Would you pay a cyber ransom?

Would you pay a cyber ransom?
Paige Fusco

A few days ago, cyber criminals hacked into one of the largest oil pipelines in the US, which halted operations after its corporate IT network was knocked offline. If the engineers don't fix the system on their own or the owners cough up the ransom that the hackers are demanding, millions of Americans will soon feel the heat of cybercrime in their daily lives, through higher prices at the gas pump.

Who pulled off this attack, and what does it tell us about the vulnerability of critical infrastructure and the rules (or lack thereof) in cyber conflict today?

The culprit. The US government has blamed the Colonial Pipeline cyberattack on DarkSide, a relatively new group of veteran hackers from Eastern Europe famous for bragging about its exploits online, and leaking data dumps from victims who don't pay up. The DarkSiders style themselves as Robin Hoods of the hacker world, donating (a minuscule) part of their profits to global NGOs such as Children International and The Water Project. But this time they may have bitten off a bit more than they can chew.

DarkSide issued on Monday a rare apology for creating "problems" to society, insisting they only want money and are not at all interested in politics, although they do seem to avoid former Soviet bloc nations. That's common for cyber criminals based in these countries, whose governments will look the other way as long as hackers target victims outside their borders.

One of those governments is that of Russia, with a long history of outsourcing its dirty cyber work to unscrupulous hackers. Joe Biden says there's no evidence that the Kremlin was involved this time, but does have "some responsibility."

The problem. The fact that a bunch of geeks armed with laptops shut down a pipeline that serves 45 percent of America's oil refineries shows that US critical infrastructure is a lot more vulnerable to cyber-extortion than we'd like to think. And the Biden administration's $2 trillion plan to upgrade US infrastructure across the board turns cybersecurity into an even more urgent concern.

As always, the pandemic has made everything worse. Ransomware attacks — and cybercrime in general — have boomed in COVID times, largely as a result of IT systems that became more vulnerable when companies rushed to adapt them for remote access. Moreover, hackers are now targeting bigger firms for a lot more money thanks to the rise of cryptocurrencies, which make it easier for them to get paid and harder to trace.

Ransomware attacks are particularly problematic for companies and countries because they are forced to make a tough choice: pay off hackers and risk encouraging further such attacks, or hold out and take the economic or social disruption on the chin.

The response. The Colonial Pipeline hack shows how cyberattacks can do severe damage to a country by disrupting critical infrastructure. But as we've written before, these types of operations are hard to prevent, and even harder to attribute and respond to.

So far, the US government has declared a state of emergency to keep the oil flowing to the Eastern Seaboard. But at this point it can't do much more to stop the hackers, or hold them responsible for a brazen attack that would otherwise be considered an act of war against America. It can't even prevent the corporation from paying the cryptocurrency ransom.

What it can do mostly depends on whether a foreign government was involved, or aware of what DarkSide was cooking. If that's confirmed later on, the US may want to hit that country harder than with the usual economic sanctions. There could even be political pressure to respond proportionately in cyberspace — perhaps with a similarly damaging attack. And when the cyber gloves are off, things could get very bad, very fast.

More from GZERO Media

Yael Richert speaks during special event to address sexual violence during Hamas terror attack on October 7 held at UN Headquarters in New York on December 4, 2023. During the event, speakers described their personal experience seeing women violated during terror attack and condemned women’s advocacy groups, specifically UN Women, to be silent on this.
Photo by Lev Radin/Sipa USA via Reuters

As the Israel-Hamas war rages in Gaza, the Israeli government and the UN are locked in an escalating feud of their own.

Papua New Guinea’s Prime Minister James Marape and Australia’s Prime Minister Anthony Albanes
AAP Image/Mick Tsikas

The Australian government on Thursday signed a security pact with its nearest neighbor, Papua New Guinea (aka PNG) that strengthens its – and America’s – position as a primary security partner in a region where China’s influence is rising.

Argentine President-elect Javier Milei
REUTERS/Agustin Marcarian

After running a scorching campaign that promised to turn Argentina into a Utopia of free-market capitalism by any means necessary, President-elect Javier Milei is cooling things down a bit ahead of his inauguration on Sunday.

Vehicles drive past posters of presidential candidate and current Egyptian President Abdel Fattah al-Sisi ahead of the presidential elections to be held inside the country next week, in Cairo, Egypt, December 5, 2023.
REUTERS/Mohamed Abd El Ghany

Sorry to be a spoiler here, but: Egyptian President Abdel Fattah el-Sisi is going to win this weekend’s election, and it won’t be close.

FILE PHOTO: The President of the Republic of Turkey, Mr. Recep Tayyip Erdogan, and the German Chancellor Olaf Scholz speak at a press conference in Berlin on November 17th, 2023.
ddp/Andreas Gora via Reuters

Just days after the Swedish foreign minister said he was confident his country would join NATO “within weeks,” Turkish President Recep Tayyip Erdoğan has thrown up another roadblock.

University of Pennsylvania President Liz Magill testifies before the House Committee on Education and the Workforce in Washington.
REUTERS/Ken Cedeno

University presidents should not have to duck behind talking points and prepared statements to answer a basic question about human decency. Higher education should not mean lower common sense.