Deal with Ransomware the Way Police Deal with Hostage Situations

In addition, ensure your data is backed up regularly. That way, if a ransomware attack happens, the victims can get professional help removing the malware from their systems, restore their data and move on.

Many companies have purchased insurance coverage to help pay the costs of recovering from ransomware – but some of those policies also include paying ransoms in the event of an attack.

Getting the data back isn’t a sure thing. Of the organizations that have paid the ransom, 20% haven’t actually recovered their data.

That presents victims with the certainty of spending some amount of money – whether it’s a ransom payment or a bill for a cybersecurity specialist – and not necessarily getting their data back.

An opportunity to Engage
We have found another approach that could reduce the amount of money spent and simultaneously increase the certainty of data recovery.

Negotiating with hostage takers is tricky business, both online and offline. But many cybercriminals are often willing to bargain over the price of a ransomware payout. In fact, nearly three out of four ransomware hackers would return stolen data for a discounted price.

With cybercrime overall – of which ransomware is a large and growing component – slated to cost the global economy $6 trillion a year by 2021, the opportunity to lower costs could be very valuable. For people or organizations without insurance coverage, there is little to lose by trying.

When a ransomware attack begins, affected computers’ screens normally announce the attack, include a demand for payment, and show a countdown clock, after which, allegedly, the hijacked data will become irretrievable.

That time is a window of opportunity to negotiate with the attackers. Usually, ransomware attackers require their victims to buy bitcoin, a form of digital currency, in order to pay the ransom. Most people don’t know how to buy bitcoin in the first place, so often an attacker has to teach the victim what to do. This opens a channel of communication between the victim and the attacker, which is analogous to the starting point police experts use to defuse hostage situations.

Negotiating with Cybercriminals
In general, the less the victim knows about how to purchase bitcoin, the more time the victim has to build up rapport and trust with the cybercriminal. During a negotiation, an attacker may extend payment deadlines, lower the ransom, decrypt some data as a show of “good faith” or provide step-by-step assistance in purchasing bitcoin.

These steps may be understood as offers to gain the hostage’s trust and may reveal the hacker’s willingness to be flexible. A victim can request some data be restored, in part to prove that the hacker actually controls the files.

If the attacker doesn’t provide any decrypted data, it may be a sign that the ransomware is one that just erases data, rather than holding it hostage. That type of attack cannot be reversed, even if a ransom is paid.

If that’s the case, then it may be smart to terminate negotiation and not consider paying the ransom, either.

A risky Business
No strategy for dealing with a ransomware attack is without risk.

Paying the ransom appears to increase the chances of being targeted again in the future, according to one 2018 report. In a future attack, the attackers will be less likely to believe that you don’t know how to buy or send bitcoin.

Paying the ransom also lets the criminals, and at times rogue nations like North Korea who also mount ransomware attacks, earn significant amounts with minimal risk, possibly increasing the likelihood of others being targeted as well.

Declaring that you won’t pay the ransom has its own dangers, as Baltimore saw, paying millions in fees to recover data and rebuild systems. That data could, at least potentially, have been reclaimed for just thousands of dollars.

In a similar situation, the city of Atlanta was hit by “GoldenEye” ransomware, with cyberextortionists demanding $51,000 in bitcoin. Atlanta, like Baltimore, refused to pay. The city ended up spending more than $9.5 million in taxpayer dollars for recovery.

These events make clear the moral and ethical dilemma around fueling crime and efficiently using public resources, a quandary that can be lessened, if not relieved entirely, by negotiating.

More organizations are trying this new approach, seeking to lower ransom payments and recover data less expensively. For example, the municipal government of Mekinac, Quebec, Canada, managed to lower its ransomware payment by 55% through negotiations. In our view, it’s worth a try – and while certainly not risk-free, it could help.

Scott Shackelford is Associate Professor of Business Law and Ethics; Director, Ostrom Workshop Program on Cybersecurity and Internet Governance; Cybersecurity Program Chair, IU-Bloomington, Indiana University. Megan Wade is Master of Public Affairs Candidate in Information Systems, Indiana University. This article is published courtesy of The Conversation.