Australia Requires Ransomware Victims to Declare Payments - Source: www.schneier.com

Comments

Vesselin Bontchev • June 2, 2025 10:38 AM

In principle, this is a good idea, since it should gather more data and give a better view of the big picture. I have two worries, though:

Will the anonymity of the victims be adequately preserved? If information about who exactly paid what keeps leaking, companies will start looking for ways to circumvent this law, which will kinda defeat its purpose.
Won’t it be used as a first step towards banning ransom payments completely? I’m strongly opposed to this idea, since it will hurt businesses, especially smaller ones.

JB • June 2, 2025 10:58 AM

Might be helpful to understand the scope of the problem. But to put an end to ransomware, you have to make it prohibitively expensive to ever pay any ransomware.

For Profit • June 2, 2025 11:55 AM

Ransomware is a for-profit industry. If payments cease, profits cease, ransomware will cease.

wiredog • June 2, 2025 12:33 PM

@Vesselin Bontchev
I see no problem with either banning ransomware payments, or requiring insurance to cover the payments. Either way small businesses get hurt by higher costs, but also either way ransomware becomes much less prevalent.

SocraticGadfly • June 2, 2025 1:03 PM

Re Vesselin, the bill says:

The law, initially proposed last year, only applies to organizations with an annual turnover greater than AUS $3 million ($1.93 million) alongside a smaller group of specific entities working within critical infrastructure sectors. The turnover threshold is expected to capture just the top 6.5% of all registered businesses in Australia, comprising roughly half of the country’s economy.

Such companies shouldn’t be anonymous. I think that some sort of “name and shame” is in fact the bill’s purpose. If you the public can’t trust Big Company X to have better cybersecurity, you should know that.

Clive Robinson • June 2, 2025 2:40 PM

@ SocraticGadfly, ALL,

With regards the legislative notion of,

“… only applies to organizations with an annual turnover greater than AUS $3 million ($1.93 million) alongside a smaller group of specific entities working within critical infrastructure sectors.”

Is a legal nonsense that is easily avoided by “corporate engineering”.

Look up the history of “breaking up companies by law” what you end up with is a number of smaller companies that are not in competition with each other…

Then consider for instance the actual control is maintained in a small “financial entity” that looks like an offshore bank/investment organisation that controls the IP by way of “moving assets out” and “leasing back” to “move money out” continuously to repeat the “assets out” and as is often the case “two bums around the the top table”…

Clive Robinson • June 2, 2025 3:05 PM

@ Bruce, ALL,

With regards,

“A new Australian law requires larger companies to declare any ransomware payments they have made.”

In many countries that are based on “english common law” the legal situation is different to that of the US.

There is not the concept that free speech overrides the “right to fair trial”. Thus as we so often see in the US it’s “trial by media” and no way an unprejudiced jury can be found.

The result of this nonsense is it lowers the conviction rate on those who can buy expensive representation whilst the false conviction rate for those who can not pay goes up so much the US incarceration rates are so appalling compared to other Western Democracies.

Clive Robinson • June 2, 2025 3:54 PM

@ Bruce, ALL,

The downside of the UK judicial system is that a trial can take many years to come to trial.

Thus the “Right to fair trial” in effect acts as a “gag order” on “the evidence”…

Which means that declaration of the ransomware demand in effect “prejudices the judicial system” for later trial of any suspected ransomware perpetrators.

So the longterm needs of the judicial system is in effect in conflict with the short term needs of corporate security etc.

It’s one of the reasons we have a specialised form of “guard labour” we call the “Police”. Who in theory can investigate without prejudicing the judical system or more importantly society it’s self.

This law in effect “breaches that firewall” and the long term effects are unknown but most likely considering current political directions toward the authoritarian will be significantly detrimental to society and individuals.

Remember,

“Justice has to happen, not be a show for the vigilante beast.”

Dave • June 2, 2025 8:03 PM

I think it’s a good thing, along the lines of mandatory breach notifications: Before that, everyone swept it under the carpet and we knew there was a problem but had no idea how big it was, “doesn’t seem to be a big thing, no point spending money trying to mitigate it”. Afterwards, we started getting some good data, which made it easier to justify mitigations. We need the same for ransomware, where we’re in exactly the same situation, “it only catches a few suckers, we don’t need to do anything”.

TimH • June 2, 2025 8:19 PM

@Dave: Not just that. If a company is breached, regardless of what the perp claims in terms of data copied and retained, and regardless of any payoff, who trusts a perp not to have retained a valuable data dump?

Besides, it needs to be public which orgs “take privacy very seriously” with words but not proactive and costly preventative actions.

Subscribe to comments on this entry