Ransomware: To Pay or Not to Pay?

Welcome to the Cybersecurity Vault. I'm your host, Matthew Rosenquist, CISO, industry cybersecurity strategist and advisor. And today we're going to talk about one of the most divisive and contentious topics in cybersecurity. Should victims of ransomware be allowed to pay the cyber criminals? And I'm going to be talking to Ian Thornton-Trump, and Ian is the Chief Information Security Officer at Cyjack Limited and the Chief Technology Officer at Octopi Managed Services. In his career that spans 14+ years, he's developed strategies, led cybersecurity teams, and been a vocal advocate of proper security practices. And well, good for us. He loves to partake in constructive debates. So welcome, Ian. Thank you for coming and talking with us.

Thanks a lot, Matthew. I'm really delighted because this topic I think we were saying is probably the most divisive thing since I heard about, you know, should we be using password managers or not, which tore through the internet. Slightly as number 2 though was, should CISOs be technical or not, which also seemed to blow up the internet. So, you know, to defuse the bomb and to have a debate and air sort of the different perspectives on this really interesting approach, I'm going to say, to looking at making ransomware an unprofitable endeavor for the bad guys is a debate worth having. So, I'm absolutely delighted to come here and try and put some great spin on what I see as an issue that we're going to be faced with in the near future and possibly beyond.

So let's start off. I think everybody understands what ransomware is. It's been around, but let's talk about how those harms, those impacts, are they growing? Are the current security controls, are we winning? Is it getting better or are we still losing to this form of digital extortion? What are your thoughts here?

All right. So, it's really interesting because the immediate opening salvo from any information security professional is, "It depends," right? But concrete data is somewhat elusive on the war, the cyber war against cybercriminals versus law enforcement. It looks like, and maybe this is just the perception that Law enforcement seems to be way more engaged with this. I was just at the 24 in 24 Doubling Down on Ransomware Task Force meeting, which brought, you know, the entire TLO and most of the U.S. government together on stage with Microsoft and some bespoke security partners that are deeply ingrained into the United States government for a discussion on ransomware and what progress has been made. If you look at the press releases coming out of DOJ, we're seeing a combined attack on the money that is changing hands with the takedown of that Suiboi wallet service, I believe it was called. And then we see, you know, obviously major disruptions happening in the ransomware ecosystem. So one perspective is it looks like we're the good guys are winning. And then yesterday, I think the announcement came out that UnitedHealth had paid $22 million to cybercriminals to not release the healthcare data that they apparently had hoovered up from United Healthcare Systems. So, it looks like we're losing big time because that payment wasn't to decrypt the ransom. This was a data extortion perpetrated. This was in an attempt to prevent that data from being made public or sold. And unfortunately, cybercriminals are not known for putting ethics first. Um, and so it's somewhat dubious whether or not that data will actually be deleted or it will be monetized by the cybercriminals anyway. But I think UnitedHealth was put into this terrible situation because if they didn't pay, they'd be accused of not doing everything within their power to prevent this data from being, you know, made public. Now that they have paid, they may get screwed anyways. So I think it's a real mixed bag right now. What's your perspective? Are we winning or are we getting our asses handed to us out there on the football field?

I think if we look at a historical perspective, right, and when, I mean, ransomware has been around for a very long time. Digital extortion has been a favorite of cybercriminals, and we saw it come out, you know, really kind of hit the news probably 15 years ago.

Yeah.

And it was around before then. It's been around even before like—

First CryptoLocker attacks. Yeah.

Right. So, but we saw it rise and, you know, there were many of us that said, hey, this is going to be a problem because they're getting paid. And if we put our mind in the hat or the mask of the attacker, when they get the benefit, their motivation is personal financial gain. And when they get that win, They just do it again, right? They're going to do it greater. We look at the greed factor that says, if I can steal $5 from you today, I'm going to try and steal $10 from you tomorrow. So there's a lot of money, right?

Yeah.

Yeah. And so we saw this, we predicted the growth and we've seen this growth and we've seen it shift from attacks primarily against, oh, individual PCs. And I'm going to, you know, lock up your family pictures for $1,000 or $500. And the attackers realized, why am I going after this low-hanging fruit? I'm going to go after the big boys. I'm going to spend a little more time. I'm going to go after the millions of dollars. And that's where we're seeing big companies get hit. And then they realized, hey, the best companies are in that critical infrastructure sectors. If I hit them, they have to pay, right? They're going to— and there's a greater chance. And so that's where we're seeing these, whether it be just regular cyber criminals or even nation states that are looking for hard currency. Right? So you're talking about the Irans and the North Koreas of the world. You know, they're using ransomware because, well, they're sanctioned and they need money, right? And so, yeah, they're going to do this. We've seen a huge increase. And you're right, I think there is still a lot of ambiguity because not all of it gets reported. However, with new rules like the SEC rules where you now have to come out with an 8-K and say if there's a significant material issue, you have to report it to your investors. For the public side companies, they're now having to do that. I think we're going to see more and more. And UnitedHealthcare is just the latest. And when you're paying $20 million, that's too— there's two big impacts, right? The attacker wins. So they're going to do it again. They're going to invest some of that money in the next tool, the next evolution, the next vulnerability. And they're going to go after— they may go after UnitedHealthcare again in a year. But they're going to go after everybody else in that sector. The other thing is it's a message to every wannabe criminal, for every person, the next billion people that are joining the internet, that are coming from countries and economies that you only earn less than $20 a day, which is half, almost half the world, right? They're seeing, wow, I could do ransomware as a service. And instead of scratch out, you know, eking out a bare existence, I can actually put food on the table, put my kids through school, No, I want to do this. So you're now encouraging the next generation, the next billion people joining the internet, that crime is a good way to make money. This is— especially we're losing today and we're going to lose in the future if we keep doing this.

Yeah, and I mean, you know, in a lot of ways this argument— there's also some pick, by the way, in that, in that novel— but let's go with the idea that we've turned Africa into the one botnet per child. A type of scenario where, as we've sent, you know, our old tech gear to somehow make their society become more technical, a segment of that society has now become Anonymous Sudan and other mercenary groups working at the behest of the Chinese and other nations, including Iran and Russia, to attack Western infrastructure. So you're absolutely correct that we are kind of making our own nightmare scenario. But I want to go back to that 8K issue and a really interesting case I came across where MGM— we all know that MGM got the hackings and they got the hackings badly. Okay, now they're actually suing the FTC right now to prevent an investigation into the goings-on related to that hackings. And this is drawn out of a belief that they're all about, hey, let's follow the law here. But the way this came around is there was an FTC representative, I believe, staying in the hotel at the time of the hacking, and they asked questions. And at that particular point in time, there wasn't sort of a due process. It's a due process argument right now. It's interesting to me that— and I said this on Twitter— suing a regulatory body in the United States doesn't look like you're not guilty, right? But I get now— I get now that the— in, in view of how the law is supposed to work, when it gets circumvented by over-anxious regulatory bodies, somebody has to call them to task. And MGM is one of the companies that has pretty much a bottomless pit of money to spend on litigation, right? So if you're gonna choose a target, you know, choose a bank because if you choose a casino, they can make more money in a day than probably your entire legal budget is to litigate. So it brings up the quandary really, and I think you alluded to this, is that when we're talking about national critical infrastructure, and I think now, policy framers get it. And this is why the ransomware task force discussion was really around the critical infrastructure that got compromised by Volt Typhoon. And the response from the DOJ was, it's so serious, we're going to go and convince a judge that we have to go in and patch your home routers, right? The Netgears and the TP-Links that were used to stage the botnet for the attack. We're gonna go in and we're gonna fix it for you. Now I can see every civil libertarian coming out of their skull over this. Like it's one thing when you go into a business and you say you're a clear and present danger to the United States of America because this WatchGuard firewall is compromised and we're gonna patch it for you and remove the malware. It's a big step to now go into your personal network and fix stuff, right? That to me is like now it's, We can agree that that set a tone that ransomware is a clear and present danger to the United States. And in the context of there's a war between Ukraine and Russia, to be fair, not a major issue for the United States, right? It's not affecting the homeland. Then you have the war.

That's a different discussion.

That's a different discussion.

Let's get back to ransomware. Bring it back to ransomware.

Okay, but then you have the war going on in Israel against Hamas and the Palestinian question in the Middle East. Again, not a direct attack on the homeland. Attack on national critical infrastructure by ransomware operators, attack on the homeland. And nothing will bring policymakers and IT professionals together than a major cyber attack on the homeland, which so far, to be fair, hasn't manifested. For a lot of reasons. But herein is the rub, and we bring it back to ransomware and the operators. And I feel like if we decide to ban the payments through a legal mechanism, we're essentially making it a crime to be a victim of a crime. You know what I'm saying? That's sort of how I see it.

I disagree. Okay. No, I disagree. Okay, so what we're saying is if we— well, actually, let's back up just a second. I'm going to address that. Let's talk about what we agree on. Number one, ransomware is a scourge and it needs to be addressed. It's— our current tools just aren't winning, right? So we need to address this. We need to do something. And it's a worthwhile thing to address because it's getting bad.

It has economic impact. It has economic impact.

It does.

100%.

And it can have personal and health impacts and all sorts of bad things. So, Bad problem. Current status quo is not sufficient. We both agree with that. 100%. Would you also agree, and this is an important point, if we do successfully somehow stop the money flow to the attackers, they will move on to something else because they're motivated by money. And if they know they can't make money, they're going to move on to something that will make them money. Right? Do we agree on that? More money. More money. But they're going to move to something that does satisfy their, their motivation. Okay.

I agree.

So now let's get back.

Yeah.

No, go ahead.

I was going to say, historically, you're absolutely correct. This is one of the reasons why fentanyl became a scourge, because it was more valuable, more addictive. You need less of it, and it was harder to detect than cocaine and other types of of drugs, right? And people addicted to that particular substance, you know, basically had, and to be fair, a longer lifespan, although that's questionable, opiates versus fentanyl or carfentanil. But the point is, is that this was about driving as much profit for an illegal drug trade as possible. I agree with you. This is why we saw ransomware become double extortion ransomware and even rare triple extortion ransomware where we can prove that you've had a data breach and we're going to report you to the regulatory authorities type extortion.

And your customers and partners. Yes. And customers and partners. Okay, so we agree on all that. So now let me address your question because your question was if we outlaw it, if we criminalize it, are we penalizing the victims? Well, if the goal is to end ransomware, which benefits everyone, it prevents victimization, then we need to find the best path to do that. Now, if we say, okay, we're going to criminalize— now think about this— what we're criminalizing is if companies or victims want to fund, pay, provide material support to the attackers. That's what we're saying you can't do if we decide to criminalize it. Now, again, there's, there's lots of concerns with this because a lot of people think, well, you can't just snap your fingers and, you know, all these victims are, are gonna have no other choice. No, no, no. That is, that isn't what's being proposed. What's being proposed is this is what we will eventually implement. Now let's find that, that proper path to where we can get it there. So yeah, critical infrastructure isn't completely cratered and, and there aren't these corner cases and everything else. Let's find that path to get there. And if we can find that logical path that says, yeah, we're going to give companies a year or 2 years to harden their environments, But at the end of the day, once we turn this on, what happens? That volume, that noise of attack, then we know will go down for everyone. So that's really what we're saying. We're not saying it's a tactical move, it's a strategic move. One, by the way, that has been proven before time and time again. If we look back at Italy in 1991, they were having massive issues with the mafia over there kidnapping people for ransom, for extortion. And it got so out of hand, they actually had to pass a law that said, we're going to freeze victims' assets so that the attackers cannot be paid. And what we've seen is it go down to almost nothing. The attackers moved on because they knew they weren't going to get paid. We see the same thing for, uh, rhino horns.

Yeah, the trade in illegal—

you can go in and try and build big walls and it doesn't work. The attackers come in, kill the rhinos, take their horns. But if you go in and cut the horns off of the rhinos, which doesn't hurt them, they do this humanely, right? The rhinos are fine to then move on. The attackers have no reason to go in and kill the rhinos. Guess what? This works. We are targeting the base motivation of the attackers. And in doing so, we now can solve the greater problem, especially for those organizations that can afford right, good security or protection, or maybe they couldn't even afford the ransom, right? We're protecting everyone. So the argument kind of in my mind falls apart. Hey, wait, no, you're doing something horrible. No, we're doing something wonderful. And anybody that says, well, wait, I want to be able to pay— okay, so you actually want to be able to pay your attackers so that they can attack you again and your peers? You want to support crime. You wanna materially fund crime. And we already have laws on the books that say in some cases you can't do that, right? OFAC, right? Which is the, help me out, it's the Office of Foreign Asset Control. Foreign Assets Control, yeah. Already forbids funding to embargoed or sanctioned countries. Oh yeah, like North Korea, like Iran, like Russia, right? And so that applies to ransomware, but people are kind of overlooking that. Oh, well we just won't look to see We'll just skip over that, right? And we're gonna pay. There's already laws on the book. So this is just one step further, but there is a lot, a lot of concern about that. If, if we do do this, right, we know it'll work. If we do do this, if we do it wrong, there may be corner cases where lives could be at risk. So in my mind, it's not a debate of whether we should do this, it's whether we should do it correctly. I don't know, what do you think? Wow.

So, uh, so a couple of things. I think the examples that you gave are really good, but in most of the cases, uh, rhinos being separate, by the way, but, um, because you're absolutely right, in that very small particular use case of preempting the trade in the ivory by removing the horn humanely before the rhino is shot, Let's also keep in mind that the anti-poaching forces are under law able to shoot poachers. So that's also a big disincentive, death and not making money.

But that hasn't stopped the poachers. Think about that. The disincentive of death, they still do it, right?

They still do it. So, yeah. So I think what's really interesting about this is I'm in agreement that that would be a great goal. What my concern overall is, is jurisdictionally it would really only work with the long resources and tentacles of American law in enforcing a ban on ransomware payments. Now, it's not to say that many nations wouldn't lockstep along with that and kind of facilitate it. The other issue I see is directly connecting these operators to their host countries and to their Bitcoin wallets that are in different countries that are more sympathetic. We can talk about Cyprus, Turkey, African countries and stuff like that, where it's difficult to understand what the origins of funds are. And in fact, as an example of this, we've been in almost 3 years into the sanction regime for the Russians, and oh surprise, the International Consortium of Journalists found some property here in the UK that happened to belong to a shell corporation that happened to be run by a Russian oligarch who's now been added to the sanctions. It takes a long time to do this correctly. I'm worried about what I saw is we're going to attack ransomware by that famous Philadelphia incident where there are armed subjects in this one building, so we're going to burn down the block with an incendiary device dropped by helicopter, right? You know, ant meat hammer. I think I'm going to say I've moved my position from banning ransomware is a terrible idea as a result of this discussion to let's consider it under a framework and governance structure. Like maybe you need a permit to pay ransomware when you can demonstrate that you have no other economically viable means of keeping your business and keeping your job running. The problem comes in with the state of governance and actual public service capability to invent a process that is not lengthy and difficult and requires litigation in order to move forward with getting that permit to pay and these other encumbrances to execute a, I'm going to say, an authorized ransomware payment, right? Because if it's too difficult, nobody will do it because generally they're lazy and they just want to have this terrible day, week, or month end as quickly as possible. And that is usually paying the bad guys in cash. Now, the last piece of this, which I think you make a really compelling argument for, is that the bulk of victims of ransomware attacks is America, is American businesses. It's not to say it's not happening overseas, But America is where the money is at, right? So, you know, with prosperity comes responsibility, right? So maybe you look at something like the Superfund that was established to clean up the messes made in the 1960s and 1970s, or a FEMA-type structure that has money allocated to it to come in and fix those businesses and get them back up and running. Because they've fallen on their asses. Subject to, and this is the part where Matthew and I can get really excited about, is that if you knowingly lie and pretend that your business, 'Oh, we need this money. We need this insurance claim.' And you've committed a fraud against the government of the United States, I think the punishment should be really severe.

Okay, okay. So I, I love these concerns and I want to tackle them. So the first one is, well, hey, this would only be US, right? The second was around Bitcoin and cryptocurrency. I'm going to address that last. And the third was, well, people are gonna hide the payments, right? They're still gonna try and go around things. All right, so let's talk about US only, and let me just be really brutal about this because we're going to walk the timeline. Okay, so if the US criminalizes, criminalizes, which means if a company, an executive decides I'm gonna pay for whatever reason, they're at risk of going to jail, not paying a fine, but going to jail. Okay. So, and we've seen this before. Sarbanes-Oxley was a great example, right? Sarbanes-Oxley said, hey, if you cook the books, you're gonna go to jail, right? You have to report this and be forthright, right? We then saw— do you know how many cases of people then being prosecuted it took before everybody actually complied? There's been one prosecution, one criminal prosecution.

Yeah, like half a dozen, I was gonna say. That's all it took!

Yeah. Apparently, if you're an executive, you're fine with the company paying a fine, right? We see this all the time for privacy in Europe and everything else, but the moment you make it criminal, and they're now potentially going into a, you know, a 10 by 10 square for an extended period of time with Bubba, they're like, no, no, that's not worth it. I am going to follow the law. So I think if we do criminalize it, it will flow correctly. There will be very few outliers. But here's the thing. You said it's only US, and this is where I'm going to get really brutal, right? Okay, so let's walk this path. Let's say the US does do this.

Right.

Right. Now, from the cybercriminals' perspective, they're still motivated by money, personal financial gain. And now all of a sudden, US companies aren't paying. Right.

Hmm.

What should I do? Oh, I know. I'm going to now attack Europe. I'm going to now attack Asia. Right? Because they still are paying. And so we're going to see a shift, sadly and brutally, we're going to see a shift to other countries. And what do you think the other countries are going to do? Wait a second. Dang it. The US outlawed this and now they're attacking us. Hmm. What should we do? We're going to see that.

Well, you can be the leaders.

They're going to go, hey, why don't they do the same thing? Right?

You could be the leaders and you're making it someone else's problem. Yeah.

Yes. Yeah. It's really pushing it off. And I know that's brutal and I know that's ugly, but this type of chain reaction is a natural response. And we're going to use it. You know what we're going to use it to do? We're going to use it to make sure that all these countries fall over quickly and do the same thing, leaving nowhere for the ransomware people to attack. This is how we end ransomware globally.

Okay, so I love the vision. I love the, the thing is like, we will make ourselves stronger by burning the weakest. Um, but it's true, and, and it has this ripple effect. So I don't want to be the last country on that list. 'cause it's gonna have a really brutal time, right?

Every cybercriminal—

The entire country of Senegal is now ransomwared on a weekly basis, right? But, you know, it's not— it is absolutely sort of, we can call it cyber Darwinism then because it will certainly be an abrupt change to the evolution of this. And, you know, perhaps in its brutality, there is some art to this because when you think about it, it might be a hell of a lot less expensive than our current approach, which involves a $400 billion industry. And this is in the rub, okay? Because all of a sudden, a big part of that $400 billion a year industry is no longer employed. And so, you've solved one problem by taking a sledgehammer to the "You should buy my product, Matthew, because I can solve all your ransomware fears." So, I feel like, okay, let's, you know, it fits a little bit Elon Musk in that we're going to build a rocket ship We're going to fire it up. We're going to see what breaks, and then we're going to build another rocket ship. It's amazing. And I mean, it is elegant in its brutality to the approach. You're not wrong.

It is.

I don't think you're wrong. I just think from a policy perspective, the EU would just absolutely crap their pants.

Yeah.

And I—

but they would be very quick to turn around and follow suit. Right. Well, like, poor Asia, I think, would be left holding the bag going, uh, what are we going to do now?

By quick, you mean it'll take them 4 years to study the problem and then come up with another document for commentary that takes a year. So yeah, you'd be at least sunsetting the ransomware future of the EU by making such a bold— That's correct. Do you think though, do you think, let's zoom in on that, of all of its absurdity, do you think there's policy folks in halls of power in Washington that have the kahunas to do something like that, keeping in mind that some of these people that may pay those ransomwares are their contributors to their campaigns.

Yeah, I think because the general public and these companies don't actually understand there is a logical path and it will benefit them to a great degree once this is in place, they don't see that. I think right now politically it's too much of a hotbed. And I said this 5 years ago, I said this is the solution. It absolutely is. There's no better solution out there that's more economical and more effective and will work long term. But we're not ready for it. And the only thing that's gonna make us ready is more pain. Yeah. So, okay, let's let the pain go up. And there is some theoretical amount of pain and suffering where everybody will step back and go, okay, it's enough. Whatever you've been doing, it hasn't worked. There are now so much impact, you have to do something legitimate. And they're going to get desperate. Well, well, what can we do? Oh yeah, oh yeah, there were these plans that we could actually solve it. Let's go down that road, right? But I think right now, until we have these discussions and people understand this is the right solution, We shouldn't be debating whether it's the right one. We should be discussing how do we get there in a logical, rational way so we don't crater everything, right? We don't do more harm than good, right? How do we get from where we are now to where we need to be to criminalize it, right?

And it has to be criminal.

It has to be criminal.

Here's why.

Talk about the second point. You raised the second point, right? Companies are gonna hide this potentially. All right, let's talk about it. One, we're going to criminalize it. So that in of itself is a huge deterrent, especially to executives who really like comfy chairs and traveling in their jets and, you know, vacationing wherever they vacation. That 10 by 10 cell with Bubba doesn't sound good. Okay, but—

Well, most of them end up in white collar prison, but I'll give you prison is not fun.

That's true. That's true.

We can agree. Prison is not fun.

Prison. Yeah. Yeah. It's still a deterrent, right? They can't vacation in the Hamptons anymore. They're vacationing out in the yard. Okay.

Sure. I can't go on my boat anymore. This is a big deal.

But there's still potential. But let's think about it. One, that's a deterrent there because it's criminal. But two, the moment you make it criminal, guess what? Every cyber insurance policy for paying out ransomware will now be revoked and you won't be able to get insurance for it. That in and of itself will also carve out and be a huge impediment, right? Because if someone's asking you for $20 million, you don't have it in the bank, you were okay, well, that's why I have insurance right now. Insurance isn't paying for that. That's also a huge problem. Okay, the third and my favorite, because again, I just love being brutal. What I would say that you would do, and you're going to love this, you're either going to love this or hate this, right? Because you make it a federal crime, right? In the US, you have what's known as a whistleblowing law, and the whistleblowing law basically states that if you're defrauding the government and you report it, right, you're doing something against the law and you report it, the person that reports it can get between 20 and 30% of whatever the fine is. And what you do is you say the fines will be 3 times whatever the ransom that was paid was. Okay, so if we take UnitedHealthcare and they paid $20 million and let's, let's turn this forward, it's been criminalized and so forth, $20 million. So the fine if they got caught would be $60 million. And that would be if an insider reported them, that's a $12 million payday.

Mm-hmm.

Okay. But really, I mean, how many people would know? Well, ransomware tends to affect a lot of systems and become very apparent, right? So you're probably gonna have—

It's not stealth.

Employees knowing this. Yeah. And then all of a sudden you get a decryption key and an executive who pays for that encryption key, I doubt they actually know how to use it. They're gonna be talking to their IT department department to say, hey, use this decryption key to decrypt all the machines. So now all of IT knows it, right? What are the chances that at least one person which is going to go, I would like a $12 million payday, and makes a call? Yeah, I think you're going to have an overabundance of people going, I want to be the first one to make that call, right? So the executives have to think about this. I'm going to be ratted out by my own people and I'm going to jail.

Yeah, I think so. I think what you'd see is the pivot from actually ransomware to data extortion, data exfiltration extortion, right?

Yeah, I would say any digital extortion, any digital extortion at all covers this. So was it ransomware they were doing? No, it's digital extortion. Done.

I want to argue in favor of it having to be criminal because of the state of Delaware.

Yeah, I can't argue again. It has to be. If it's just a fine, it'll be like Meta and Google paying off privacy in Europe, right? There's no— there's no resistance to that. That's an economic decision then.

We have to also pierce the corporate veil that is constructed through shell corporations and privacy laws. And that goes away when it's an actual federal criminal case.

Yes, it does. Yes, it does.

But see, let me give you an example of how UnitedHealthcare, okay, could have avoided paying the fine and made it very difficult to it. So let's say it was not a ransomware attack. It was a data extortion attack where all of the data was stolen by an unknown third party and they're now demanding a ransom. Okay.

So to me, that's, that's still, that's digital extortion. That still should be covered.

But here's where, here's where I'm saying it has less of a ability to be detected and the amount of people that would be rolled into that would be somewhat, somewhat reduced from a ransomware event where it's on every screen, right? Okay.

Okay.

So let's say that is the pivot because the cybercriminals know the more that a company knows about it, all of a sudden these penalties kick in and the whistleblower legislation could go forward. So, you've managed to control who knows about this event, right?

Yes.

So, you're UnitedHealthcare. You've got a lot of money, okay? You call up a Cypriot law firm in Cyprus and you say to them, I need to move some money from this Bitcoin wallet to that Bitcoin wallet. Make it happen. Make it happen for me. Okay? All of that potentially goes away, right? Because now you've done the transfer, right? The bad guys have the money. The bad— and you know, you ask for them to do it in Monero, which is a very difficult to trace transaction.

Okay, sure.

So you're taking— you're now moving OPSEC and, you know, you lock down these people. All of a sudden, the SOC guy that first detected it is given an NDA and a giant check. You know, I feel like there's ways that you could bypass this, you know, this sort of like black and white scenario, right?

Well, hold on, hold on. Yeah, I can tell you it's not going to work. And this is why. And this is the beauty of it, right? Or the cybercriminal that says, give me $20 million and you do do that. They're going to be laughing because the next email to you is Now you're going to give me $100 million every year or I will report you to your government and you're going to jail. Now it's no longer you lost your data. I'm now threatening you to— threatening you that you're going to go to jail, right? And so these companies, if they want that to be signed up for, they're done for. They are now on the hook every year to be funding these cyber criminals. They will never get out of it. Even if they leave the company, they will never get out of paying ransom extortion to these because they will always have that over their head. So no, there is no logical person that would say, yeah, okay, I can, I can hide it from my people. But guess what? The attackers are then going to extort you for life because they're attackers and they're criminals and they're criminals, right? They're not your friends. They're not your friends. They're going to extort you now. They don't care about the data. They can up it by 100%, 500%, 1,000% every year.

Related, related to this, and I, and there was a comment made at this 24 Doubling Down on Ransomware Task Force thing, and I thought it was very interesting and it raised an eyebrow. Um, ransomware attack on national critical infrastructure, the lights go out in a major city in, in the United States. Kinetic response? Do we just go kinetic at that point? Because the United States and, and well, that's just it. The United States and the United Kingdom have proven that under certain circumstances, they're more than too happy to drone strike somebody for perpetrating a crime in the United States under terrorism. But is it not terrorism? Is it not considered terrorism to do a mass casualty type of attack or a mass inconvenience type of attack? I know we're sort of slicing it down. But at what point is money now not the problem? You're literally running for your life. Because I think we're getting to the point where we can do real physical damage with a cyberattack with enough preparation and enough capability, and that the attack surface is always growing and somebody will make a mistake somewhere and put something catastrophic online. I'm just wondering, is there now an argument that says, oh no, No, no, no. Yes, you're now enemy number one of the United States. And you know what being enemy number one of the United States means? You don't last in that position very long, right? Yeah. You get— you go to the next guy pretty quickly. So I'm wondering about that in that are we now escalating against these perpetrators directly? Like, should Lockbit Admin be drone striked.

So it's an interesting tangent, right? And this is a discussion that again has been going on for the better part of 15 years. I remember sitting down with, you know, the director of CIA and NSA and talking about this. And the simple fact is, regardless of what you see in the news, right?

Yeah.

Somebody gets hacked and immediately they say, oh, it's some APT out of this country. The reality is in the digital world, it's really easy to masquerade as somebody else and hide. So attribution, true attribution is incredibly difficult. And normally it actually takes a lot of human resources down the line to figure out who really did it. And so that isn't something that happens very fast. And do you really wanna drop a Hellfire missile into a building if it really wasn't that person or group that conducted the attack, right? If the attacker first hacks a hospital and then launches a ransomware attack or some critical infrastructure attack from the hospital systems, are you really gonna bomb the hospital?

Yeah.

Probably not. So because attribution has become such a difficult problem, such a difficult problem. Until we get better at that, we probably won't be dropping, you know, airburst weapons on targets for digital attacks. And it'll probably more go the criminal route as it has been. But I do want to kind of, because this touches on another, and that would be a great deterrent if we could do attribution and we could do, you know, elimination strikes. It's one of the ways to solve attacks is eliminate the attacker. It's one of three ways. You know, that's an alternative, which I kind of want to get to. Are there better alternatives? I mean, we talked about, okay, it is viable and choking off the money to the attacker does solve the problem, but is there an alternate method that maybe would be better. And, you know, I've heard a lot of people say, oh, well, we're going to increase collaboration with law enforcement. Oh, well, we want everybody to spend twice their budget on cybersecurity. And we want— and nothing that I've seen so far even comes close. And you brought up, well, Bitcoin, and I hear this all the time. 'Well, we should just outlaw Bitcoin. Bitcoin's evil.' And I have to laugh. And my first response is, by the way, ransomware existed before Bitcoin, right? So even if you got rid of all cryptocurrency, they're still going to find a way because that's how they get money, right? So whatever it is, yeah. And, and so it's, it's not even getting rid of Bitcoin. You mentioned Monero, right? Monero. And we're talking decentralized. You wouldn't be able to get rid of this stuff even if you tried. Even if the US outlawed it, it still wouldn't get rid of it. So one, it's not feasible, and two, it wouldn't actually solve the problem. The attackers would just adapt, right? We already have some attackers today. Hey, gift cards. Hey, I want cash. I want this. I want that. So yeah, they would find another way. Liberty Reserve, which was a criminal institution, right? These things will pop up.

So Western Union, you know, so crypto is not a solution.

Not a solution.

So, it's interesting. Yeah, it is interesting. It isn't a solution. I agree 100%. I think though, it's sort of like the way cash is illegal under certain circumstances, right? And that's where policy and law needs to align. That if you use Bitcoin to buy a property, that's okay. All right? But if it turns out the Bitcoin was garnered from criminal means. It's just the mechanism of the transfer and you're, you know, the criminal, right? And you've now been proven that you're criminal because they watched the transaction. They saw where the money came from and it was suspicious to begin with. And now, it went through a bunch of washers and now we know, right? That we're fairly certain to a reasonable doubt standard basically, which unleashes the criminal resources against Yeah, I think if you get to that point, it's worthy of an investigation to then confirm.

Yeah.

Yes. And then we usually know that if there's enough evidence for an investigation, it usually means there's a good chance we'll get enough evidence from that investigation to prosecute you. It all flows downhill. You don't get signed off just because I think Matthew Rosenquist is a drug dealer. I have to have, I have to have something a little bit more concrete than that.

Due process, little things like that. Innocent until proven guilty.

And this— yes, and this comes back to all of the cyber criminals that are non-US citizens that we've extradited from other countries to face the long arm of the law in, you know, in usually some sort of cyber crime that includes wire fraud, you know, the illegal transfer of funds. Do you think that the existing wire fraud law then can be the antidote. We just have to apply it to people that are making a transaction with, you know, for criminal purposes.

I don't know if it's the antidote, right? We've got rules right now. So for example, we mentioned OFAC and said, okay, you can't transfer. And yet a lot of people are going, well, if you can't prove to me that this attacker was North Korean, I'm just going to assume it's not because it's convenient. So I'm going to go pay for for it. I think, you know, when it comes to, okay, well, we're gonna, you know, just look at some of the funding or the transfers and see if we can manage that. I think, again, we need to target the source, right? We're using the behaviors of the attackers against them, right? So if we choke the money off, we know they're gonna go somewhere else. We're also using the behaviors and motivations of, unfortunately, their victims. To say, okay, if you do do this, you're going to go to jail, so don't do it. Right. And in not doing it, now this problem goes away for everyone. So this becomes, we're going to all work together and do the right thing, which means we're not going to fund organized criminal activities. We're not going to provide the material support. We're not going to give them the resources to get better and expand their operations. That makes sense. It really does.

It does.

But people don't want to look at it that way.

The federal problem too is they don't see it as— now they're starting to talk about it being clear and present danger for the pain threshold that we talked about. But still, when you look at the IC3 numbers coming out, back business email compromise and fraud, romance scams, and all those other things are in front of ransomware attacks and the amount of money being made? Or, and you can— and I'd love to hear your perspective on this— is it because folks are more reluctant to report those type of fraud and scams that they fell victim to than a ransomware attack? So is there a problem with the numbers that makes it look like federally it's less of a problem than it really is? Go Matthew.

Yeah, I think right now people, companies get very embarrassed to say, hey, we were a victim of ransomware, especially if data was extricated. It's even worse now because there have been clarifying rules that say whether you think data has been exfiltrated or not, if you're a victim of ransomware, we consider that a data breach. So there's a lot of concerns around that and a lot of people don't report, right? If they're sextortion and And, you know, these other types of attacks against an individual, that's very embarrassing to report. So I think we are greatly underreporting all crime across the, across the board. And without that information, it's really tough to say, well, how much are we not reporting? Okay, it's, it's, you don't know what you don't know. But, but I think when you look at ransomware, there's a difference. Well, the difference with ransomware, instead of going to a sextortion case and you're impacting one person, ransomware is now targeting critical infrastructure, which means it doesn't just impact the embarrassment of one person. It can impact millions of people, an entire society, in fact, right? When we talk about the UnitedHealthcare, it didn't just impact one embarrassed executive. They're talking about the majority of people in the country may be impacted by this one. When we look at You know, what was the fuel company on the East Coast? Crap, I forget their name. But—

Pipeline.

That shut down gas stations. Yes. You know, and you know, you look at SolarWinds and that was 1,800 companies, including critical infrastructure, defense sector and everything else that could have impacted the entire nation. So, you know, it's a different kind of world. We need to address ransomware. We need to, and it is becoming— the White House has already said this is a top priority. This is getting severe. We've looked at, um, uh, National Intelligence, who has also said this is going to impact us. This is now a national-level crisis event, and it's going to get worse. We have to address it. So I don't think we can put it in the same category as some executive sextortion or you know, some email, you know, redirection of $50,000 funds. This is at an entirely different level, and we shouldn't be bundling.

I think that's really important because you picked up the big trigger word that is going around Washington right now, and it's about clear and present danger that ransomware presents to the national critical infrastructure of the United States. This is a really important moment, and I think it's the inflection moment where your policy of brutality may actually get some drive because a couple things. First of all, the leaders are now being advised by a generation that grew up that is computer literate. Okay? That never happened before. I remember Mudge and a whole bunch of other guys testifying in front of the US Congress basically saying that the internet is going to turn into a pit of despair and blow up the country. And everybody was like, oh, you hackers, blah, blah, blah, right? Those hackers had kids.

And the audience didn't even understand what the internet was. I mean, Mudge had to, you know, kind of explain it in small words. I remember that testimony.

I was shaking my head, embarrassed of my legislators for knowing so little about something that became so important and is the entire basis of the economic prosperity of the United States. United States, or at least a big chunk of it. So, you know, it went from pipes and wires, I guess was the description of how the internet went, to it's now of national critical infrastructure importance, and it affects our daily, uh, the way our life, our daily life, uh, works here in, in Western developed nations. Um, so I think there is a call to action. I think the, the folks that are informing government, maybe they'll even become government themselves. I remember there was Candidacy from a former Cult of the Dead Cow member who got close, got really close. But as time goes on, I think we'll see more people elevate that importance and that policy who understand the problem. And there may be room to maneuver. But I also agree with your point that the climate right now of partisanship where any good idea is shot down just because it wasn't your idea is a difficult thing to overcome. And I think that the wind is starting to change the whole dynamic for a lot of the reasons you said. So I think if I was going to say I'm adamant about not making ransomware payments, I've moved my position into we should consider it as an option with some good governance and decision-making around it.

All right. So where do we go from here then? Right. We do have those political challenges. We've got the the communication and awareness challenges. Where does our industry as cybersecurity and leaders who have this insight, who have understanding, what do we do? Where do we go?

So, we're the ones that it falls to us to have debates like this and talk about these issues and then put the to-do list together. So, I like to say, you can't give someone a speeding ticket if you haven't told them what the speed limit is. So this calls for a national minimum data protection standard that perhaps needs to be filed along with your other filings that attest because of USC Code 18-1001, which is the hammer that can be used for criminal sanctions for lying to the United States government. That's a really important piece. And I mean, everything today right now in the United States, you sign under penalty of perjury anyways. It's about time people wake up and understand what penalty perjury actually means. And then I think what is sort of a way of doing the— there's two components to it. It's educating businesses on what is going to happen if you transgress this new law, why the law has been put in place so eloquently articulated by yourself. I think everyone can get behind American Brutality. Historically, you've managed to pull that off. Um, but, but then comes the part, the hardest part, is you need the slickest salesman you can get to go in front of the UN and to go to these, um, organizations, these global organizations, and say, this isn't a debate about your permission to do this. This is what America is going to do, and this is what the repercussions of that are going to be. So either get on board or get out of the way because this is coming. We put up with it. We reached that maximum pain threshold and we're going to go for it. And I think you're right in that America's always been a leader in space. Okay. You can argue about American sort of isolationism.

Wow.

That was a little bit tough to get out. But they've always been there to rescue the world from terrible, terrible things. World War I, World War II. These are examples of American exceptionalism. Nationalism, which was the word that I was looking for, to feel a bit like a statesman and uttering that. But you've always been there to rescue the world from really bad things. We can count on you.

Like the British. Yes.

Yeah. Well, yeah, that was more of an extrication per se than a true getting rid of the empire. But maybe that did contribute. You never know. But I will say this. I think America is now positioned to be a leader in the space. I think they're the only one that has the resources to pull it off. And, you know, I think it's worth starting to experiment because I think as we started this discussion with, and now we will end it, we both agree that there is a pain threshold now being suffered and an exposure that is unprecedented.

Yeah, I agree. I mean, personally, I would love to see leadership in our industry work with like CISA, right, you know, federal government agency to actually draft out a plan because we know what the solution is, but we really do need a good job in charting out how do we in a, in a good method, in a good way, roll this out. And I think there's several different milestones to make sure that we're not creating unnecessary harm in doing this. We're not leaving open backdoors for bad things to continue to happen. And we do achieve our goal at the end of the day. But it's important that the world, the industry, those sectors, businesses, people understand what that path is so that they can look at it and go, oh, okay, so you're not just turning the switch and I— oh, okay, I'm going to have time. Oh, there's going to be resources. Oh, there's going to be— okay, no, no, that sounds good. And at the end of the day, we're going to have a stronger environment and more protective, and there's going to be less damage and impact because of cybersecurity issues. I think if people see that plan and can weigh in on it, that I think will ease a lot of the fears. That will turn down the resistance for the politicians to go, oh yeah, this makes sense. And now we're all feeling the pain, both sides, right? Unfortunately, there's very polar— big polarization, as you had mentioned. I think both sides, if they've got that plan, they can go, okay, this, this helps my constituents no matter what side of the— whether I'm red, blue, green, purple, whatever, this actually helps. I can get behind this and then we can move forward with that plan. But I think we do need that plan documented. And I think it's going to take the luminaries in our industry working with organizations like CISA to be able to document that and work with legislators to say, hey, this is how we get from A A to Z and everybody agrees.

Yeah, and I think, you know, the thing that can bring everybody together and avoid the political realities of this is this: Crime is bad and you making less money because you've had a ransomware attack and have to pay criminals is worse. And, you know, we go at it from an economic prosperity because it's pretty hard to argue against economic prosperity. There are some that I'm sure can find a fringe way of doing it. But I also think that it starts with getting in front of the audiences. So, this type of discussion, your ideas around this need to be keynotes at, you know, the BlackHats and the RSAs and get into a think tank that thinks the same way and wants to advance this policy because this is a case of I've heard about that Matthew guy and he seems to have some good ideas. Why don't we bring him up here for a little conversation? That's how it all begins, right? And that was, I think, my sort of American senator type of voice.

That was your senator. Okay, Mr. Thurmond.

Yes.

Good job.

Oh, you got that one.

Yeah, I did get that one.

But I think, I think what I'd like to say is thank you for having me on and thank you for, you know, the opportunity to kind of talk about these issues because I think the less rancorous and at times, you know, I think the unwillingness of people to like move their position on issues does not show strength. It shows weakness.

Yeah, I concur. I concur. And I want to thank all of you for watching. Be sure to subscribe and catch all the cybersecurity episodes where we chat with industry leaders like Ian here to dive into the most relevant and interesting and sometimes contentious cybersecurity challenges, perspectives, and best practices. Thank you, Ian. Thank you all. And we'll see you next time.