When it\ncomes to ransomware, malware, and hackers, the government is finding it\ndifficult to keep pace with the quickly evolving landscape of cybercrime. And\nsometimes, the government seems to be going after the good guys instead of the\nbad guys, as evidenced by the recent CoalFire debacle in which Iowa arrested\nand charged the same cybersecurity professionals it had contracted to try to\nbreach the state\u2019s security systems.<\/p>\n\n\n\n
As a criminal\ndefense attorney, I\u2019ve been involved in myriad cybercrime cases. There were the\nDDoS attacks<\/a> on the Church of Scientology, and then the infamous Blackshades\nmalware allegedly used to spy on Miss Teen USA. We defended a sports gambling software company\naccused of conspiring with the mob<\/a> abroad, which went to trial and was ultimately dismissed.\nLater, we handled a cryptocurrency hacking case, an online currency arbitrage\nplatform; and, more recently, the allegedly illegal deployment of scores of\nBitcoin ATM machines around high crime neighborhoods \u2013 to name a few.<\/p>\n\n\n\n In most\ncases, it\u2019s at least apparent why prosecutors are focusing on our client. But\nin other cases, prosecutors are barking up the wrong tree\u2014they\u2019re going after\nthe targets they can find instead of looking for the actual bad guys. After all,\ncareer hackers can be nearly impossible to track down and apprehend. In the\nsports gambling case I handled, my client reported that the New York district\nattorney\u2019s office wanted to strongarm him into hacking into his clients\u2019\nsystems to turn over personal data on gamblers and their bookmakers who may be\ninvolved in illegal gambling.<\/p>\n\n\n\n Another area\nwhere prosecutors seem to be struggling to find and prosecute the right parties\nis with ransomware attacks. If you should fall victim to a ransomware attack,\nbe very careful how you navigate your crisis. And that goes double for those\nwho try to help you. The government may be looking to indict you both. And the penalties<\/a> are steep.<\/p>\n\n\n\n Let\u2019s hash it out.<\/span><\/p>\n\n\n\n Ransomware\nbrings companies to their knees in an instant as it encrypts user data and\nfiles irretrievably. In some cases, the only way to resume business as usual is\nto pay the ransom outright and most of them only take crypto.<\/p>\n\n\n\n You show up\nto work to find a message like this one filling all 100+ displays of your\ncompany\u2019s employee workstations. Your CTO and IT administrator are in a panic. Your\nentire company has been locked out of its servers, computers and files. The company\nstands to lose hundreds of thousands of dollars each week that this persists. There\nis a countdown clock on the monitor, and IT cannot find any way to access the\nsystem. All you can think is, \u2018What would Kiefer Sutherland do?\u2019 <\/p>\n\n\n\n It\u2019s day two\nand the losses have already exceeded $40K. Clients are taking flight as they\nfear the worst. Employees are asking whether they should come to work, and the IT\ndepartment is pulling its collective hair out. You wonder what you have them around for if\nthey can\u2019t fix your computer-related problems. Arnie, Head of IT (for now), has\nresorted to Googling (from his personal cell phone) \u201cransomware help\u201d to look\nfor outside companies that might be able to lend a hand. <\/p>\n\n\n\n The 5 bitcoin\ndemanded hasn\u2019t yet increased, but it might as well have because the volatile\nbitcoin market has already added $5,753 to the price (some companies are\nstarting to keep an emergency bitcoin account to offset the risk of price\nfluctuations). <\/p>\n\n\n\n Someone\nreminds you that you have business insurance that may cover this sort of thing.\nYou call your insurer. They do in fact cover ransomware attacks and have a list\nof \u201capproved providers\u201d aka cybersecurity firms who can help.<\/p>\n\n\n\n It looks as\nthough all that panic-driven Googling may have paid off. Arnie has already\nfound a cyber security firm and is on the line with them. As luck would have\nit, this firm is also on your insurance company\u2019s \u201capproved provider\u201d list. The firm thinks they may be able to resolve\nthe problem remotely. But when asked, they admit that no one can actually decrypt\nthe files. More pointedly, if you were\nto marshall the combined forces of Homeland Security, the NSA, M.I.T., Kaspersky\nLabs and Elliot Gunton to the singular purpose of retrieving the electronic\nfiles of your trading house and photos of your mini labradoodle wearing a tutu,\nthey would all wind up with zilch. That\u2019s how hard it is to unencrypt what\u2019s\nbeen properly encrypted. <\/p>\n\n\n\n So how can\nthis cybersecurity firm help? <\/p>\n\n\n\n Pay the\nransom, of course. <\/p>\n\n\n\n So then, what\ngood are they? Well, for starters, they have a bitcoin wallet on the ready. You\ndon\u2019t. Secondly, they actually know how to deploy a decryption key. You don\u2019t\n(and neither does Arnie). <\/p>\n\n\n\n Turns out\nmost ransomware, eh hem, artists don\u2019t restore your files for you when you pay\nthe ransom. They merely send you a key. Technical support doesn\u2019t exist. It\u2019s\ndo it yourself. And you wouldn\u2019t want your attackers fixing it for you even if\nthey offered. <\/p>\n\n\n\n Here is why\nit makes sense to hire the cyber security firm rather than pay the ransom\nyourself in a nutshell:<\/p>\n\n\n\n All good? Not so fast. Now the cyber security firm\u2019s principals and employees are contacted by the FBI\u2019s Cyber Division. The U.S. Attorney\u2019s Office wants to talk about a turn-in date and because they know this is a real company with generally law-abiding individuals, they wanted to call and invite them in to \u201cself-surrender\u201d so they can forgo the unpleasantness that comes with a 3AM home arrest warrant execution. \u00a0<\/p>\n\n\n\n Looks like\nyour company\u2019s savior is going to need to hire a great criminal defense\nattorney.<\/p>\n\n\n\n Why? Turns\nout the government doesn\u2019t look kindly on paying ransoms. The reasons\nthemselves are not objectionable: <\/p>\n\n\n\n But the\ngovernment also knows that juries don\u2019t like to convict victims for paying\ntheir extortionist. It\u2019s like arresting the mother of a kidnapped child for\npaying the kidnappers their ransom to get her baby back. <\/p>\n\n\n\n It would never fly. <\/em><\/p>\n\n\n\n Lost\ncomputer files, lost business revenue and even stolen intimate photos are less\nsympathetic reasons to sponsor a crime cartel than say, getting a real live\nchild back. But, just the same, the DOJ doesn\u2019t like to lose. And prosecuting\nvictims is a losing strategy. So, for now, victims can (probably) pay ransoms\nback directly (as ill-advised as that is) to their attackers. <\/p>\n\n\n\n But if you\nhire an intermediary, that\u2019s where the government is testing a prosecutorial\ntheory. The theory is if they can prosecute the cyber firms who pay the ransoms\nthen they can get a pelt for what they view as an ugly business. Hey, somebody\nhas to pay. Cybercrime is the new bank robbery and it\u2019s turning into an\nepidemic. The government\u2019s so-called ransomware \u201cexperts\u201d are in the stone\nages. But prosecuting cyber security firms makes it look like they are doing\nsomething about this epidemic (spoiler alert: they aren\u2019t).<\/p>\n\n\n\n Strangely\nenough, the FBI has made multiple statements encouraging or allowing companies\nto pay off ransomware attacks:<\/p>\n\n\n\n They haven\u2019t yet publicly announced a policy of indicting companies for paying ransoms or started issuing mass indictments. But they are hovering around the periphery, looking for instances where they think they might be able to dirty-up the white knight cyber security firm to make them a public example of the perils of paying ransoms as a business model. <\/p>\n\n\n\n What if they succeed? What does that accomplish? It doesn\u2019t stop the ransomware attacks. It doesn\u2019t stop the victims from paying those ransoms directly. But it takes out a middle man would-be protector, leaving the victim to their own devices.<\/p>\n\n\n\n If juries\ndon\u2019t like to convict victims, how would they feel about their heroes? As a\nmatter of public policy, do we want to criminally prosecute the saviors of\nthose who have otherwise irretrievably lost their businesses? <\/p>\n\n\n\n The answer\nis it depends<\/em>. We should not criminalize the only people that offer any\nprotection whatsoever to the victims of ransomware. They also provide a\nmechanism for insurance companies to insure the losses of such an attack. The\ngovernment is putting this in jeopardy (more on this to come). In order to make\na white knight prosecutable, the government needs to shift our view of them. The\nprosecution will want the jury\u2019s perception of the white knight to be that of\nan opportunistic broker of shattered dreams. Instead of saving their victims\nfrom further attack, they provide a surcharge to further exploit them. As\nridiculous as this sounds, this is what in fact is being kicked around at DOJ\noffices everywhere. <\/p>\n\n\n\n So, if the\ncybersecurity firm is recommended and, in some instances, paid for by the\nvictim\u2019s insurance company, doesn\u2019t that make said insurance company an\naccomplice in the conspiracy to pay ransoms to possible crime cartels? After all, the insurance company knows exactly\nhow the cyber security firm addresses the problem – by paying ransoms. So, will\nthe government start prosecuting Allstate for providing ransomware protection\nto its insureds?<\/p>\n\n\n\n Probably\nnot. <\/p>\n\n\n\n But, by\ntaking the cyber security firm out of the equation, it would force the\ninsurance company to pay the ransom to the insureds or even worse, pay it\ndirectly to their attackers. Knowing that would result in potential\nprosecution, they would have to stop insuring businesses and individuals from\nransom attacks all together, compounding the victim\u2019s losses exponentially. <\/p>\n\n\n\n So if the\nreasons listed above are all valid reasons why you SHOULD hire a cyber security\nfirm in a ransomware attack and if billion dollar insurance companies are\nrecommending that their insureds hire these companies (knowing full well that\nthose companies will pay the ransoms), then how in the world can the government\nlook to criminally charge these very same companies for doing what it has\nfailed to do – rescue victims of\nransomware?<\/p>\n\n\n\n For now, the government is limiting its\nprosecutorial powers to low hanging fruit; looking at smaller cyber security outfits\nthat they believe make easy targets to test-flex their muscles. They have yet to rope in the insurance companies\nwho refer them business. And their internal (and informal) policy of the moment\nseems to militate against charging ransomware victims who pay ransoms\ndirectly. <\/p>\n\n\n\nHow Ransomware Attacks Work: From Attack to Prosecution<\/h2>\n\n\n\n
Phase 1: The Attack<\/h3>\n\n\n\n
![\"Fake](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/12\/fake-fbi-ransomware-1024x576.png\")
<\/figure>\n\n\n\nPhase 2: The Fallout<\/h3>\n\n\n\n
Phase 3: The White Knight Arrives<\/h3>\n\n\n\n
![\"Ransomware](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/12\/ransomware-screen-1024x708.png\")
<\/figure>\n\n\n\nPhase 4: \u00a0The White Knight Gets Indicted<\/h3>\n\n\n\n
How The Government Views Paying Computer Ransoms<\/h2>\n\n\n\n
Making the Good Guys Prosecutable: Dirtying up the White Knight<\/h2>\n\n\n\n
The Insurance Companies as Co-Conspirators? <\/h2>\n\n\n\n
No Good Deed Goes Unpunished<\/h2>\n\n\n\n