Security Engineer Explains Ransomware Response
Deploying ransomware is a crime, but it seems like you never hear about criminals being held accountable. Why do you think that is?
Well, I think it’s simple and not straightforward at the same time to understand why criminals aren’t held accountable a lot of times for these cybercrimes. One of the substantial issues that several people don’t understand is to do an investigation.
Let’s say someone stole $100,000, and it costs $200,000 to investigate. It doesn’t make sense to pursue that person.
Now, why would it cost so much? It’s because you have to get legal action in other countries.
You have to get subpoenas and proper documentation to go to those countries and start investigating and get those logs and things like that. So that alone is expensive.
But besides that, you have to understand that not every country abides by the same laws. That’s the most difficult part of it.
So, an example: if it’s not illegal to attack, let’s say, the U.S. from your country, and then you attack us, and we say, “Hey, we want to investigate this.” If you go and ask that country, “Hey, we would like to pursue this, we’d like to prosecute,” and it’s not illegal in that country, they’re most likely not going to allow you.
It doesn’t make sense to authorize your laws to go into their country. So that’s usually the most telling thing that you see.
These criminals are doing this from a country that doesn’t prosecute, doesn’t issue any warrants for their arrest, and doesn’t hold them accountable for hacking other countries, which is a big problem.
The other reason, like I said, is usually funding. And I don’t mean that unpleasantly. But usually, hackers are pretty good at hiding their tracks and using multiple VPNs to multiple countries.
And when that happens, you have to pursue each of those leads into each country, which means you have to negotiate and get proper documentation and things for each country that VPN entered, which makes it extremely expensive and time-consuming. And therefore, a lot of times, it’s not worth it, because you’re not going to be able to prosecute that person, and it’s going to cost you an arm and a leg to do so from a government spending standpoint.