Colonial Pipeline forked over $4.4M to end cyberattack -- but is paying a ransom ever the ethical thing to do?
It took little over two hours for hackers to gain control of more than 100 gigabytes of information from Colonial Pipeline on May 7, 2021 -- causing the firm to shut down its fuel distribution network and sparking widespread fears of a gasoline shortage. The decision to pay off the attackers was also made with apparent speed, but the ethical arguments involved are age old and the implications could reverberate well into the future.
Cyberattacks, including those on critical infrastructure in the U.S., are nothing new. Ransomware, a type of malicious software that locks access to a computer until a ransom is paid, has been a component of the cyberthreat landscape since the mid-2000s. But the Colonial Pipeline breach raised the stakes and highlighted the ability of ransomware to interrupt the vital services on which Americans rely.
As scholars of cybersecurity policy, in particular critical infrastructure protection and ransomware, we think it important to consider the legal and ethical questions surrounding ransomware payments -- just because paying off cyberattackers may be lawful in some contexts, that still doesn’t make it the morally correct thing to do.
To pay or not to pay
It has been widely reported that the Colonial Pipleline CEO Joseph Blount agreed to pay a US$4.4 million ransom to DarkSide, the Russia-based group behind the cyber attack.
In describing his decision, which he said did not come lightly, Blount argued that it was justifiable given that it was “the right thing to do for the country.”
Official guidance suggests otherwise. In October 2020, the Treasury Department warned that ransomware payments are a violation of its rules and would only encourage future demands. Although there is no federal legislation, such states as California, Texas and Michigan have cyber-extortion laws on the books that discourage ransomware payments.
Often, though, the decision of whether to pay falls in a legal and ethical gray area.
CEOs can turn to three main schools of ethics in guiding decisions about whether to pay ransoms based on virtues, duties and consequences.
Under virtue ethics, which traces its origins to philosophers Plato, Aristotle and Confucius, people make decisions based on a set of virtues or character traits such as honesty and loyalty. In and of itself, the tradition does not help in situations that require weighing one virtue against another, such as not wishing to reward criminal activity against preventing disruption to the wider American public. For example, Colonial Pipeline CEO Blount expressed a moral distaste in paying “people like this,” but ultimately decided to override that concern based on other factors.
Another way to approach challenging ethical decisions is through what is called the deontological approach, which holds that actions are good or bad determined by a clear set of rules. So another way to come at the question of whether to pay a ransom is to ask, “How does doing so align with recognized universal duties?”
The problem with cybersecurity is that, given the rapidly changing technological and regulatory environment, it is not always clear what the “golden rules” are, or even if any have been established. Some business leaders may even perceive a duty to pay as Blount did, especially in the case of critical infrastructure such as pipelines on which so many people rely.
The ethics of ransomware payments can also be viewed through the consequences of the decision to yourself, your family, your organization and, as Blount suggested, the country and the world. Utilitarian philosophers hold that what is important is promoting the greatest good for the greatest number of people.
This is often described in boardrooms and policy circles as cost-benefit analysis. Yet it’s not always clear where to put that next dollar of investment to maximize the good and minimize the harm in the long term. In dealing with ransomware, for example, backing up data is key, as is practicing zero-trust security, an approach in which companies assume that their networks are already compromised and act accordingly. But doing so can be complex, and investments might cause fewer benefits than if the money were invested elsewhere.
"pay" - Google News
May 28, 2021 at 02:44AM
https://ift.tt/3fqetTK
Colonial Pipeline forked over $4.4M to end cyberattack -- but is paying a ransom ever the ethical thing to do? - GCN.com
"pay" - Google News
https://ift.tt/301s6zB
Bagikan Berita Ini
0 Response to "Colonial Pipeline forked over $4.4M to end cyberattack -- but is paying a ransom ever the ethical thing to do? - GCN.com"
Post a Comment