Schneier - Negotiating with Ransomware Gangs

Really interesting conversation with someone who negotiates with ransomware gangs:

For now, it seems that paying ransomware, while obviously risky and empowering/encouraging ransomware attackers, can perhaps be comported so as not to break any laws (like anti-terrorist laws, FCPA, conspiracy and others) ­ and even if payment is arguably unlawful, seems unlikely to be prosecuted. Thus, the decision whether to pay or ignore a ransomware demand, seems less of a legal, and more of a practical, determination ­ almost like a cost-benefit analysis.

The arguments for rendering a ransomware payment include:

• Payment is the least costly option;
• Payment is in the best interest of stakeholders (e.g. a hospital patient in desperate need of an immediate operation whose records are locked up);
• Payment can avoid being fined for losing important data;
• Payment means not losing highly confidential information; and
• Payment may mean not going public with the data breach.

The arguments against rendering a ransomware payment include:

• Payment does not guarantee that the right encryption keys with the proper decryption algorithms will be provided;
• Payment further funds additional criminal pursuits of the attacker, enabling a cycle of ransomware crime;
• Payment can do damage to a corporate brand;
• Payment may not stop the ransomware attacker from returning;
• If victims stopped making ransomware payments, the ransomware revenue stream would stop and ransomware attackers would have to move on to perpetrating another scheme; and
• Using Bitcoin to pay a ransomware attacker can put organizations at risk. Most victims must buy Bitcoin on entirely unregulated and free-wheeling exchanges that can also be hacked, leaving buyers’ bank account information stored on these exchanges vulnerable.

When confronted with a ransomware attack, the options all seem bleak. Pay the hackers ­ and the victim may not only prompt future attacks, but there is also no guarantee that the hackers will restore a victim’s dataset. Ignore the hackers ­ and the victim may incur significant financial damage or even find themselves out of business. The only guarantees during a ransomware attack are the fear, uncertainty and dread inevitably experienced by the victim.

from Schneier on Security https://www.schneier.com/blog/archives/2020/09/negotiating-with-ransomware-gangs.html