got Matthew Rosenquist here, who's one of the people I respect most in the industry and probably knows more than any 50 people you run into. Matt, if you wouldn't mind, give, uh, just a quick background on who you are and what you do.

I'm a CISO, cybersecurity strategist, been doing this for almost 34, 35 years now. I'm currently the CISO at Eclipse, and previously I was a cybersecurity strategist at Intel Corporation.

So been in the trenches, done the work, know the space is pretty much what we can gain and ascertain from that. You and I were having a conversation back and forth, and I was actually making some comments on things that you were talking about as far as the ransomware side of do we pay the ransom goes. And I think that that's a conversation that not a lot of people have had out in the open. I would like to kind of get into that. And your position, and correct me if I'm wrong on it, is don't pay the ransom.

Not only should we not pay the ransom, we collectively need to not pay the ransom, which basically means regulations. And I hate regulations. I absolutely despise them. However, I know there's a place for them when the community isn't doing the right thing for the benefit of the end users. So yes, that is my position. Don't pay, never pay, don't allow anybody to pay, gut out the financial resources going to the bad guys.

So then how would we do that though? At a— let's start at the highest level, right? So what would the requirement or legislation or whatever have to be to put in place to do that? And I guess the other side of it is, would that only apply to enterprise and not small business, or is this just carte blanche, this is how we do for everybody?

Well, yeah, and we can get into how to do it. In fact, I did a whole bunch of video blogs on that, but let's talk about why we do it, right? And, you know, I talk with a lot of CISOs, I talk with a lot of CEOs and CIOs and CTOs, and they go, "No, no, no, we want the option to be able to pay for it." And that's great because they're looking out for their shareholders and, you know, their business. However, they're part of a larger community as well, and they recognize that. They still want that flexibility. However, if we really want to undermine ransomware as an attack vector that is continuing to grow and victimize and, you know, take on critical infrastructure and do some really bad things, we need to go after it as a team. And the way you do that is to cut the money supply. We know these attackers for the most part, they're after it for the money, right? There's huge groups of organized cybercriminals. As soon as you turn that tap off, it's not like their desire for money goes away. It's still there. They move on. They find some other way. Chances are they're gonna go back to some type of denial of service or some other cybercriminal activity, charge fraud, whatnot, things that we're very used to, things that don't take down our critical infrastructure, right? They're going to continue to, but they're going to move on because they want the money. If they know ransomware gets them nothing, they're not going to do it. And we've seen this all across the world in all sorts of different criminal organizations. We saw it with kidnappings in Italy. We see it with rhino horns being taken in Rwanda and other places, right? As soon as you remove that benefit, they move on. They stop attacking. Why waste their time? So we have to work as a community. For an individual company, it makes a lot of sense. I still want that option to do it. But if we really want to stop this, we have to work together. So that's why we do it. We can gut— this is one of the few cyber attacks we can truly cut off at the knees for everyone. That means it benefits small, medium, and large organizations, governments, you know, all the critical infrastructure sectors. That's why we do it. Okay. So to answer your second question, how do we do it? It's not like we just write a law and say, okay, you can't pay anymore. It's actually got to get rolled out, right? Because we don't want to severely impact organizations unnecessarily. If that hospital gets ransomware tomorrow, it might be for the patient safety and health the right thing to pay because they don't have any other controls. So what regulation would probably look like is we would say, okay, we're going to outlaw it in a year or a year and a half or 2 years. So you have that period of time to understand your environment, to institute proper security controls, failovers, backups, whatnot, right? And get yourself up to a good level knowing that you will not have that option. And the rules, the only really good regulation rules that get followed are ones where there's criminal penalties. If you say, oh, well, we're just going to, you know, institute a fee of a few thousand dollars or a million dollars for these big companies, they don't care, right? They're paying $40 million as part of the ransom to begin with. What's a little fee on top of that, right? So you have to put criminal controls in there like we did with Sarbanes-Oxley and say, okay, if you're part of that decision tree to say yes, we are going to fund the attackers who will then use that to attack other people, you are now contributing to crime. You can go to jail for a year or two years. And you tell that to a CTO or CIO or CEO or board members, they will back off. Well, nope, that's no longer an option. If it were just a fine, yes, that's part of business. But me going to jail, sitting in a 6x10 cell, That's not going to happen. Right? So then, you know, once we get to that year or year and a half or whatever the legislation is, give people the opportunity and organizations the opportunity to invest in security and recovery. Then you institute it and you say, not only are there criminal penalties, but we will also enact whistleblower rules. So if you do decide, I'm going to do it, I'm just going to keep it quiet, Well, then you better convince all of your employees who know or think, because they may get 20% of whatever you're paying out. And then you're also going to jail. So again, we can put in tension in the system to make sure it's effective. And if we do that as a nation, guess what? Targeting our critical infrastructure, our businesses, small, medium, and large, becomes unprofitable for attackers. They move on to other countries. Simply put, they'll move on to greener pastures, which will drive those other countries to do exactly the same, like Australia is considering to do right now, outlawing paying of ransomware.

Yeah, but doesn't that also require an actual investment in focus from everybody all over the place on literally mitigating the avenues for compromise that allow ransomware to occur. And that's such a big giant problem. And I agree with you that I think like the position we should take is, you know, I don't give my teenagers money 'cause I don't respond to terrorists, like that type of thing. Like I shouldn't basically pay that ransom, but we can't fix the, we can't get people to fix logins. So how are we gonna, push these organizations that have had decades to do this thing differently to actually— you know what, you know when the first actual iteration— I had to go dig to find it— for mandated computer security technology was put in place? Just guess the year.

Oh, I'm thinking '90s, 2000s.

By 1987, right? '87 was the first presidential directive I could find that came out that said, this is a potential risk for interconnected systems and networks, and we have to put controls in place. And these are the basic controls. And that was '87. I think he—

right after WarGames movie came out. Probably so.

Yeah, we should blame Matthew, what's his name? Yeah, it's his fault.

Yep. Yep.

I mean, we can't— like, the rising tide here should lift all ships, but we've got all these ships that are anchored to the bottom of the bay that when the tide lifts, they're just going to sink.

OK, so you bring up a great point, but let's change the thinking there because you're thinking everybody then has to protect against ransomware. Well, I think everybody has to not have shitty security, but— well, that's a whole different topic. Nobody should have that. But, you know, it's a business decision and not all organizations are going to invest in it. But the reality is, whether they choose to or not, They understand the regulations are coming and they're not gonna be able to pay. Okay? But here's the beauty of it, because normally in our security minds, and this is a flaw of us security professionals, we think we have to block every attack. And we don't. In this instance, the real control is not the security we're putting in. The real control is targeting the brain of the attacker. We are using psychological warfare, right? They are an attacker that is motivated, motivated by personal financial gain. That's what they want. We are now removing that off the table. We're not blocking them from attacking with ransomware, by all means, right? But the reality is you're not gonna get any benefit out of it. So it's not a matter of establishing blocking controls, It's removing the benefit of doing that. And attackers, well, they're just like us. They're lazy, right? I mean, we want the easy button. We want to achieve our objectives in the, you know, down the path of least resistance. And if their objective is financial gain, once this is instituted, regardless of if anybody puts in security controls or not, once it's instituted, they don't get the gain. That forces them— they choose to move on to somewhere else. But then what happens? That we have to block it? We don't. That will be a choice of those companies whether they choose to invest or not, but they will benefit at the end.

So then what if they're— I mean, we're playing, obviously we're playing a bit of, uh, the what-if game, but this is kind of the fun side of this conversation, is like So on the what-if side, if you're an organization and you decide like, I'm not gonna really fix my security, but there are requirements that say that if I do, you know, pay a ransom, I'm gonna do whatever, and I'm fully aware of it, and then you get hit and you're sitting there locked up hardcore, like, what is— I mean, your options are just— you're fucked basically, right? Like, then it's just, whoops. Like, what's your avenue for any sort of repair? I mean, do you just shut your doors and go home? Like, take your toys and leave the sandbox?

That's risk management. That's what businesses do every day. Am I going to invest in this, um, huge marketing plan? Am I going to go after this one customer versus diversify? Am I going to rely on a market that could disappear tomorrow? This is what the executives do every single day. That's why they're the executives. That's why the board is there to help make those decisions. So, and they then bear the weight and the responsibility if they make a wrong decision. This then falls back into that same category of normal business risk. But the beauty is the number of attacks are going to drop significantly. And again, we've seen this. This, this is not theory. We've seen this before. I mentioned a couple of different scenarios. One was in Italy. Italy a few years back had a horrible time because the mafia there realized, hey, we go kidnap somebody, we can ransom them off. And if not, we do bad things to them and, you know, gets in the public eye. And it became so prolific, right? The kidnappings that the government had to step in. And what the government did is said, you can no longer pay ransom, abduction ransoms. In fact, as soon as somebody got abducted, the government would go in there and seize the assets and lock the assets of the families so they couldn't pay. Right. You know what happened? Kidnappings dropped to almost nothing because the attackers knew If I kidnap Dr. Zero Trust, I don't get a penny. That's a lot of risk. That's a lot of investment of time and effort. And the law is, you know, even if the family wants to pay, they can't, which means I don't get my money. And that's all I care about. Sure. So it dropped. Yes. Efforts went into other things, you know, illegal gambling and protection money and so on and so forth. But those were things that were much more controllable. We've seen the same thing with black rhino horns, right? The black market. You go to places in Africa where, you know, they've got— they've, you know, they've had to put these poor animals in these large, you know, protected sections of wildlife and their own little ecosystem because the hunters will come in, the poachers will come in and kill them to take their horns. And these are endangered animals. And you've seen huge amounts of security resources— fence, walls, sensors, drones, armed guards, uh, scouting parties and everything to try and protect these large areas. And it doesn't work very well because the value of those horns are just so astronomically high on the black market. So what some of the— these preservers decided to start doing because protection, no matter how expensive, wasn't working, they would actually go out to their rhinos, tranquilize them, go in and cut the horn off. Mm-hmm. You know what happened to poachers? They moved on. Why would a poacher go in there and risk life and limb for nothing, right? And so this works. This is one of the ways that you can undermine. And in reality, there's only 3 ways to undermine a threat. It doesn't matter what threat, what industry, or anything else. You either remove the attacker themselves, put them in jail, whatever, right? You remove or you block their ability, their capability, their methods of achieving, which is where our mindset normally is 99% of the time. Or the third one, you undermine their motivation. And if you can do that, you don't have to have walls. You don't have to have guards and guns. You've undermined the motivation for them to commit the act in the first place. You are getting inside the head of the attacker. It is psychological warfare. And in many cases, it's not possible. In this case, it is because we know what they're going after and we can block it. Hmm.

So, well, what if we— okay, so let's go. You said there's 3 ways to do this, right? I'm a fan of number 1, which is remove the bad guy from the planet Earth. Aren't we all?

But we're not going to talk about removing the target.

Well, I mean, but if you look at like— if you look at— there was a scenario a few years ago, I think it was 2 years ago, where the Israelis were getting targeted by an organization, Hamas, and the Hamas folks were just going after them right and left and they caused ransom op. Israelis don't play and they eventually had enough of it and they said, okay, fine, you're going to take my websites out. And they just took out the building where the guys were operating out of.

Counter battery. Yes.

Yeah. So if we look at the— I was actually just reading through some of the— it's not out yet, but some of the coverage around the new Biden organizational cybersecurity response strategy. Like they talk about defend forward and those types of things. I think that we're going to have to take the position on some of these that maybe there's a line in the sand where you do move to a kinetic strike on an organization because you have the intelligence. And I mean, from being in the intelligence community, they're not that hidden. We know who they are. We know where they are. We know how they operate. If you take out our pipeline and you cause a degradation of service or whatever else, there might be a tomahawk downrange. And then you start second-guessing whether or not that's worth it. And I mean, I think that if it was very— I agree with you, right? If we change the value proposition and if we impose our will upon the mindset of those individuals, I think we can change a lot of this shift. But I think until we probably send some people to meet whatever god they believe in, that it's going to still lack teeth.

Well, the thing is, we don't have to bite. We just deny them their goals.

But it's still, it's so big. Like I, this morning I found like 3.3 million VPN misconfigurations in the United States alone. Like where, I mean, and how many of those are tied to some critical infrastructure? If I, I mean, I'm not a bad guy. Well, my children would probably tell you I am, but like I could wreck shop on a lot of organizations and it wouldn't cause me any, you know, I wouldn't lose sleep over it. But in these, Like you said, these criminals who are doing this because their way of life is not the way that they want, they trying to buy Lambos for their homies or whatever and all the other stuff, like their motivations are there. If it's not literally in some instances their ass on the line for hitting that keystroke, why change it? And then I guess the other side of it is, so if we play the, let's play that we do exactly what you're talking about and everything's great in the US and they do move to other nations and they do fall follow down the line. Oh yeah, we wind up becoming the, well, hey, what the hell, the US left us in a lurch and now we're getting threatened and what do we do next?

And what do you think they're gonna do if you're that next country down the line and you see the US basically denied ransomware payments and now all the attacks are against you? What are you going to do?

I would hope that they follow suit, but then again, I know that that doesn't happen a lot. I know in a lot of places they just point fingers and blame.

Well, then they suffer, right? I mean, they become the preferred target. But, you know, after so much pain, you're going to learn. And you're going to go, you know what? Let me block that and I'll kick all these attackers down the line to the next country, right? And you get a domino effect. Again, we're using psychology here. We often, so often want to use brute force and brute blocking Yet Sun Tzu, thousands of years ago, told us, know your enemy, know their motivations, undermine them, beat them in their own mind first. It's a lot less painful than putting troops on the battlefield. If you can deter somebody from attacking you, that is less costly, maybe not as satisfying as thrusting a spear into something wet and solid., but it saves you a lot of time, effort, pain, and energy. And that's where we want to go.

I mean, I, yeah, I, I, I, I, I, I, I love the approach. Um, actually without getting myself in trouble from classified side, like I, I did a bunch of work on the counter piracy stuff when that was the cool thing off the coast of Somalia. And we ran into a lot of that issue of those ships had huge insurance policies and the Somali pirates would grab them and do what they did, and then they'd get paid. Um, and you're absolutely right, once basically the— it wasn't— and the funny thing was, it was not the governments, because there was so many different governments involved. No government ever said, you won't— you shouldn't pay. The insurers said, we're not paying anymore.

Finally said enough, you know.

And then all of a sudden, okay, Somali piracy stopped like overnight. So yeah, I mean, it, it's doable. I— it's just the scale of this and the ease of the problem space to me. And even if we put a stop, say, let's say 2025, President Rosenquist policy goes into place.

I like that.

No one— Hold on, hold on.

Let's get back to that. Hold on. Right? Right?

Matthew for president. So that goes into place and then we get to that step and then there's new iterations of technology that come out at new scale with new vulnerabilities that are even—

Sure.

And it just continues. So where— like, there's the cessation of it is what I can't quite grasp of, like, when it's going to be.

You're so close, though. So yes, there's always going to be vulnerabilities. Yes, there's always going to be opportunities for attack. And this avenue does not solve all of our security woes.

Sure.

It does not stop cyberattacks. They're still going to happen. What it stops is a major funding stream, right, for the attackers. Because when, you know, the insurance company pays $40 million to an attacker, greed principle kicks in. Doesn't matter whether they pay you $1 or $40 million. Greed principle kicks in, which basically says, if I can steal $5 from you today, I'm not going to be satisfied. I'm going to steal $10 from you tomorrow. Sure. So you give them $40 million worth of research funds and ability to buy zero days now and ability to outsource and create more crews and spread the wealth. They're going to come at you more powerful on a larger scale and going to do more damage. So what are you going to do? You're going to keep digging that hole? How deep do you need to dig your hole to get out of it? You never will. You're funding the enemy. Don't fund the enemy. Don't give them resources to attack you. That is absurd. In military terms, that's absurd.

Bad idea. Yeah, right.

It's a really, really bad idea. And if you're going to spend— if you're going to pay more to the bad guys than you are investing in your security, your end is coming. You're just shortening that runway. It's just, it's insane. And, but we don't see it from a strategic perspective. We only see it from that tactical perspective. And you're gonna lose. You may win that little battle, you think, but you've just now given huge resources to your enemy. They're coming at you. You're gonna lose. It's just a matter of time. Hmm.

Is it, is it become the war on drugs for cyber? I mean, is that kind of in the same— because I mean, we've dumped over a trillion dollars in the war on drugs and it hasn't—

Sure, but what did we do? We established controls. We went after the drug runners and we built up controls on our walls. This is all defensive, right? This is going after the two things. I'm going to put up controls, big walls and security and everything, and I'm going to try and go after the attackers. I'm going to work with the Colombian government to try and bring down the big cartels, neither of which really work that well, right? Why? Because the funding is still there. You still have a huge group of Americans that are willing to pay lots of money to get high for your illegal drugs.

Yeah.

So if we shifted that and remove that financial incentive to where the money isn't flowing, that would change things. And We've actually seen that, right? I mean, take a look at the global illicit drug trade compared to the cybersecurity, right? Criminal online crime. Online crime surpassed total, total market value illicit drug trades back in what, 2015 or something?

Yeah, it would be like the third largest economy on the planet or something like that.

Yeah, you saw criminal organizations go, hey, You know, illegal gambling and prostitution and illegal drugs. That's pretty profitable. Oh, wait, wait, wait, wait. Oh, look, cyber. Wow. We can make a lot more here. And that's where they went. Yeah. Why? Because we understand the minds of the attackers when we break apart, because there's not just one archetype of attacker. There's several. And when we look at the organized criminals, we know their motivation. We know their objectives, we know their methods, right? And if we undermine those objectives, right, then we can, we can attack them in a way to where they don't want to attack us. If we deny them their goals, they will move on to other ways.

What would it be of value if we put something in place in the, like, almost the supply chain side of it, right? Like, because I was reading through and doing some looking at the vectors that usually are aligned with a successful ransomware exploit. Like Microsoft PowerShell is almost 9 out of 10 of them.

Sure.

So what if there was also a software push to say, look, no more PowerShell is invoked unless you have specific admin-level needs to do that. Like that would eliminate such a large, and it's a software deal. You could go off, President Rosenquist could go off and have a mandate that came down that said, we are stopping the use of Microsoft PowerShell on all systems where there's not an admin login or credential. And that would exponentially clear out a whole lot of things. Like, is that sort of technical thing valuable as well, do you think? Or is that just way too far ahead?

Does it have value? Yes. Does it change the equation? No. Okay, so you're the ransomware crew that just got $40 million last year, right? $40 million in your pocket. You're thinking this year, $80 million. It's not the Lambo. I'm getting the yacht. I'm getting the yacht, baby. Right? Okay. Oh, by the way, you were using PowerShell and that's how you were getting in. Oh, they've closed that. What are you going to do? Oh, close up shop. I'm done. No yacht for me. $40 million is all I got. I'm done. I'm done. No. The motivation hasn't changed.

Sure.

The method just needs to. They will adapt. And cyber attackers are infamous at being creative and adaptive. They will follow the path of least resistance. Just because you made the easiest one disappear, hey, no sweat, I go to the next easiest one. So yes, it does provide some benefit. And I would say obviously patch and limit, you know, exposure and reduce vulnerabilities. Those are all good practices. But if we're having a specific discussion about ransomware, that will not undermine the attacker. It will not force them to give up. And it ultimately, it will not stop them. They will find another way. They're good, right? They will adapt faster than us and they've shown it time and time again. And whatever technologies we migrate to, that's where they're going to go first. Right? So yeah, yeah, it has value. No, it's not going to stop ransomware. Not at all. Sure.

Not stop it. But I mean, in a, I guess, a combination of policy and technology, right? That could be potentially interesting or useful. I would think somewhere along those lines.

Yep. But it's the policy, it's the cessation of funds going to the bad guys for this activity, right? It's the bell, it's Pavlov's dog, right? We're getting rid of the bell. So if we take away that benefit to their pleasure center, right? Achieving their objectives, then they move on. They go somewhere else to get that bell, to get that treat. Mm-hmm.

Take the dopamine hit away from it. Yeah.

I mean, their objective is, hey, I wanna make money. I want the Lambo. That never goes away, right? If you take away the easiest path, right? Okay, ransomware isn't getting me money anywhere. They will go somewhere else. Absolutely. Because they're still motivated. They just not going to use ransomware, which is great because ransomware, a characteristic to other types of cybercrime, goes after critical infrastructure, can take down, you know, very important widespread services, right? Healthcare, finance, right? These kinds of things. And the amount of damage is just tremendous. We carve that out. It forces them back into models where they're going after the individuals or a single company or, you know, taking financial assets away, whatever. Great, right? That sucks too. But that doesn't— that can't bring a nation down to its knees, not like ransomware can if it's targeted at all the different critical infrastructures.

So why is that policy so difficult to put in place and actually make a thing? Like, we, it's, I mean, I do a bunch of work on Capitol Hill. I've heard that conversation come around a few times. Like, why is that not something that we've already started to push out into the space?

Well, first off, it's a tough concept to grasp around because even the security professionals want to go, no, no, no, just build higher walls. That's what we have to do. We have to block them. That's what we do. Okay, we have to actually look at the problem from a completely different angle, one that's not very comfortable for most security professionals, right? This is psychological warfare. This is understanding the enemy's mindset versus just looking at what controls you have in your little world. So part of it is explaining it. And if the security professionals, you know, the security world is not behind it, why would they, anybody consider it? So we have to have our own internal movement to say, yes, we've thought through these different avenues. This makes a lot of sense. It's worked before in other areas. Yes, the security community's behind this and we can articulate why it works. And the story of why it works actually is easier than a lot of the technology stuff that we try and explain. The other piece where there's a lot of resistance are those companies, especially big ones, they kind of want that fallback. And even when I talk with fellow CISOs, right, at some very, very big Fortune 100, Fortune 50 companies, they'll smile and go, yeah, I'd like that. But no, I don't want that for me. I want to be a— because I don't get all my security budget I want. You know, I want that as a fallback. If something bad really happens, I want to be able to save my company. And I know the money that I pay is gonna wreck other companies. I know that, right? I'm paying X millions of dollars to the bad guys. They're going to keep coming. In fact, they're going to keep coming after me as well as my peers. So I know I'm kind of doing the wrong thing, but my job, my company, if I put that first above everybody else, I like that option. And they don't want to say that in public. Oh no, no, no, no. But Chatham House rules behind closed doors, that's where they're at. They're like, this is my job. I'm gonna protect it, whatever I have to do. And so I want the option to be able to pay that.

What about a standard and a punitive measure for negligence in cyber? Because I mean, it's pretty freaking clear what negligence is in the realm of cybersecurity and configuration and infrastructure. Like, why, why is it— and this is kind of tangential, but this falls in line with the Biden future state because I was reading about some of that stuff— why is it still okay for a company to do something that is overtly wrong and then they just go, oops, my bad, they pay the fine, whoever's running the place gets their giant golden parachute and walks out the door and then winds up at, I don't know, KPMG or something as a consultant making more money on the far end of it? Like, that That's so wrong and that continues to skew things. And if we did that in any other industry where there's potentially lives on the line or even critical infrastructure, someone would be in prison, but in cyber it just doesn't exist. And that, I think earlier when you were talking about putting someone in jail for something, until we do that with executives that should be in jail for it, Who cares?

And well, there's a lot of regulations out there that don't. I mean, they've got a financial disincentive, a fine. We see this in privacy all the time. And, you know, look at GDPR. They've established fines out there and companies are like, eh, it's just the risk of doing business. I'm still going to do that. Because I'm gonna make 10x, 20x in revenue because of this bad practice, then I'm gonna pay in the fines.

So what?

Who cares? It makes sense. Yeah, yeah. No, that's, that's a legitimate business decision. I'm making more profit than loss. Of course I'm going to go do that, right?

But it's wrong.

It should be illegal. It is wrong. It's a— and it's against regulations. It's against the law.

But nothing happens. No one cares.

Well, no, they— you know, there's gonna be potentially an investigation, potentially a fine at the end of the day. They may have to pay lawyers' fees, but you know what? So they've already calculated that. They've already done that math and said, even if we get investigated, we have to pay lawyers, we're still making money. The only difference when you go, no, it's not about the money, we're still going to fine you, it's You, your personal freedom. You're going to spend a year in federal penitentiary. Oh, that's different now. That isn't a business profit loss ROI decision to make. That's me not spending time with my family. Instead, with some very—

Bubba in the cell.

Yeah, Bubba, who doesn't necessarily want to have a verbal conversation.

Right.

Yeah. Yeah, no, that's not gonna happen. Let me put the rules in. This is just simply not required, right? We, we just, we're not gonna do it. We will prohibit that, right? And so that is the difference. If you institute that, and I think it's rational because if you are funding the attackers, right? And we've got rules like this, right? If you fund a terrorist organization, or you trade with an embargoed nation, you're done.

They're going to use that money to attack Americans, to attack our interests.

Guess what? You go to jail. It's not a little slap on the wrist.

You're going to go to jail, buddy.

Same thing here. And guess what? A lot of these ransomware, the biggest ransomware crews, guess who's behind them? You've got nation states out there that are attacking the United States that are embargoed nations. North Korea is behind a lot of ransomware. Yeah. Right. If a company decided to trade with that nation, someone's going to jail. If somebody decided to pay money to that nation, they're going to jail. Oh, but wait, it's okay if you're victimized by ransomware and then you give money to that nation. No.

You leave admin admin to the public internet for 5 years.

You know, because, and the reality is those rules are in place, criminality rules, because it harms Americans, people, our nation, freedom, all of that. Okay. Put that same level of vigor around all digital criminal, you know, payoffs. And you're doing the same thing. You're simply extending the laws that we already have for a lot of those criminal and terrorist organizations. You're extending it and now you're benefiting everyone. Mom-and-pop shop, you know, a year after we institute this and ransomware drops to almost nothing because the attackers aren't getting any benefit from it, it's the mom-and-pop shops that benefit. It's the midsize companies that benefit. Why? Because they're not getting hit with ransomware. And it's the big corporation. It's the critical infrastructure. It's government agencies as well. They're not getting beat up from ransomware because now ransomware isn't occurring that often. Everyone wins. Everyone wins regardless of whether you invested in better security or not. Everyone wins.

But then, because I mean, I think if you put us in a room with 50 people of our sort of, I don't know, background and ilk, they would all agree to the same thing. But in your opinion, like, why is that not actually part of what's going on in the space? Like, we— and I mean, I, I was just, uh, recently on a call with a bunch of folks that were drafting some of this legislation stuff to move its way up. Not even a topic of conversation of like actual punitive criminal time for egregious things in the space. And if you I mean, if you did, you know, if Boeing built airplanes the way that we legislate cyber, there'd be 5 of them in my yard right now. But no one says a damn thing about it. It's just like, oops, sorry, you screwed up and go on about your way. Where's the disconnect?

I think you've got a lot of lobbyist groups out there, very powerful, that don't want any type of criminality when it comes to business. They don't want that, right? If it's a corporation, it's a separate legal entity. We don't want to, you know, breach that. That veil. So they're going to resist that even if— right. And the people behind those policy decisions are well removed from the conversation of how much is this going to impact you, your customers, your business partners, your suppliers, your critical infrastructure, the power you rely on, the electricity, the water supplies going in your facilities. Right. They're distant from that conversation. They don't understand the risks. And if we haven't put forth a rational, easily understood justification that says all these things are connected, right? And if we establish these controls, everyone benefits much more than the potential issues. Makes a lot of sense. But I don't think we're having those forthright intelligent, succinct, easy-to-understand conversations. Because I think at the end of the day, if everybody is on that same page, "Oh wow, wow, we could really gut ransomware." And not just at today's level 'cause it's going up, right? We're able to gut all of that future potential impact and loss. Wow, let's do that, right? I think we would have to have some think tanks write some papers out there, do some estimates. And be able to, again, communicate that to all parties so that we're all on the same page because we all want the same thing. We want not to be victimized by cybercriminals. We want ransomware to go away. We all want that. Well, except for the—

except for the ransomware—

illegal nation-states attacking us and the cybercriminals, right? They don't want that. You know what they want? Status quo. They don't want regulations. Who would oppose this the most? The bad guys. They like the easy button. And right now it's easy and really profitable. Keep everybody broken apart. Don't have any regulations. Right. They even right now, they will negotiate. They're willing because they're going to get money out of it.

Sure.

They don't want a flat-out rule that says they're not going to get paid. Heck no, no, no, no, no, no. Right. So if you're on the side, if you're looking at the ground and you're on the side of the line with the attackers, you're in the wrong place. You should do a check.

You're more—

should you be standing on this issue? Continue allowing ransomware payments and now you're standing with the attackers? Or are you going to be on the other side of the line going, no, we need to stop it, we need to stop the payments? And just saying we'll put a little fine on, or it's best practice not to do that, it's not going to be effective. It isn't. So what will it take?

Gotta have teeth. Yeah, I think that that's the, the side of it that just has to happen, right, is we got to start putting some teeth into the legislation. The fines and stuff just don't make a lick of difference. Like you said, it's the cost of doing business.

It is.

I did enjoy that.

Sarbanes-Oxley, right? Sarbanes-Oxley, really one of those first ones that says, guess what? Your CFO's going to jail. Your CEO's going to jail. Do you know how much money was spent on getting organizations compliant with SOX? An extraordinary amount. And this isn't even near that scale, right? But put the teeth, as you said, put the teeth in place because once a personal freedom right, my ability to get in my car and go home versus sitting in a cell with Bubba, right? Once that's on the line, yeah, you're gonna see people change really quickly. Really quickly.

Yeah, I think it, um, I think it's just a matter of time before it has to happen. Maybe you and I should draft a paper up and submit it up to the, uh, the chuckleheads on Capitol Hill and see if they can, you know, read through it. We could do it with crayons. They could probably follow the crayons.

3 basic colors, stick figures, crayons. Yes, let's do that.

Pop-up things.

Yeah, I hear those are very popular, very popular, the little pot. Yeah.

Oh yeah, I think that that would be a time well spent.

I'll bring the safety scissors.

Yes, well, I would have to use those. I'm sure I could find one of my Marine Corps buddies to give me some crayons they haven't eaten.

So tasty.

Yeah. All right, well, we covered a ton of ground, Matt. Thanks so much for your insights and thoughts. Um, maybe we should put that paper together and we'll, you know, figure that one out on the far end. But, uh, if you folks that are— the 3 of you that listen to this, if you're looking for somebody that knows their stuff and really, uh, understands the space, look for Matthew Rosenquist. This is, uh, this is one of the best in the business.

Thank you much. And the same goes for you. I mean, I always enjoy your insights, and you know, what you say is just so straightforward and to the point. How can people not, not appreciate that? Those 3 people that are watching us right now, exactly. I'm sure they appreciate that.

Two out of the three enjoy it. So, all right, thanks.

Thank you much.