> It would seem the unintended consequences of such a policy would be to ensure every cyber breach is kept entirely secret (so that ransom payments could be made discreetly)
It will show up somewhere in the tax filings. There's no such thing as discreet payments unless it's in such small amounts that it comes from petty cash.
And since the ransomers are demanding payment in crypocurrency, it's even easier to spot for the clear majority of victims.
> It will show up somewhere in the tax filings. There's no such thing as discreet payments unless it's in such small amounts that it comes from petty cash.
Create a shell company in some remote tax haven with lax disclosure laws, have them pay the ransom, and close the shell company afterwards. Companies are already good at dodging taxes this way.
> Create a shell company in some remote tax haven with lax disclosure laws, have them pay the ransom, and close the shell company afterwards. Companies are already good at dodging taxes this way.
That only works for hiding income, not hiding expenses.
You create a shell company in Malta (for example). Now how do you get $$$ into that company so that it can pay the ransom?
Okay, so you assign your payment to $MALTA-COMPANY the line-item of 'consulting fees'. It only takes a few companies to do this before the tax authorities are wise to it.
After all, even for relatively tiny amounts companies still have to perform KYC on customers!.
Think about it this way: if it was that easy to hide expenses from authorities, embezzlement schemes would be a lot simpler than they are now.
> Okay, so you assign your payment to $MALTA-COMPANY the line-item of 'consulting fees'. It only takes a few companies to do this before the tax authorities are wise to it.
Tax authorities already don't give a fuck about where a company shifts its money to. As long as there's a proper entry in the books, at least. There are schemes involving up to six different legal entities [1]. A measly million dollars or two is a minor rounding error for a multibillion dollar company.
> Think about it this way: if it was that easy to hide expenses from authorities, embezzlement schemes would be a lot simpler than they are now.
Embezzlement is easier the higher the embezzler is in the command chain. When the CFO orders something to happen - say, a monetary transfer or the creation of a shell company - it will usually be executed without question by the lower levels. Maybe, given the rise of impersonation attacks, the underlings will follow protocol and call the CFO back to verify that it is really the CFO ordering that thing, but that's it.
It depends on how illegal "illegal" it is, too. Illegal doesn't mean criminal, and even then, companies do plenty of things that are normally criminal and they get away with a small fine.
It isn't just the IRS, every large company hires independent auditors to go through the books and report anything "funny", they generally are required to report illegal findings to the police along with reporting legal things that are against the companies interest.
Independent auditors check to see if a company's accounting is following GAAP accounting standards (so that a statement can be put in the SEC filings). They don't comb through each payment in detail (corporations can have millions of them each year). And if they find things, they tell the company to fix it or report any deviation from GAAP standards.
But much of it is dependent on good faith of the company along with some spot checking to see if their accounting processes line up with what they said they do.
And plenty of companies who have been found to commit fraud have gotten the "thumbs up" during their "independent audit". It gives you a sense as to how cursory their audits are.
It will show up somewhere in the tax filings. There's no such thing as discreet payments unless it's in such small amounts that it comes from petty cash.
And since the ransomers are demanding payment in crypocurrency, it's even easier to spot for the clear majority of victims.