So ransomware and cyber attacks have been all over the news lately. Whether it’s the CDK automotive dealership hack or the big AT&T hack, these are big-time events and occurrences that affect millions of people. What happens with these attacks is companies are attacked by a hacker, and usually, what they do is they get into your system, lock down the system of this large company, and tell you, “We’re going to keep you locked down unless you pay a ransom.” That’s why they call it ransomware.
Ransom Payment Dilemma
The company can make a couple of decisions. Either they don’t pay the ransom and spend a lot of time and money trying to unfreeze their computer system, and in the meantime, the hackers can delete files, take private information and share it on the dark web, or they could just pay the ransom and get it over with. Many times, the companies look at it as a cost-benefit and say, “We’re better off paying the ransom; it’s a cheaper option.”
Risks of Paying Ransom
However, at some point, paying these ransoms is going to get these companies into trouble. First of all, so far, the hackers have been honorable. When you pay, they unlock your system. At some point, the hackers are going to make you pay more, they’re going to keep upping the ante on the ransom. I think the hackers are doing it out of self-interest, knowing that if they start doing that, then no one’s going to pay ransom anymore. However, there are two other potential risks for a company paying a ransom, and those are regulatory and legal risks.
Foreign Corrupt Practices Act (FCPA)
There is a law called the FCPA (Foreign Corrupt Practices Act), and what that law generally says is if you pay a fee or a bribe to an entity that’s related to a foreign government, you’re committing a crime. It’s designed to stem bribery. So if you go to another country, want to build a factory, and the governor of that province says, “Look, you got to pay me a bribe to get permits to build a factory,” it made it illegal so that companies could say, “We are not allowed to pay a bribe.” It was a good law.
Hackers and Government Connection
However, these hackers technically are not part of the government, but if it could be discovered that they’re working with the government or under the approval of a government, some companies might get into trouble by paying the hacker a ransom. Another way a company could get in trouble is if the hacking company is using that money for terrorism or some other illegal activity, and you’re funding that through your ransom.
Money Laundering Concerns
A third way there could be legal problems for a company is if there’s money laundering involved. If you pay it through crypto or launder it through a bunch of different cutout private accounts or wire transfers, it’s yet to be tested. At this point, our government has more things to worry about than how companies are trying to save themselves from being extorted. However, I’m sure that the large corporate counsel looking at these ransom payments are cautioning the CEOs and the boards, saying, “You got to be careful how you do this.”
Cyber Liability Insurance
That’s why many companies have cyber liability insurance, where the insurance company handles all that as an insurance payment. The insurance company knows how to structure the conversations and messaging so that it doesn’t come across as being a bribe, money laundering, or some type of illegal support of a foreign government or terrorism. The question is, at what point is that gray area going to be breached where a payment of a ransomware hack is going to be construed as being an illegal activity by a company?
Regulatory and Legal Implications
I hate to be the first large company to be regulated or prosecuted about this, but at some point, the government is going to set an example, and they may do it just to keep the hackers from continuing to infiltrate US companies. If companies are warned against paying ransom because they’re going to get prosecuted, now the hackers are not going to have as big of a market.
Future of Ransomware Payments
So whether this comes from regulation, prosecution, or somebody changing the laws legislatively, it’ll be interesting to see how this plays out. The volume, number, and extent of these ransomware payments are going up. Presumably, the CDK hack had a ransom of about $25 million paid in Bitcoin. It’ll be interesting to see if in the future there’s pushback against this from government agencies.
