In this commentary, the speaker critiques the U.S.-led multinational meeting on ransomware, arguing that the joint statement released on October 14th—focused on resilience, financial disruption, and law‑enforcement cooperation—is politically safe but ineffective. He breaks down each of the three pillars, labeling resilience advice (backups, strong authentication, education) as basic and already long‑standing, the cryptocurrency‑focused financial measures as misunderstanding the decentralized nature of crypto, and the push for international law‑enforcement cooperation as insufficient against well‑funded, adaptable ransomware groups. The speaker underscores the scale of the problem, citing Treasury data tracking over $5 billion in ransomware payments, billion‑dollar profits for some crews, and high‑profile incidents like the Atlanta city outage and the Colonial Pipeline shutdown, emphasizing broader economic and societal impacts. He argues that passive measures only “bandage” the wound and calls for a bold, proactive strategy—specifically, prohibiting victim payments to cut off attackers’ revenue streams. The video concludes with a call for viewers to explore further videos on the proposed approach and to engage with the channel.
Chapters
U.S. leadership organized a meeting with over 30 nations to figure out how to address the growing problem of ransomware. The results were unimpressive. First and foremost, I want to acknowledge the fact that the executive branch recognizes the importance of the issue and has taken proactive steps to pull together a working coalition of nations. But at the end of the day, the leadership of the most powerful country with the greatest to lose from ransomware attacks has missed by a mile an opportunity to effectively crush ransomware in an expeditious and cost-effective manner. Overall, I am disappointed. The results of the meeting as documented in the joint statement released on October 14th, identify 3 main areas to apply focus: resilience to attacks, disruption of finances, and international law enforcement cooperation. All of these are politically safe areas, but pedestrian in nature and passive at best. Nothing bold, and even in aggregate Definitely not effective. The direction is largely responding to criminals' actions. Uh, the attackers have the initiative and they set the tempo. These recommendations are allowing that to continue instead of taking charge and cutting the heart out of ransomware. What is outlined is simply putting expensive bandages on the wounds that ransomware inflicts instead of stopping the attacks from occurring in the first place. Even adding more security does not stop the attackers. It just makes them adapt, which they are really good at, until they find the next weakest spot. In fact, everything recommended has been recommended previously and to some level over the past several years has been enacted with little overall impact. And let me be more specific here. Let's, let's break this down. First, the report recommends a number of resilience efforts such as backing up data, making sure you have strong authentication, social engineering education, and sharing industry best practices. Okay. These recommendations could have been crafted by a first-year cybersecurity student. They're the basics, but to date, they have not stopped the flood of attacks because attackers constantly adapt and find new ways to victimize their targets. At best, they can make it more challenging for attackers or improve the chances that someone else with lesser security will be targeted, but attacks will still occur. Secondly, the recommendations go on to target one of the favorite tools of ransomware, cryptocurrency. And although ransomware predates cryptocurrency by a decade, It's been widely adopted by criminals because cryptocurrency is decentralized in nature and it has pseudo-anonymity. In other words, it's non-traditional in the ways that it handles money transfers, and they chose that because it can make it very hard for governments to control. The recommendations here are not taking any of that into consideration, and they're approaching it like it's a traditional finance tool, a centralized organization that they can go after, and it just doesn't work that way. They just don't understand how flexible cryptocurrency can be, and This translates either into the fact that this entire recommendation is security theater, or the governments don't understand what cryptocurrency is, or they just don't want to talk about the fact that they can't stop cryptocurrency for the most part. Okay, thirdly, the coalition partners want better international cooperation for law enforcement. Again, this is a great general practice for all crimes. We've heard this for many years for all sorts of different criminal activities, and it's a really good practice, but it will not result in a major slowdown of ransomware, right? These criminals are well-funded, organized, and adept at maneuvering around law enforcement. So even if they are all working together, they can make it more difficult, but it's not gonna have a huge impact. Cooperation will help, but to be realistic, it won't be a crushing blow to ransomware. Law enforcement is on the tail end of attacks. What we need is to stop attacks from occurring in the first place. Now ransomware is a major problem and it's growing. A recent announcement by the US Treasury indicated that they tracked over $5 billion worth of ransomware payments. And this is in alignment with some of the ransomware crews self-reporting billion-dollar profits. Think about that. In some ransomware crews, have amassed more than a billion dollars. Highly motivated, right? Now they're well-resourced. They're not going to give up easily. And the ransoms themselves, tracking that, are really only the tip of the iceberg, as there is more loss associated with the downtime of these services and the loss of data. When the city of Atlanta was hit with ransomware Several million people were affected by a loss of city services. When the Colonial Pipeline was attacked and they ended up paying $5 million, the outage actually affected the fuel supply of much of the Eastern Seaboard. In fact, it spurred, um, consumers to go out and buy, and we had a shortage of gasoline because of it. So the impacts are much more The insane ransomware, uh, amounts that we see, which total in the billions, are not reflective of that bigger picture of loss. And ransomware is growing quickly. It's tripling or quadrupling or more every year, and it's set to dwarf all other types of cybercrime. And keep in mind, cybercrime already surpasses all other crime. As, uh, as an example, it surpassed several years ago, years ago, the global illicit drug trade, right? So this is a big deal, and these criminals are willing and well experienced in dealing with law enforcement and basic cyber hygiene practices and impediments to their financial tools. They're highly motivated and they will persist as long as there are large sums of money to be made. So we cannot act in such passive, complacent, and short-sighted ways if we want to effectively stop ransomware attacks from happening and to do so in a timely manner and a cost-efficient way. We must act with forethought and strategy— in strategic ways to take the initiative and undermine the attacks from occurring in the first place. It is possible. It's not easy, but I was hoping that with US leadership we could make the climb to rid ourselves of ransomware once and for all. Now, if you're interested in what such a path looks like, well, it involves disallowing payments to be made by the victims to the criminals, and that severs the flow of money to the attackers in one decisive action. I have a number of videos on the topic because it is controversial, and it covers what success would look like, examples of how such a strategy has worked in the past for similar situations, and the cascading effects of what would happen, kind of like dominoes falling, to get us where we want to go. It also covers how this could be applicable to a region or across the globe. I'll put the links to those videos in the description. Thanks for watching. If you like these cybersecurity videos, please click the like button, leave a comment, and subscribe to the Cybersecurity Insights channel. I put out a video about every week on various cybersecurity topics, risks, ideas, events, and best practices. Let's continue to communicate and collaborate together. That's how we make cybersecurity strong in protecting the global digital ecosystem.
