Weird. I would think that while it's not worth the government's time to go after individual companies paying off ransoms, it would definitely be worth their time to go after a business professionally focused on paying illegal ransoms who tell interview candidates that they are aware that what they do is illegal.
Maybe, maybe not. It's technically illegal to grow or possess any amount of weed, but in practice you don't get prosecuted (by the feds) unless you have over 100 plants or thousands of pounds. Until ~2004 it was illegal for native Americans to be within Boston city limits.
There are thousands of things that are illegal, but in practice are rarely or ever prosecuted, even in cases where people are violating those laws at pretty significant scales.
In my case that's not a risk I'd be willing to take, but I can see why other people would. The reason it's not prosecuted though isn't because of companies, it's because there are lots of wealthy people who travel overseas and then get kidnapped, and the government isn't going to prosecute their families for paying to not have their kids dismembered and the videos posted on YouTube. The reason companies aren't prosecuted is mainly because once you decide not to prosecute families for doing this, then anyone else can make an equal protection argument.
I think you may be writing from a perspective of privilege and in the current civil unrest climate, this may seem a little tone-deaf. We're experiencing nationwide protests because a black person tried to buy cigarettes with a fake $20 bill, and he was murdered.
Perhaps things like your age, gender, and wealth may be insulating you, allowing you to think, "these laws don't actually apply to me", and if they did, you could most likely hire a lawyer and fight it.
Many people in this world cannot. Think about how many people are incarcerated for weed-related "crimes". Just because no one is going to go after YOU for them, doesn't mean that these laws don't serve a purpose to screw over others not so fortunate.
Anyways, not to pick on you specifically - I obviously don't know a whole lot about you, but your reply irked me a bit. Cheers.
I believe you are tilting at a windmill that doesn't exist. OP specifically stated that they didn't take the job because they didn't think it was worth the risk. OP didn't bring up their background. Do you have some information about him/her that the rest of us don't have that would back up your accusation of privilege?
I specifically said I didn't take the consulting gig because I didn't think it was legal, and I wouldn't ever start a commercial grow op for the same reason. So not sure your comment really follows.
Objectively neither activity is probably super high risk, but I still wouldn't be willing to take on either of those risks myself.
I was specifically commenting on this wide-sweeping generality:
There are thousands of things that are illegal, but in practice are rarely or ever prosecuted, even in cases where people are violating those laws at pretty significant scales.
"rarely or ever prosecuted" for you. You are on the advantageous side of a system that isn't that way on happenstance. Let's take your startup. How easy would it be for a black-owned startup in the US to raise VC funds in comparison to a white-owned startup? How easy is it to get... well any sort of loan if you're a black person, compared to a white person? How many black-owned banks are there that cater specifically to black businesses of any size?
The perspective that there are “thousands of things that are illegal” but not prosecuted always fascinates me, that’s not at all a common perception e.g. here in Germany. Is that a difference between common law and civil law systems? Maybe in places where code law is mostly binding, there’s a lot more pressure on the legislature to keep the law books up to date with the current norms of society.
Personally I see a big difference in the philosophy of lawmaking in the US vs Germany. Take driving, for instance. In the US, almost anyone who can physically climb behind the driver's seat of a car can get a drivers' license, and indeed having a drivers' license in the US is almost a fundamental right. Speed limits are then set, to first order, to accommodate the fact that you have marginal drivers behind the wheel. In addition, the police can - and do - selectively enforce driving laws. Ideally that power would be used to keep truly bad drivers off the roads, although the current civil unrest in America shows that that selective enforcement is, to put it mildly, abused.
In Germany, the barrier to getting a drivers' license is much higher. More training, more stringent tests. But the effect of that is that drivers are (mostly) assumed to be able to adapt their driving to road conditions; as a consequence, you get unlimited legal driving speeds on part of the German road system. In good weather, traffic permitting.
Of course, there are confounding facts: in my experience the average physical state of a car is much better in Germany than the US, and highways are better maintained. But still, the contrast is interesting. In the US, lifting speed limits on even straight roads through the desert would have poor outcomes.
I can only speak from my layman's understanding of US law. In the US, there's a doctrine prosecutorial discretion. Basically the police and prosecutors can choose whether to arrest and charge someone for a crime.
> "Maybe in places where code law is mostly binding, there’s a lot more pressure on the legislature to keep the law books up to date with the current norms of society."
In the US, where everything is so entwined with politics, there's a lot unenforceable laws still on the books.
For example, the US Supreme Court struck down sodomy laws in 2003. Last I checked, Texas still has a law on the books criminalizing sodomy. Sure Texas can't enforce it, but the conservative majority in the legislature won't actually repeal the law because politics. Similarly, when the US Supreme Court ruled that banning same-sex marriage was unconstitutional, Texas had to recognize same-sex marriage. But there was no law allowing same-sex couples to divorce. So there was this weird limbo wherein you couldn't get divorced if you were in a same-sex marriage.
There's a difference between laws that exist but are rendered moot by a court ruling it unconstitutional, and laws that exist and are constitutional but are just never used, and laws that exist, and are probably not constitutional, but aren't used, so have never been challenged.
For all intents and purposes sodomy was made legal by the 2003 precedent; that those laws are still technically in black-and-white doesn't mean they're in force.
But there are lots of laws that are still in force but aren't actually picked up and used much. They're still there, though. For instance, hardly anyone was prosecuted for Espionage Act violations for decades, but nobody disputes that the DoJ can dust that law off and start using it again, subject to the current jurisprudence on free speech etc.
In Germany it's currently illegal for someone to leave an escooter outside of a designated parking space. How many of them have you seen just laying around? I know in Mainz I've seen dozens.
Just saying, there's plenty of laws here that aren't prosecuted either.
It partly can be explained through white privilege, as the law enforcement and judicial systems are designed systemically to screw over minorities. Racial profiling is a thing, and if you're black, a police officer can use whatever excuse they want to pull you over while driving, and if they can't find anything, they'll invent something (for example: planting drugs on you). When that happens, you're life is literally in danger. Many examples of this can be found - one just has to look at the racial makeup of the US prison system (systemic slavery). It goes really deep. The US is kind of in a state of being acknowledging this in a fundamental way, with the movement to defund the police.
Basically, many laws overlap and it isn't always clear what applies. A new law may pass but they don't go strike through all the old laws that no longer apply.
Also there are laws that reference other country's laws. An example is that is (or was) illegal to buy/posses a type of meat in the US that is illegal in other jurisdictions. This was made to protect endangered animals but can easily apply to everything as there are lot of jurisdictions and who really knows if any one of them currently doesn't allow pork or beef for whatever reason.
In Germany it seems as if something is outlawed then it is believed that thing physically can’t be done. In the United States, we take it as a challenge!
Yes, laws are selectively enforced in many jurisdiction. For instance a local sheriff might choose to not enforce state or federal law when he sees it being broken. A local prosector can also choose to just not prosecute cases of a certain type as well. This is one reason why Americans are currently protesting our law enforcement, selective enforcement can make life difficult.
The perspective that there are “thousands of things that are illegal” but not prosecuted always fascinates me, that’s not at all a common perception e.g. here in Germany
It's definitely my perception in Berlin. There is almost no police, prosecutors and courts are completely understaffed.
I can think of an example in New Zealand where an old law (Sedition) was essentially ignored for several decades. A couple years after its first use in a modern setting (early 00's) it was repealed.
>It's technically illegal to grow or possess any amount of weed
Federally. The states have made this all higgledy-piggledy. And since there's money (legit retail income and state sales tax) involved, I'm surprised we don't have more federal troops kicking down more retail establishment doors.
Federal law has changed on this matter and the federal government is prohobited from interfering with states medical marijuana laws including a complete prohibition on prosecution.
It's a pretty legit business model; just because it's illegal doesn't necessarily mean the government wants to go after them. "Focused on paying illegal ransoms" = "allows companies to recover from devastating attacks by being a middle-man for paying the extortion fee and getting the decryption keys". It's probably one of those things that the government tells people not to do, but acknowledges is inevitable in many cases.
A company I worked at once had a meeting with such a firm, and it all sounded pretty reasonable to me. Obviously, one would hope the company has backups (which are stored in a place that can't itself become encrypted), but if they don't, sometimes the cost of paying the ransom is far, far lower than the cost of staying down. These middle-man firms have probably saved companies from enormous amounts of damage. Another commenter claimed these companies are often in cahoots with the ransomers, which maybe is sometimes true, but I highly doubt it in the case of the company we dealt with, or other US-based companies with physical locations that meet on-site.
Of course in an ideal world no one wants to reward criminals, but just to give an extreme example, if someone kidnapped one of your children and held them hostage, you'd probably pay anything to get them back, and that's not far off from the situation some ransomware-affected companies end up in.
> Of course in an ideal world no one wants to reward criminals, but just to give an extreme example, if someone kidnapped one of your children and held them hostage, you'd probably pay anything to get them back, and that's not far off from the situation some ransomware-affected companies end up in.
That's an appeal to emotion though while a company can do a cost-benefit analysis.
Also, if you pay for your children that means you signal that the kidnapping business model is viable and thus endanger more children. If the government keeps you at gunpoint from paying for your children then yes, in the worst case a bunch of children might die, but the business model would die with them.
No, in the worst case the government would shoot the parents of kidnapped children, and lose its legitimacy in the eyes of the people who it governs. There's no case in which a government would be able to continue to do that with impunity until enough children die to convince every potential kidnapper that kidnapping is a hopeless business.
Right, which is why this is always done as part of a cost-benefit analysis. Sometimes the cost of not paying is far greater.
And yes, paying the ransom signals that hostage-taking can be profitable, but not paying it signals that you value crime prevention over the lives of your children, which isn't necessarily a reputation or circumstance you want, especially when they'll very likely end up brutally murdered.
A company that decided principle-based crime deterrence was more important than granting customers access to any of their funds for 6 months would probably go out of business quickly. Also, try using that argument when talking to people who live in areas largely run by organized crime.
When most of them are from a little connected with the hackers to basically the same people and live off of ransoms I wouldn't use words like Pretty legit. I'm sure the exact business you have worked with is very different, in your opinion. I'm also sure everyone says that. I doubt a single of these businesses exists that isn't connected to hackers at all. How about a name if you are sure and we'll see?
What are you basing any of this on? Can you show a single example of an American company that this applies to? The onus is on you to substantiate the claim in the first place, not on me to prove innocence.
Paying ransom is illegal in some jurisdictions because it’s seems to be the easy way to prevent ransoms if it works or not I don’t know.
Ransom works when the target is capable and has sufficient incentive to pay out, if you make it so that you’ll face jail time as a CEO who orders a ransom to be paid out it’s quite likely might reduce acts of ransom.
I know that there is grey area that is common in the energy and global construction sectors where companies might not be able to pay ransom legally essentially have a ransom insurance so when 3 of your workers get kidnapped in Djibouti you have your “insurance company” which also often facilitates negotiations, extraction and repatriation handle the case.
(This is also common for other reasons, especially liability reduction if something goes wrong the company can wash their hands of the case and send the families after the “insurance provider”.)
There is also the grey area of “private emergency services” which range from private medevac on standby to assault teams capable of executing asset recovery missions some even take pride of being able and willing to perform prison breaks.
