O’Brien: Colonial Pipeline was wrong to pay ransom

Colonial Pipeline paid the ransom.

And after forking over $5 million to hackers who forced it to shut down an important fuel conduit, which spurred a bonkers run on local gas stations, the burglars gave Colonial a decryption key meant to sanitize its computer networks. But the tool didn’t work very well. Bad trade.

Lesson: Don’t pay the ransom.

Law enforcement authorities and other experts have been advising as much for years. Professional hostage negotiators regularly try to observe that maxim, too (though specialists who negotiate with terrorists have unusually complex dynamics to consider, and paying ransom may be the safest strategy for them).

When lives aren’t directly at stake, the guidelines seem to be clear. Here’s the Federal Bureau of Investigation’s advice:

“The FBI does not encourage paying a ransom to criminal actors. Paying a ransom may embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illegal activities. Paying the ransom also does not guarantee that a victim’s files will be recovered.”

There’s also a boomerang effect that arises when companies give bags of money to extortionists deploying ransomware. It seems to convince thieves that a target is an easy mark, and they will most likely circle back later and thump the same company or institution again. A particular willingness among U.S. companies to pay, combined with a porous and lackadaisical approach to cybersecurity in the private sector in America, may explain why the U.S. appears to draw a disproportionate amount of ransomware attacks.

Hackers also may be shaking down U.S. companies more often simply because they’re following the basic wisdom attributed to a bank robber, Willie Sutton: “Because that’s where the money is.”

Companies confronted with “double extortion” — the unhappy reality of having to pay hackers to unlock a digital network and then pay them again to recover stolen data — should remember that a significant portion of ransom-payers never get their data back anyway.

So what might an alternate approach look like? Consider Baltimore and Atlanta.

Atlanta got hit in 2018 when hackers asked for $51,000 in Bitcoin to revive municipal computers crippled as part of the broader GoldenEye attack. Atlanta refused to pay and chose, instead, to upgrade and secure its networks for $9.5 million.

Hackers laid siege to Baltimore’s municipal computer networks in 2019 and demanded $76,000 in Bitcoin to go away. Mayor Jack Young told them to kiss off and then ate a $10 million fee to overhaul the city’s networks and $8 million to write off unpaid taxes and other fees while computers were down. “We’re not going to pay criminals for bad deeds,” Young told the Baltimore Sun. “That’s not going to happen.”

There’s a lot to be said for Young’s perspective. A vulnerable network is going to need upgrades regardless of how ransom negotiations proceed, and there’s no telling if paying a bribe will forestall all of the problems that come with a significant intrusion — so why not eat the costs upfront and move on?

All institutions in the digital era should have appropriate backups in place. That’s not a complex fix. Also, companies should think about the expense associated with a shutdown the same way Atlanta and Baltimore did — proactively rather than reactively.

---

Timothy L. O’Brien is a syndicated columnist.

from Boston Herald https://ift.tt/3okLEuK