BrianKrebsDec 15, 2023

I've grudgingly come around to the notion that there is only one way out of the ransomware problem: Make paying a ransom illegal. This is not very different from laws that make it illegal for US companies to pay bribes to foreign officials.

I really don't see any other way out of this mess. Yes, some victims will unfortunately ignore any laws that say they can't pay, but enforcement probably will not be hard.

What will be difficult are the situations where peoples' lives are at stake in ransomware incidents This sounds callous, but we can't afford to take the short view here anymore, and our other alternatives aren't great either.

I'm quite certain this is an unpopular view, but we have already seen the cost of doing nothing. At least in the interests of congruity for our financial sanctions vs Russia, we should probably make this change sooner rather than later.

Show threadBrianKrebsDec 15, 2023
I really admire what Bruce Schneier has said about the pay-or-not-pay debacle that ransomware puts companies and individuals in. Because it aptly summarizes the counterpoint to outlawing the payment of ransomware: I'm paraphrasing from memory here, but it was something to the effect of, "it's your data, or your daughter." In other words, the imperative to pay is directly related to your skin in the game.
Show threadBrianKrebsDec 15, 2023
In re the "how ransomware could possibly get worse" response, I have two scenarios (which we have already seen in the playbook/arsenal of ALL of the regimes already mentioned): Deleting data (forget ransoming it: you already pwn the servers); corrupting it (holy crap what blood type is this patient????).
Show threadRandom Damage 🌻

@briankrebs the second case is why EHR is one of the few good uses for blockchain

When you absolutely must be able to verify the validity of a document

Also a great reason for off-line backups to become standard again

Dec 15, 2023 at 2:17amWeb
Show threadMikeasaServiceDec 20, 2023
@RandomDamage @briankrebs
Since data can’t be changed on the blockchain, the method of updating information works be replacing old items with new. What’s going to stop the hackers from putting bad new (superseding) info on the blockchain?