In this monologue, the speaker outlines the escalating global ransomware crisis, describing how attackers encrypt victims' files, steal data, and extort payments—often demanding cryptocurrency—resulting in an estimated $20 billion annual loss. He critiques popular but ineffective proposals such as outlawing cryptocurrency, arguing that criminal actors will simply adapt to alternative payment methods. Instead, he advocates making the payment of ransom or extortion illegal, citing the U.S. Treasury’s OFAC sanction regime as a precedent. By criminalizing ransom payments, victims would be forced to invest in preventive security, the attackers’ financial incentive would be undermined, and international pressure would build as jurisdictions adopt similar laws. He acknowledges that this measure won’t eradicate ransomware entirely—attackers may still sell stolen data—but asserts it would dramatically reduce the problem by removing the attackers’ primary objective.
Chapters
Today we're going to talk about ransomware, and it's going to be a little bit of a rant, so, so bear with me as I am frustrated with some of the ideas that are floating about to address ransomware. But stay with me because I will be outlining a practical maneuver that will help stop ransomware on a global scale. So first off, right, ransomware, well, it's the scourge of the digital world at the moment. Individual businesses, both large and small, and governments across the globe are being impacted. Ransomware attackers who are normally cybercriminals infect victims' computer systems and modify files in a way that, well, they're just not accessible any longer to the rightful users. Most of the time it's done just by encrypting them. Then they extort the victims to get the keys back to unlock those files, and the price can be a few hundred dollars and range into the tens of millions. The average is right around $100,000 for businesses. So this is quite profitable for the attackers, and the, the current preferred Method of payment happens to be cryptocurrency, and we'll talk a little bit about that in a minute. Now, the latest tactics is also for the attackers not only to encrypt the files, but also to steal the data. And if there's any hesitation at all by the victim, they then threaten to make that data public if they're not paid. Sadly, many individuals, organizations, and even government agencies are paying the criminals. Often cyber insurance policies are used to cover the extortion costs. About 40% of all cyber insurance claims are related to ransomware. Regardless, this only reinforces the bad behaviors and adds to the problem. When the attackers get what they want, they continue to pursue victims. It just, emboldens them. The world of ransomware is now swelling out of control, and currently it exceeds $20 billion per year. And personally, I believe that's a conservative estimate, as a lot of ransomware attacks, they go unreported. Unfortunately, I'm hearing of some ineffective solutions being proposed. The one that bothers me the most is to outlaw cryptocurrency. Now, let's keep in mind, personally, I'm a fan of cryptocurrency as they represent a tremendous set of benefits for freedom and financial equality and equity around the globe. But that's not the reason I'm annoyed with this proposal. The simple fact is that outlawing cryptocurrency is not a real solution. It's, it's a speed bump at best. It would just create a barrier that the attackers would then go off and address some other way. And attackers, they will adapt, especially when there's this much at stake. Now, online extortion, it existed long before cryptocurrency did. Cybercriminals, they will find a way, just like phone scammers today have victims send cash or buy gift cards or do something else. Removing crypto from the picture will not deter these ransomware attackers. Yes, most ransomware campaigns do currently use cryptocurrency as an easy path for payment, But correlation is not causation. Cryptocurrency did not create ransomware or digital crime. The reality is only a very, very small percentage of cryptocurrency transactions are actually related to crime, with the latest data showing it's a mere fraction of 1%. Cash, on the other hand, is actually used a lot more and is more preferred in criminal activities. If we want to crush ransomware, then outlaw the payment of ransom or extortion. Make it illegal for victims to pay the attacker. It's that simple. Overnight, that will have a sweeping impact on ransomware because it removes the attacker's objective, what they're pursuing. When people don't pay, it will undermine all the malicious effort that the attackers have to go through. Now, there is a precedent here. In fact, the U.S. Department of the Treasury, their Office of Foreign Asset Control, OFAC, they actually announced last year that paying ransom to cyber criminals is now illegal where those assets would be funneled to sanctioned organizations or countries. Basically, we're talking like embargoed nations, despot regimes, terrorist organizations, and so forth, because they're using ransomware to fund their activities. So when a victim pays a ransom, they may actually be funding terrible acts. So let's just write a law that states it's illegal to fund criminals, and that would include, including paying any extortions and ransom. Make it illegal to pay ransomware. Now, although this won't solve the problem entirely— there is no perfect solution— it will have many positive effects. Let's think about this for a minute from a strategic perspective. If we outlaw straight out outlaw paying ransomware, organizations without the ability to pay their way out or buy insurance that will pay, they're actually going to be forced to invest in better preventative security. And that's being proactive versus reactive. The second thing is by greatly reducing the number of victims that will pay, it fundamentally undermines the primary motivation for attackers, their financial gain. For countries that institute such a policy first, well, they benefit the most, as the attackers will simply shift to countries that haven't adopted such a policy. They're going to follow the path of least resistance, and that shifting will create tension and pressure, and this will create a chain reaction forcing other countries to also follow suit. Now, although this is not a complete solution, as adapt— attackers will still, uh, siphon data off and probably attempt to sell it on black markets and things like that, it will overall have a huge positive impact. So let's stop vilifying technology and start addressing the root of the problem. Take away an attacker's objective and they often cease to pursue those actions. So less outlaw paying ransomware.
