Colonial Pipeline forked over $4.4M to end cyberattack -- but is paying a ransom ever the ethical thing to do?

It took little over two hours for hackers to gain control of more than 100 gigabytes of information from Colonial Pipeline on May 7, 2021 -- causing the firm to shut down its fuel distribution network and sparking widespread fears of a gasoline shortage. The decision to pay off the attackers was also made with apparent speed, but the ethical arguments involved are age old and the implications could reverberate well into the future.

Cyberattacks, including those on critical infrastructure in the U.S., are nothing new. Ransomware, a type of malicious software that locks access to a computer until a ransom is paid, has been a component of the cyberthreat landscape since the mid-2000s. But the Colonial Pipeline breach raised the stakes and highlighted the ability of ransomware to interrupt the vital services on which Americans rely.

As scholars of cybersecurity policy, in particular critical infrastructure protection and ransomware, we think it important to consider the legal and ethical questions surrounding ransomware payments -- just because paying off cyberattackers may be lawful in some contexts, that still doesn’t make it the morally correct thing to do.

To pay or not to pay

It has been widely reported that the Colonial Pipleline CEO Joseph Blount agreed to pay a US$4.4 million ransom to DarkSide, the Russia-based group behind the cyber attack.

In describing his decision, which he said did not come lightly, Blount argued that it was justifiable given that it was “the right thing to do for the country.”

Official guidance suggests otherwise. In October 2020, the Treasury Department warned that ransomware payments are a violation of its rules and would only encourage future demands. Although there is no federal legislation, such states as California, Texas and Michigan have cyber-extortion laws on the books that discourage ransomware payments.

Often, though, the decision of whether to pay falls in a legal and ethical gray area.

CEOs can turn to three main schools of ethics in guiding decisions about whether to pay ransoms based on virtues, duties and consequences.

Under virtue ethics, which traces its origins to philosophers Plato, Aristotle and Confucius, people make decisions based on a set of virtues or character traits such as honesty and loyalty. In and of itself, the tradition does not help in situations that require weighing one virtue against another, such as not wishing to reward criminal activity against preventing disruption to the wider American public. For example, Colonial Pipeline CEO Blount expressed a moral distaste in paying “people like this,” but ultimately decided to override that concern based on other factors.

Another way to approach challenging ethical decisions is through what is called the deontological approach, which holds that actions are good or bad determined by a clear set of rules. So another way to come at the question of whether to pay a ransom is to ask, “How does doing so align with recognized universal duties?”

The problem with cybersecurity is that, given the rapidly changing technological and regulatory environment, it is not always clear what the “golden rules” are, or even if any have been established. Some business leaders may even perceive a duty to pay as Blount did, especially in the case of critical infrastructure such as pipelines on which so many people rely.

The ethics of ransomware payments can also be viewed through the consequences of the decision to yourself, your family, your organization and, as Blount suggested, the country and the world. Utilitarian philosophers hold that what is important is promoting the greatest good for the greatest number of people.

This is often described in boardrooms and policy circles as cost-benefit analysis. Yet it’s not always clear where to put that next dollar of investment to maximize the good and minimize the harm in the long term. In dealing with ransomware, for example, backing up data is key, as is practicing zero-trust security, an approach in which companies assume that their networks are already compromised and act accordingly. But doing so can be complex, and investments might cause fewer benefits than if the money were invested elsewhere.

Pros of paying

In practice, business leaders use all these ethical tools, and more, in deciding whether or not to pay -- and there isn’t much time to weigh the options. Colonial Pipeline CEO Blount’s decision reportedly came almost immediately.

And it isn’t universally accepted that Colonial Pipeline came to the right decision.

Some cybersecurity professionals want to ban paying out ransoms to halt the growing problem of malware attacks for profit. Others say banning payments would be a “horrific game of chicken” in which cyberattackers up the stakes until the consequences of not breaking the law are greater for the companies involved than the impact of the breach. And banning ransom payments outright would place an impossible burden on smaller businesses or organizations that do not have the resources to protect against malicious actors.

The thinking behind banning payments is that attacks might stop if they don’t yield payments. Yet if the attack has the capability of paralyzing an entire entity, paying up is often the economically rational decision in the short term. An attack on the Irish Healthcare System in May, for example, is expected to cost tens of millions of euros to rebuild the network. Cybersecurity experts estimate that companies hit by attacks take an average of 287 days to fully recover to normal operations.

Ransomware as a service

The rapid proliferation of attacks has been fueled by a new business model known as “ransomware as a service.” Ransomware developers sell personalized variants to “affiliates”-- cybercriminals who deploy the ransomware.

With the emergence of ransomware as a service, ransomware can be profitable for both the developers of the variant and the affiliates.

Not all affiliates and ransomware developers are governed by the same moral code. DarkSide, which conducted the Colonial Pipeline attack, has its own set of principles, which include not attacking certain targets, such as medical services, the educational establishment and nonprofit organizations.

DarkSide has also been known to promise it will completely leave a network alone after ransom is paid.

The FBI discourages payment, partly on the grounds that it is not a guarantee that a company will not be hit again.

But the message is mixed. Law enforcement agencies encourage victims not to pay, but paying ransom is not illegal, and even police departments have been known to pay up when their systems have been compromised. And while the Treasury Department has been investigating new financial penalties against payment of ransoms, to date none have been levied.

But even without the threat of legal sanction, payment of ransomware will continue to pose a moral dilemma.

This article was first posted on The Conversation.