Companies hit by ransomware are faced with an ethical dilemma: pay up to save their now-encrypted data, or hold the moral high ground and lose it all. This is a question many companies may have to face. The recent WannaCry cyber-attack, which targeted the data of organisations including UK hospitals, is part of a growing and lucrative “industry”.
In most cases, the perpetrators attempt to encrypt a business’s data and then refuse to share the decryption key unless a ransom is paid. WannaCry reportedly demanded that companies pay upwards of US$300 in Bitcoin.
Of course, there are ways to protect yourself. Up-to-date software and effective backups are good controls for ransomware, but many people fail to keep up. For examples, an estimated 7% of computers globally still use Windows XP software, despite Microsoft having ended support for the platform. In the case of WannaCry, this was an important vulnerability.
Paying up may be the rational choice for an individual business, but given that cybercriminals go where the money is, the repercussions for others could be significant.
The case for paying up
Pop-culture morality tells us a ransom should not be paid; movies tell us that paying the ransom means the bad guys win.
In the real world, however, businesses faces a serious dilemma. Paying the ransom could save the business and keep staff employed, but the cybercriminal will probably feel encouraged to continue their attacks.
Ultimately, businesses held to ransom have at least four choices:
- Refuse to pay the ransom and risk the possibility that the criminals will carry out their threats
- Call authorities to launch a criminal investigation, although whether the data will be decrypted is uncertain
- Attempt to use decryption tools to access the data. One such method is “brute force” – a trial and error computational method to guess all possible variants of the decryption key – but some mathematicans estimate that’s beyond the processing power of most computers.
- Pay the ransom and hope you get your data back.
Ransomware ‘WannaCry’ attack explained.
Several factors may affect the decision, including whether the victim expects that the encrypted data will be returned once payment is made, or how embarrassing it will be to inform clients about the incident.
The value of the data is also important. If the data held hostage is not integral, then the business is obviously less likely to pay.
Thinking about others
The victim’s consideration of the consequences of their choice for others is also important.
Economically, rather like the decision of an individual trawler to over-fish the seas or a factory to pollute the air, paying the ransom creates a “negative externality”.
That is, paying the ransom may benefit the cybercriminal as well as the business and its survival, but it’s a sub-optimal choice from the perspective of the wider community. The business that pays the ransom obtains all the benefits of their choice, but much of the cost is borne by others, who may become the victim of emboldened cybercriminals.
The moral dilemma is difficult: paying the ransom saves the business but hurts others. However, not paying the ransom is to feel morally superior while waiting in the unemployment line.
How to fight ransomware
Avoiding such a dilemma entirely requires businesses to prepare for ransomware attacks.
There are several key actions and responses a company can take to blunt the impact of a cyber-attack. Chani Simms, co-founder of Meta Defence Labs, has suggested, among other things:
- Implementing preventive controls to make attacks less successful, such as regularly “patching” software and training staff in good information security practices.
- Ensuring data is backed up offline and business continuity plans are in place.
- If an attack is still successful, quickly isolating infected computers to limit losses.
Such simple strategies are estimated to mitigate most cyber intrusions as well as ransomware. Yet the risk remains that ransomware creators will find a vulnerability, encrypt important data and leave the business with a sticky choice.
Until someone creates a ransomware-proof software system, some might decide that paying up is the rational choice.
Micheal Axelsen, Lecturer (Business Information Systems), The University of Queensland
This article was originally published on The Conversation.
Comments
7 responses to “When It Comes To Ransomware, It’s Sometimes Best To Pay Up”
If the crooks never decrypted the data after paying, everyone would be screaming it from the rooftops – never pay, you won’t get it back anyway.
It’s in their best interests to make it decrypt when you pay, otherwise no one would pay them.
Even if one pays it may not end well:
* Victim gets no key and instead gets another ransom.
* Victim gets no key and no word back thus both data and money is lost
* Victim actually does get the key but for whatever reason (wrong key or broken decryption) the data is still lost.
If anything, the such ransoms are just proof that individuals and business need good backup strategies.
What I’m about to write is very harsh but it is still some of the best advice I’ve heard over the years: “Those who do not backup their data deserve to lose it.”
I’m kinda hoping I get hit… I need an excuse to rebuild but always find something else to do. Backup is current and offline.
the best strategy is to &^%$%%# backup! seriously, computers did not arrive on the scene only a year ago. a company that get ransomed deserves to lose their data and their business.
1. pay up
2. pay more
3. pay more that you cannot afford
4. sorry no unlocking for you
5. /end
Just for the record – under Australian law it is illegal to pay the ransom. Eg see the Crimes Act (1990) of NSW and similar legislation in other states. However, whether law enforcement would pursue the matter is a different question.
Always good to hear a calmly proffered left-field argument, Micheal, though I am with the “Try your best not to pay” crowd (..probably based on my IT background).
However… I do think you left out a factor that seems to be gaining momentum as an “influencer”: Insurance.
Looking at how costs of insurance have affected much of society and business, it’s a growing thing with ransomware. So are we headed for a business world where ransomware insurance is an essential? I’d hate to think so, seeing the insidious tacit partnerships that exist in the (eg.) automotive world between those who stand to gain: insurers, repairers, regulators…. And Joe Blow has wallet and life caught in the 21st century vise… again.