A few weeks ago we discussed what has become an epidemic of extortion attempts against companies by people who demand that their victims pay up-typically by wiring money to an offshore bank – or face a potentially debilitating distributed denial-of-service attack.
Many send the money rather than risk network hell-and they are also loath to notify the authorities for fear of bad publicity.
Because trade press columnists get paid to tell others how to conduct their business, I had two suggestions regarding this matter: Make paying extortionists illegal so as to remove the temptation to take the shortsighted way out, and at the very least make reporting such crimes mandatory.
This week we’ll hear from readers who wrote in response to that column, and we’ll share the results of an unscientific online survey conducted at NetworkWorld.com.
Next week, we’ll hear from the heads of two companies that are on the frontlines of fighting distributed DoS attacks. They don’t agree with my approach and have interesting alternatives of their own.
Let’s start with the poll, which again is only a self-selected sample of opinion.
Of the 64 respondents who logged a vote for or against making these extortion payments illegal, 35 backed the idea, 23 were opposed, and another nine fence-straddlers chose the option of “it depends.” Given the limits of the survey, I wouldn’t draw any conclusion from those numbers except the obvious, which is that opinions are mixed on this point.
However, there was no such ambiguity on the second question, which asked if reporting extortion attempts to the authorities should be required by law. Of the 54 readers who took the time to register an opinion, only three believe that these corporate victims of extortion should have no legal responsibility to report the crimes.
Self-selected sample aside, that’s an unmistakable consensus.
But let’s hear from one of the dissenters: “Suggested and encouraged? Yes. Required? No,” writes the anonymous respondent. “We have too many laws already, and legally requiring people to report extortion demands is like legally requiring people to cross the street in designated pedestrian crosswalks – good in theory, but who’s going to do it? If you’re scared enough to pay, you’re not going to tell the authorities and risk retaliation. If you’re not going to pay, you’re going to call the authorities on your own.”
A common thread through the objections to prohibiting payments was that companies might simply have no reasonable choice.
“Until there are serious, ubiquitous alternatives to paying, then there should not be punishment for paying,” offers one reader. “There does need to be a requirement, and standard procedures, for reporting these incidents, so that alternatives can be developed based on reality.”
Another sees a role for law enforcement in determining if and when capitulation makes sense.
“Payments should only be considered with the assistance of professional investigators” such as the FBI, this reader says.
The FBI reportedly discourages companies from paying, for whatever that’s worth.
One reader is of the opinion that targeting only the extortionists or considering sanctions against those targeted misses another important piece of the problem.
“Extortion is only effective if there is a very real belief that the attack is possible,” writes Paul Kraus. “As long as vulnerable systems are allowed access to the Internet there will be the very real possibility of DoS attacks. Why not halt the extortion by restricting Internet access for any host that is vulnerable to takeover? . . . [Tier 1 ISPs] need to look at the Internet as more than just a revenue source, but a community to be ‘policed.’ Certain behaviors should get a host’s IP address blacklisted from carriage on the Internet. . . . I know it’ll never happen, but I can dream, can’t I?”
And, finally, here’s my favorite objection to prohibiting payments:
“One should recall that even the United States government paid bribes and ransoms to the Barbary Coast pirates until the young nation gathered the means to squash the criminals.”
Can we all get behind making the extortionists walk the plank?
It’s never too late to add your two cents. The address is buzz@nww.com.
