This is How to End Ransomware

We can end ransomware. It is possible, and it doesn't rely upon some security product or service. And I'm not talking about just ending it for one company or one industry or even one nation. I'm talking end it everywhere. It is possible to rid the world of ransomware attacks to such an extent that they are no longer a likely risk vector. Now, this is not a sales or marketing pitch, just an exploration of an idea by a cybersecurity strategist trying to highlight a path for the world to collaboratively end ransomware. But we all have to work together. And this idea, it starts with one simple concept and act to criminalize the payments of digital ransoms. It's a controversial proposal, so lend me your ears and I will convince you. I have the burden of proof to make the logical case to support this, and the solution is not pretty or easy, but it is far better than the alternative of being ever more victimized by cybercriminals. And no other strategic plan or option comes close to being affordable and delivering what we need to protect our digital ecosystem. So let's get started. The solution is straightforward. Pass a law to criminalize the act of paying ransomware extortion. We will cover why this one act will undermine the global risks of ransomware attacks. Now, in previous videos, I discussed who's behind ransomware, the three basic ways to stop cyber attacks, how ransomware is increasing in cost and impacts, and what the success criteria should be for any solution we evaluate to rid ourselves of ransomware. Take a look at those for more details, as I'm not gonna spend a lot of time on those in this presentation, but they are important foundations for this discussion. So I would recommend taking a look at those videos for a deeper understanding in the importance they play with this particular strategy. Okay, let's get started. First, let's level set on the relevance and complexity of the problem we're trying to solve. First, ransomware is a significant and important issue to address. It's, it's worthy of our time to discuss and tackle. Secondly, we're dealing with an intelligent set of adversaries. They are highly motivated. Creative and will aggressively react to actions that impede their success. They are adaptable and they will not go quietly nor surrender easily. We have to understand this. This is not a static problem. We're dealing with an intelligent adversary. Thirdly, ransomware is a national, even a global issue at this point. It can affect any single entity directly, but it can also affect millions indirectly. Just a single attack. And think about like critical infrastructure. If the power company, you know, gets impacted by ransomware, sure, it's just one company, but how many millions of people does that impact? The same thing with food distribution, water supplies, fuel distribution. We're seeing all of these So we're not trying to reduce the impacts to just one company or one industry. What we're talking about here is to help everybody who might be impacted by ransomware. That's what this strategy is about. And lastly, we need to do something to mitigate this growing threat. The status quo is not acceptable., and we can't stand by and continue to act as we always have. Ransomware has been around for decades and continued to thrive in the face of cybersecurity innovation. Better actions that are strategic and benefit from forethought must be taken. Okay, let's talk about success criteria because this is important. I covered it in a previous video, but we're gonna fly through this. Because we must also have clear goals that help us evaluate if any proposal is a good idea. So let's go over them quickly. So for any, uh, plan, strategic plan to end ransomware, first and foremost, it has to be effective, right? We're talking high 90s percentages that we want to reduce ransomware attacks. And that's a huge number given the fact that they're going up every year. We want to cut it down, down to the bone, take out at least 95% of those attacks. Secondly, timeliness. We don't want to wait, right? This is going up every year and it's impacting more and more people every month. We want to have a plan and hit that effectiveness number within 2 to 3 years tops. And again, keep in mind, this is a complex problem that has many different dependencies. So 2 to 3 years may seem like a long time out, but not for this level of complexity. It's actually very aggressive. Thirdly, it has to be affordable, right? There needs to be an ROI within 5 years. And what that really means is we need to be spending less on security than what we're saving from risk mitigation. So there needs to be a return on that investment. Usability. We need for any solution to make sure that there is minimal friction to the people, the businesses, the industries, and everything else. We know anytime we implement security or controls or whatnot, there always is a cost in that friction for the users or the people, uh, managing, but we want to keep that low. We've got a goal of about 5%, but it really should be much less, and this proposal Over time, it gets much lower than that. Okay, lastly, sustainability, and this is crucial. We know those intelligent attackers, they're going to adapt, and they're very good at it. They've shown throughout the years how good they can be. So whatever we come up with, the benefits must be reliable over time. It must work with anticipation of how the attackers will adapt. That's a tall order. It really is. But here's the plan. We criminalize ransomware payments. Yes, that means passing a law that says anybody who is paying ransomware is committing a crime, can be prosecuted and sent to jail. You are materially supporting, you are paying for, and financially aiding crime. That's it. And it may seem odd. I get that. But in doing so, it will set in motion a series of events that will undermine global risks of ransomware attacks. In fact, this proposal will satisfy all of that success criteria that we just talked about, and it will do it in a way that is better than all the other plausible ideas. To understand why this works, we really must think strategically over time, like playing a chess game. We must look at many moves ahead and give no maneuvering for our opponent. Like a chain reaction or a series of dominoes falling one after another, implementing a single law that criminalizes the payments of digital extortion starts us down a path that will gain momentum and result in the dramatic reduction of ransomware. And it can be broken up into 3 phases: where we enact the law, which results in money really not going to the hackers anymore, the attackers then respond, and if we thought ahead with that first phase, they will ultimately adapt their attacks to shift away from US targets. And we'll get into why in a moment. This really is because they're not receiving financial rewards for their actions. So they're going to go elsewhere. And that leads us kind of to the last area where the rest of the world becomes a better target and a focus of the attackers. And when they realize that, well, then the other governments step up and they also adopt a similar strategy of outlawing ransomware payments. The attackers with very few victims that they can go after, it just doesn't make economic sense. There's no reward. They then move on to other cybercriminal activities, ones that have been around for a while, but that are less impactful to the community. And frankly, they're easier for people and organizations to defend. These are the areas that attackers have left because ransomware is so much better. They're probably gonna go back to those. But let's look at this story in more detail so we can actually see the nuances and the dependencies. And it breaks down to 10 steps. First, step 1, a law has to be passed. It has to be a national law within the US that criminalizes the payment of digital extortion. And as part of that, it's slated to actually go into effect 12 to 18 months later, right? That's a grace period, and that grace period is very important because it gives organizations out there— critical infrastructure companies, businesses, individuals, whatever— it gives them time, and it also motivates them to say, hey, go take a look at your environment, do a risk assessment, understand what those risks are, realize you're not going to have an option in 12 to 18 months to actually pay the ransom. So implement prevention and/or recovery measures, whatever makes sense for your business or organization, right? But it gives them the time to do that, and that also provides additional benefits, right? Organizations then get an overall uplift to their security posture and their visibility and everything else that helps them against other types of cyber attacks as well. So this is a motivation to get companies to be able to follow those basic rules, to be more in tune, to take more responsibility of security. This is that first step. So there are additional benefits, but this is just step 1. Step 2, is when the grace period ends. And we do absolutely expect that there will be a ramp-up. Ransomware organizations are going to see that that's going to come into effect. They know there's going to be friction in trying to get money from people and companies. So prior to that, they're going to try and attack a little bit more, right? So there's going to be a rush on it. But at least right now, their capability to scale and deliver this type of attack is less than it will be in a year or 2 years or 3 years or 5 years down the road. So we're hitting them with this and they've got a window of— a smaller window of opportunity, but we know they're gonna try. But at the end of that grace period, the regulations take effect, which means if a company does pay for it, pay ransom, right, those executives that were part of that decision Well, they've committed a crime. They can be arrested, right? Somebody can whistle-blow on them, right, and get a reward. And by the way, federal whistleblowing benefits are about 30% of the take. So if it's a, you know, a $20 million ransom, that insider, that whistleblower, could get a huge windfall of money. So again, it puts natural tension in the system. And the reality is, companies, for most regulations where there's just an economic penalty, they look at it as a cost-benefit analysis. Should the company go down path A, and if they get penalized, pay a certain amount but gain business, or should they follow the regulation on path B and get less revenue? It becomes an equation of whether they're willing to pay the penalties. In this situation, we avoid all of that because there is a person or group of people that are on the hook. It's the executives that are making the decision that have culpability. They're aware of the decision. They're supporting it. They're the ones that can get arrested and go to jail. And so it isn't a matter of, oh, we'll pay a little fee. No, executives have to consider the fact they may be incarcerated. That changes the equation. That completely shifts organizations from, let's see if it's financially viable to apply or comply or not, to, yes, I don't want to go in jail, I don't want to be behind bars, we're not going to do it. So the compliance level goes up significantly. In fact, I would expect all legitimate businesses to comply with this. And again, there's the whistle— whistleblower aspect of it. Um, being impacted by ransomware, it becomes pretty obvious, right? And trying to take millions of dollars and siphon that secretly to pay off some criminal organization, that can easily be tracked. And even if you do do that and you get that key, Well, you need to have very technical people use that key to decrypt files within your organization. So you've got these technical people now that it becomes obvious. Well, where did you get this super encrypted key? You didn't guess it, right? So it becomes really obvious, and any one of those people can, you know, whistleblow, can raise the awareness, and, and again, executives would be in dire straits personally. Now, there's also one other motivation to absolutely not do that, because the moment that somebody pays the extortionists, the ransomware attackers, right, who are extorting money from you, the moment you pay them, they now have something even better. They can hold above your head the fact that you committed a crime in paying them. And if you paid them with cryptocurrency, by the way, it's on a blockchain, probably a public one, and they can prove that they received the money from you. So they're then going to extort you, the person that paid it, well, forever. They'll simply say, you're going to keep paying me those payments or I'm going to alert the authorities. I'm going to publish the fact that you paid. And show the proof, and you're going to jail. So you either pay me and continue to pay me, or you go to jail. And who's gonna trust the extortionists? They're going to do this. This is a bigger and better payday for those who do choose to pay them. So this is an important element in step 2. Companies aren't gonna pay, and that means also insurance companies. They're gonna apply— comply with the law. They're also not going to pay. And any organization, third party, that spins up in some other jurisdiction and companies try and go through them, again, it's something that can be tracked and it's something that a particular person can be held accountable for criminal charges, you know, export them back to the US if need be, you know, and criminalized. So again, step 2 is hugely important because it leads to steps 3, and that's really where the money flow, the major money flow stops. It doesn't get to the cybercriminals anymore. These tens of millions of dollars from single attacks aren't going into the coffers of the attackers. That's their big payday. Ransomware started with trying to extort, uh, small amounts of money from individuals, and that wasn't very, very profitable and rapidly moved into attacking small and medium companies and then large companies and organizations, critical infrastructures, things of that sort, where you get big paydays, $50 million, $100 million, $40 million, all these kinds of things. And that's where the money is. And that's what these attackers have been pulling in. It's insane money. But when we get to step 3, that spigot is turned off or, or mostly turned off, and it has some profound effects. First off, attackers in doing these attacks, they spend some of that money on research and development, and they use a lot of that money to build up their internal technical operations capabilities. They have to have servers and web domains and databases and all these different things, uh, as part of their infrastructure. You take away the vast majority of money and they don't have the millions of dollars to discover or purchase zero-day vulnerabilities. They don't have the money to spin up at a moment's notice these infrastructures to support the command and controls and everything else necessary to manage it, or to go out and to recruit new people, right? They call them affiliates that help distribute this. So this greatly reduces the agility and the tactical resources of our opposition. That's a very good thing because what it does is it slows down the innovation of the evolution of ransomware because it's constantly changing. Right now it's changing at such a fast rate, the security companies cannot keep up with it. But you take the money away and that agility, that innovation begins to slow down very, very quickly. So that's important. And the other aspect is, on the rare occasion that governments and law enforcement do take down an infrastructure— and it happens We've had some great wins where a law enforcement agency will take down an entire server infrastructure or database, or— and you're talking tens or even hundreds of servers and potentially thousands of domains and websites. And yet the attacker returns within a couple of weeks. They've rebuilt their infrastructure. Why? Because they have the money to do it. You start taking away that money And now it's tougher for them to do that. Maybe they can't do the whole infrastructure or just some of it now, maybe some more later, right? But you're putting pressure on them because you're taking away their resources. And this is where it all starts to happen. In step 4, well, we know the attackers, they're not just going to sit back and take it. They're intelligent, they're aggressive, they're going to defend the millions and tens of millions of dollars that are coming in. They're going to get vicious. They're going to respond. They're going to try and adapt just as they have before. Whenever a new security tool or a new methodology comes out, they adapt. Whenever a zero-day is closed or vulnerabilities are patched, they adapt. They're going to adapt this time as well. But we need to ask, how can they attack it? Because it's It's not technical in nature, right? This is a decision by the victims not to pay because of the criminal consequences to them. So what's likely going to happen is they're going to try and raise the stakes and threaten even more. If you don't pay, we're going to release your data, we're going to embarrass you, we're going to hack you even more, we're going to do all these terrible things. But ultimately, all those threats they really pale in comparison to an executive in their comfy chair going, I don't want to go to jail, right? My stockholders in the government say I can't pay, therefore I just can't. It's just not on the board. I just can't do it. It's not an option. So those threats, they will fail because the consequences of incarceration, criminal prosecution, that's just too great. No company, no executive is going to want that. And the chance of hidden payments also is really, really low because of what we talked about before. It's tough to hide it. It becomes obvious when you're impacted. Miraculously appearing with a decryption key is really suspicious. Payments can be tracked, and the extortionists are probably going to blackmail you anyway. So, you know what, it just doesn't make sense. And that one whistleblower that does raise the alarms and report it to the government, they're looking at a 30% gain on whatever you're paying, whatever that penalty is, right? So again, it just doesn't make sense in any way, shape, or form. But we know the attackers will try and adapt. In this way, it's not technical. It is trying to change the decisions to motivate people to violate the law, commit a crime, and pay the ransom. And it's simply not going to work. And that leads us to the next domino that falls in this cascade. Attacks begin to decrease. The simple fact is, if it's a US victim, they're not going to pay. Cybercriminals are many things, many bad things. But they're rational. They realize they don't want to spend effort and time and resources on something that's not going to return a benefit. Benefit they want is that personal financial gain. And if US targets are not going to pay, well, where else can they go? And that's exactly what they're going to do. They're going to shift attacks away from US targets. To, well, other countries, other geographies that will pay. And they're also gonna— some of them are gonna go back to other types of fraud, credit card fraud and theft and clickjacking, all sorts of other things, right, that they're used to, that they're familiar with. Some will already start to migrate there, but most of them, they're gonna go where the victims are, right? It's the Willie Sutton principle. Willie Sutton was a bank robber, and he was asked, you know, one day, hey Willie, why do you rob banks? And although he was misquoted by the, by the press, basically the Answer was, that's where the money is. And if the money is no longer with US targets, the money is overseas in Europe and Asia, that's where the attackers are going to go. It's as simple as that. It is human nature. We go into step 6, because when the US— where most, by the way, most of the cybersecurity tools and services and everything are created and maintained, some of the biggest cybersecurity companies companies are here in the US that fight and, and protect our data, including against ransomware, or try to, right? They're here in the US. When the attacks begin to shift away from the US, it gives those companies a little bit of breathing room. Think about it. Their opposition, these attackers, for years, and especially now, are getting a huge influx of money for R&D and are constantly innovating, and they have the initiative. And so it's just a— you're just fighting fires one day after the next. You can never get ahead. But with the reduced pressure now, it gives these cybersecurity products and service vendors an opportunity, right, to be able to innovate better, and in some cases ahead of the attackers. And the other thing it does, because we've got this reduced amount of money and R&D on the attacker side, it tends to consolidate the types of attacks and vulnerabilities that are used. And that's a smaller surface area that the cybersecurity firms really have to deal with. Again, it gives them the opportunity to improve their overall effectiveness. And in the same vein, it also gives that breather to law enforcement. Can you imagine yourself in law enforcement right now getting all the reports from all the companies saying we have ransomware, we have ransomware, it's happening tens, hundreds of thousands of times a year, and just getting those flood of reports and having to deal with all that, you get very little time to actually do something meaningful. And understanding in that massive cloud how they're all connected and who's behind these big— it becomes very difficult. It becomes fuzzy, clouded. But when you start taking away from those attacks, the picture becomes more clear, and it allows law enforcement to start see, okay, who are the groups that are still in this space? Let's focus in on them and their tactics and their infrastructure and their software. And again, it can help improve the effectiveness of what law enforcement can go after. And that's a good thing. That between the cybersecurity firms and law enforcement, that simply adds more positive pressure to protect and respond and lower the number of attacks coming into the US. Now we get to an interesting point in step 7. By the time all of this comes into play, we can start seeing and measuring from a qualitative and a quantitative perspective the benefits of what's going on. We've seen the trend of 200 to 300% every year growth for ransomware. By this time, we should see that completely reversing the trend and taking a nosedive. And that's important because it's newsworthy. What's most important a part of that, a certain audience that will be listening in. And right now we've got 4 to 5 million internet— or billion internet users. We're going to have another billion internet users coming on board. And the next billion internet users, many of them are going to be from regions and countries that don't earn very much a day. In fact, half— more than half of the world earns less than $20 a day. But we're going to see a lot more people coming onto the internet that are looking for opportunities to make money. And right now, ransomware, right, especially ransomware as a service, which is a type of ransomware where you can attract affiliates, right, entry-level criminals that don't need to have any technical skills at all. They just need to be able to send emails or send text messages, right, with infected links. That's all. And the bad guys who run the infrastructure behind it take it from there. And they will give a slice of that profit if the victim pays back to that affiliate. That's very attractive to these non-technical, and some of them are technical, but people that are joining the internet, and we don't want them to become cybercriminals. We want the message to them to say, this is a dead-end road. You're not going to get paid. It's going to be a waste of your time, and this is not where you should be looking to add to your revenue. Find something else. We can sidestep a huge problem. Vast numbers of entry-level criminals coming in and turning to cybercrime, especially ransomware. We can get those out before they even come in. So this is a very important step because if we are not successful in the next couple of years, the number of those affiliates that are sending out the emails and, and doing social engineering and making phone calls and and all of that is going to double and triple and quadruple. We are going to have so many problems, and it will be near impossible to not eventually get tricked into getting sucked into ransomware. Eventually it will happen. So we have to get those attackers out of the equation and do it soon. With less of those affiliates that are attracted, those entry-level people Well, that poses a problem for the attackers because these ransomware-as-a-service operations, they rely on these affiliates to come in and they just give them the links to, to, you know, send out to infect people or get people to click on or open. But without them, they lack a good distribution method to get organizations and people infected with their ransomware. So that becomes again another pressure for these ransomware-as-a-service super organizations, which by the way, when you look at organizations like DarkSide or REvil, they're making $90-100 million a year. But again, they rely upon their affiliates. With the drop of affiliates, that just adds another problem, another headache to these super organizations, criminal organizations that are doing ransomware. That again is another good thing. The next step, right? The next domino that falls, well, the attackers get the message, right? They realize US organizations, they're not paying, so we're not gonna target them. They realize that now they don't have the vast amount of money for research and development and buying zero days or building infrastructure, so they have to be very economical chemical and tight. They're not getting the affiliates that they need to distribute this. The law enforcement is getting better and so are now security firms. Ah, okay, time to shift. Let's abandon the US. Let's go after the businesses in, in the other areas. And we're gonna see a massive drop. There's just gonna be now a trickle of attacks, probably accidental, that are targeting US companies. Because all the ransomware people— and they do talk with each other, these organizations talk and work with each other, um, and sell information and everything else— when the word gets out, it's pointless to attack U.S. firms. The word will get out and people will change. These attackers will shift very, very quickly. Again, they're very adaptive, so they will shift and they're going to start attacking other nations, probably exclusively. And the other nations are going to see this. They're going to start feeling the pain. Their critical infrastructure is going to start going down and being targeted, and their government agencies, their schools, their hospitals, their water supplies, their food distribution, all of that— they're going to get the message real quick. And they're going to look towards the US leadership position in there going, we need to do that too. And there's going to be very little debate because it's going to be proven. We're already going to have the metrics. We're already going to have the messages out there. You're going to be able to see the gains. So yes, other governments, guess what they're going to do? They're going to follow suit and they're going to implement the exact same laws that say, hey, we're making payments for ransomware illegal because we know this works. And the last step, this is my favorite one. With, from an attacker's perspective, with a shrinking target pool, with now really no countries, uh, or, or, or good targets out there that, that are going to pay, it's time to walk away from ransomware. Ransomware becomes history. The attacks on a global scale now decrease at the same rate that we saw them, or even faster than what we would have seen in the US. And cybercriminals, well, they still are motivated by personal financial gain. They still want money. They're still going to do illegal things and they're going to shift away from ransomware. Yep, absolutely. They're going to go off to other things. They're going to go back to credit card fraud and theft and forgery and all those other areas that they're currently in now, but they've chosen ransomware because it's a lot more lucrative. They're going to have to go back to those. And for those areas, our security is actually pretty good, right? And those types of outages and attacks, they don't scale in impact like ransomware does, right? Stealing data and selling it for pennies a record on the dark market, yeah, that doesn't bring the electricity down. Doing credit card fraud or opening up fraudulent loans and medical fraud using personal health information and personal finance information, that doesn't stop the flow of fuel across the nation. That doesn't shut down hospitals in regions. So the impacts of are less scaled and the security around those are a lot better. So we want them. We want— the good guys want the criminals to migrate back to those other areas. And yeah, they're still going to win, but the amount of money they're going to win and, and be able to fleece is going to be much less. And more importantly, the impacts on a national, on a society, on a global level become much more compartmentalized. So that's hugely important. At the end of the day, right, criminalizing ransomware payments will set in motion these events, and it will undermine those global risks right now for ransomware attacks. This doesn't help just one company or one industry or one nation. These events, these cascading events, help everybody as part of the digital ecosystem everywhere in the world. Just like I stated in the beginning, this path will satisfy all the success criteria that we talked about. Effectiveness, timeliness, affordability, usability, and sustainability. Not all of you are going to be convinced. I get this. You won't be convinced of this strategy no matter what I've said. In fact, you probably even have a reason in your head why we should not criminalize ransomware payments. And I would wager whatever that argument is, it's probably on this list you see right here. Now, I've been discussing this idea with many experts across multiple, uh, domains and addressing all of these arguments that have been posed that say this is a terrible idea, we shouldn't do this. So in my next video, I'm going to go through each one of these to explain why these arguments aren't good ideas or how the perceived barriers to success will actually be overcome. If you have doubts, don't miss the next video. And if you have a good argument that's not on this list, let me know. Drop me a line, connect with me on LinkedIn, and send me a message. I'll add it to the list, and I'll address it in the next video as well. Thanks again for watching. We can all make digital technology more trustworthy, secure, private, and safe. When we communicate and work together. So leave your comments, and I appreciate them all— good, bad, and ugly. And feel free to share the video. Be sure to subscribe and catch all the weekly videos on the Cybersecurity Insights channel, and I'll see you next time.