Murder, she wrote: Ex-FBI chief wants some ransomware crims charged with homicide If a cyberattack leads to a death, that's murder. A former FBI cyber division chief urged the US Justice Department to consider felony homicide charges against ransomware actors when attacks on hospitals lead to patient deaths. In testimony before a US House of Representatives subcommittee hearing, Cynthia Kaiser, former …
Well OK I can sort of see a sort of logic to the argument, but has anyone informed Cynthia Kaiser that the perpetrators are almost certainly outside the jurisdiction of the US. so it’s pointless?
Spend less time and resources on trying to punish people that are beyond your reach and more on education, toughening infrastructure etc, but basically education!
Okay, I'll ask, what do you think it means? Their meaning, that people who know they could get arrested if they do that and nonetheless take the risk to their detriment, seems clear enough, and assuming that the people concerned would prefer to avoid being arrested, seems to work well with the definition I've previously used.
Not that it matters much to the philosophical idea, but wouldn't the correct charge be manslaughter rather than murder, since although the criminals caused the death through their actions, they didn't do it intending the death? A lawyer could demonstrate that they might not even expect the death, as many ransomware incidents fail to kill anyone, which would make the murder charge even harder to prove. I've heard some US states redefine murder into a lot of different types which might apply, but in most situations, I'd think a manslaughter charge is a more certain one for ransomware operators.
Outside the Humpty·Dumpty† jurisdictions of the US, unlawful homicide usually requires an element of foreseeabilty and of recklessness. Many jurisdictions weaken these elements should the death occur during or as (potentially unforeseeable) consequence of a criminal act.
Hopefully with much of the planet washing its hands of the US, extradition to the US and gratuitous extra·territoriality of US legislation will become far less common.
† "When I use a word," Humpty Dumpty said, in rather a scornful tone, "it means just what I choose it to mean- neither more nor less."
Your complaints are incorrect and illogical. Nobody was suggesting that this would not be a crime, in the US or elsewhere. The question was which crime, murder or manslaughter. Both come under the heading of unlawful homicide, whether in the US, UK, or pretty much any country on the planet.
It is not. For example, let's consider what's murder and what's manslaughter in the UK. The Crown Prosecution Service has a guide to explain it. Here's the important difference which makes this more likely manslaughter than murder. One of the requirements to charge murder in the UK is "with intent to kill or cause grievous bodily harm (in contrast to the offence of attempted murder, where only intent to kill will suffice)". If you do something which does kill but you intended something else to happen, that's manslaughter. To quote the guide again: "Conduct taking the form of an unlawful act involving a danger of some harm that resulted in death ("unlawful and dangerous act manslaughter")."
I'm not sure whether it's murder in the US either, except that, from news I've seen, it seems that US states have various conflicting definitions of murder. This has been a problem in cases where someone would like a murder charged under a higher degree but the law has established extra rules which make that difficult, and therefore with a potential 51 different definitions of murder, I'd have to do more reading to find out.
Well, how about the case of Mahek Bukhari and her mother - they were both convicted of double murder when the car they were chasing (and ramming, to be fair) went off the road and killed the drivers. Neither she or her mother were even driving.
That was murder because:
"Under the principle of joint enterprise, the jury found that Mahek, her mother, and the drivers (Rekan Karwan and Raees Jamal) shared a common goal to cause serious harm or death. The high-speed chase reached speeds of up to 100mph before the victims' car was deliberately rammed off the road."
The difference seems pretty clear to me, the law requires "intent to kill or cause grievous bodily harm", the jury decides they have "common goal to cause serious harm or death", those align. Ransomware operators usually have a goal to get money, not to kill or cause the physical injury that the law requires, which would make it manslaughter by the CPS's requirements.
But they weren't even driving. I actually agree with the sentence, but how they could prove they "had the common goal to cause death" is s mystery to me. Still, I guess that's a quibble with the jury, not the law itself as you rightly pointed out, so it was a bad example! And looking for other examples, I couldn't find any more relevant, so I guess I was wrong!
P.S. Not my downvote!
In the US, it would be a murder charge. The accused committed an act they *knew* was likely to result in death, but they intentionally did it anyway. While their *goal* wasn't to kill, they were fine with it happening. So it's still effectively "intent to kill".
Note that committing an act that isn't likely to result in death, but accidentally does anyway, is manslaughter.
Deliberate state sponsored attacks notwithstanding, the simple fix is to cut off the money supply to the attackers. Make it illegal to pay ransom, and progressively isolate and punish the banks and payment processors who handle such payments. A useful start would be outlawing digital currencies, but with the thief in chief being rather keen on making and stealing money through similar means this won't happen anytime soon.
It would also be useful to stop connecting all essential utilities to the Internet.
Of course, that would make remote management more difficult, require dedicated lines, etc.
Tough cookies. Security is essential, whatever the cost. If you can't pay for security, you're a liability and should be dealt with as such.
It would indeed. But I'm afraid the history is against us. Most of the connections were done at a time when it was a very sensible decision to allow that kind of connection; it would probably be simpler and cheaper to rip out and rebuild than try and harden existing infrastructure, but either way it's going to cost a bloody fortune.
Yes, I want companies to make lots of money for their shareholders; I'm a pensioner and directly or indirectly, that's where my income is from. But I wonder if we really need companies to have _all_ the money? Perhaps there could be some consideration for the rest of humanity?
"it would probably be simpler and cheaper to rip out and rebuild than try and harden existing infrastructure, but either way it's going to cost a bloody fortune."
In some cases it might be possible to refurbish and reconnect the old infrastructure that was disconnected when the inernet connection was installed. That shouldn't be too expensive.
I wonder is it's possible to take the fight to the beancounters who are the perennial source of the problem.
Require accounting standards to include quantifing the risk of the internet connection in terms of money and deduct that from the book value of the companies assets. It would show up as a sharp loss in the first year which could be reduced by spending rather less than the loss in eliminating as much of the risk as possible.
The blame for someone dying is how a choice was made to make people's lives dependent on proprietary software that is susceptible to ransomware.
Considering that many components of windows stop working at random intervals, even when not infected by ransomware (with windows, the question is not if you will be infected by ransomware - it's when you will be infected), it is clearly total and utter insanity to use windows in a hospital.
Sure, charge the ransomer for extortion, but if you want to charge someone for murder, the correct person to charge was the person who decided that windows was to be used.
If someone is walking across a defective bridge, where it's known that if you pull out one particular pin (which can be done by hand), the whole bridge collapses, still, if someone is walking across the bridge, and you intentionally pull out that pin, you'll be charged with murder - you won't be able to blame the defective bridge.
If the bridge was installed knowing that one pin falling out or being pulled out by hand causes the whole bridge to collapse, the one who gave approval to such defective bridge being installed is clearly more culpable than an extortionist that decided to apply 1kg of force to pull the pin out - as the defective bridge was the only thing that allowed such extortionist of little competence to act.
As it was just a question of time as to when the pin was going to fall out - there was little difference in the end result - people were going to die due to the defective bridge - the only difference the extortionist made was made people die earlier (maybe even the end result would be less people dying, if the bridge wasn't fully loaded yet and its replacement would be a non-defective bridge, although clearly the bridge shouldn't have been defective in the first place, as that way there would be 0 deaths).
Ideally people would learn from the consequences and deny to give approval to the install and use of such defective bridges - too bad that's not going to happen.
Oh, do get over yourself; you're not special. Trump is shooting every federal and state department he can in the foot, in the head, and in the gut, and as many times as he can get away with it before someone finally puts this madness to a stop.
You're just the latest in a long line of "cost cutting measures" to pay for the illegal "war"/ASSAULT.
