Reputation among thieves: ransomware and kidnapping

Like everyone else, I occasionally get notifications of data breaches from organizations with which I have digital relations.  Often the breach involved a third party.  Sometimes the breach involves the theft of data accompanied by a demand of ransom--i.e. the victim is invited to pay the cybercriminal, who then promises to destroy the data instead of selling it on the dark web or otherwise using it.

This bears some resemblance to the kidnapping business, and its high-seas version, piracy.

Here's part of an email I recently received informing me of such a breach, and subsequent payment of ransom.

"I’m writing to inform you that Blackbaud, the company that hosts [xxx’s] relationship management system, suffered a security incident in May. Blackbaud is the world’s largest provider of fundraising technology for non-profits and educational institutions, and many organizations have been impacted by this incident.

...

"We were also informed by Blackbaud that in order to protect data and mitigate potential identity theft, it met the cybercriminal’s ransomware demand. Blackbaud has advised us that it received assurances from the cybercriminal and third-party experts that the data was destroyed. Blackbaud has been monitoring the web in an effort to verify the data accessed by the cybercriminal has not been misused. "

************

Why should "assurances from the cybercriminal" be reassuring? (and for how long?).  And what are the roles played by "third-party experts"?

My guess is that, as in the kidnapping biz, intermediaries have emerged to conduct the negotiations, get some sort of assurances, and make it possible for criminal organizations to maintain reputations for honor among thieves.

It is of course possible to regard ransom paying as a repugnant transaction that facilitates ransomware, kidnapping, etc.  In fact the U.S. for some time made it a crime to pay ransom to kidnappers, but relaxed that view over time, as kidnapping became a bigger international business, and there was often a considerable desire (sometimes covered by insurance) to pay ransom when it seemed the best way to recover the kidnapped person alive.

Here are some related posts which touch on that story:

Monday, June 24, 2019  Kidnapping insurance

Tuesday, September 13, 2016 Ransom as a (not so) repugnant transaction

Saturday, June 27, 2015 Ransom as a repugnant transaction--the U.S. relaxes its position

Monday, August 9, 2010 Brokers for pirate ransom

Saturday, December 5, 2009 Market for kidnapping

Friday, February 13, 2009 Pirate ransom: counterparty risk in the endgame

Sunday, November 30, 2008 Pirate ransom: counterparty risk

Ransom as a repugnant transaction--the U.S. relaxes its position

The U.S. is revisiting laws and policies against paying ransom to pirates, terrorists and other hostage takers.

In New Hostage Policy, U.S. Will Not Prosecute Families for Paying Ransom

"After a six-month review that included discussions with families of people held overseas, the White House said the government will continue its longstanding policy of not making concessions to hostage-takers.

But it will no longer threaten families who decide to pay ransoms. The government may communicate with hostage-takers and intermediaries, and it may help families who are trying to pay ransom, the White House said."
**********

Obama Announces New Hostage Response, but No U.S. Ransoms

"The president reasserted the main plank of U.S. policy that, unlike some allies, the government would not make concessions or pay ransom to hostage takers, saying this would enrich the militants and encourage further abductions.

However, he set out a more cooperative policy in which the government would work with the families, and said a special presidential envoy would be appointed to coordinate the efforts of law enforcement and diplomats.

Government officials would now be allowed to communicate and negotiate with hostage takers.

The new approach was drawn up over six months after complaints by families that their initiatives to free relatives had been discouraged and sometimes blocked by officials who threatened legal action if they raised a ransom privately.

He said - as did a separate statement from the Justice Department - that such threats should never happen again, and that no American had been prosecuted for paying a ransom.

The new approach, set out in a presidential directive, allowed "communication with hostage takers by our government, the families of hostages or third parties who help these families," Obama said."
**********

Kidnapped Missionary Was Freed as U.S. Tested Hostage Policy Shift - Family

"The family of a U.S missionary kidnapped in Nigeria earlier this year said on Thursday it paid a ransom to secure her release in March while receiving around-the-clock guidance from federal agents under a newly changed hostage-response policy."

Piracy watch: can security off the coast of Somalia be privatized?

Steve Leider writes:

Piracy season is resuming off the coast of Africa with the end of the monsoon season.  Several attacks have already been thwarted by ships newly equipped with safe rooms:

Over the weekend, pirates boarded the Greek-operated MV Lugela in the Indian Ocean but were frustrated to find the Ukrainian crew had locked itself in a safe room and disabled the engine.  Unable to hold the mariners' lives to ransom or steer the ship back to base, the pirates left the cargo.

Nick Davis, a piracy expert with the United Kingdom-based Merchant Maritime Warfare Centre, explained that such panic rooms were cheap and effective.  "You need a strong master, a well-stocked citadel, so you can sit there for up to five or seven days and wait for the cavalry," he said. "If the pirates have a dark ship and no crew, they'll just look for another."  But he stressed the importance of having functioning communications equipment in the citadel.

Earlier in September, pirates boarded a German-owned ship in the Gulf of Aden. Failing to find the crew, they even called the vessel's operator out of frustration, only to be told the ship was broken and the crew "on holiday".

Unfortunately only half of the ships active in the area are believed to have such a safe room.

A multi-national naval force is also currently patrolling the area, however it has yet to substantially reduce piracy.  A major UK insurer is suggesting the creation of a private navy to be placed under the command of existing international force to augment their activities:

A leading London insurer is pushing ahead with radical proposals to create a private fleet of about 20 patrol boats crewed by armed guards to bolster the international military presence off the Somali coast. They would act as escorts and fast-response vessels for shipping passing through the Suez Canal and the Indian Ocean.   Jardine Lloyd Thompson Group (JLT), which insures 14 per cent of the world’s commercial shipping fleet, said the unprecedented “private navy” would work under the direct control of the military with clear rules of engagement valid under international law …

Sean Woollerson, a senior partner with JLT, told The Independent: “We are looking at setting up a private navy to escort vessels through the danger zones. We would have armed personnel with fast boats escorting ships and make it very clear to any Somali vessels in the vicinity that they are entering a protected area.

“At the moment there is a disconnect between the private security sector and the international naval force. We think we can help remedy that and place this force under the control of the multi-national force. We look after about 5,000 ships and have had 10 vessels taken in total, including a seizure where one crew member was shot and killed. Piracy is a serious problem, these are criminals basically extorting funds, so why not do something more proactive?”

The force, which would have set-up costs of around £10m, would be funded by insurers and shipping companies in return for a reduction on the anti-piracy insurance premiums, which average around £50,000 per voyage and can reach £300,000 for a super-tanker. The maritime insurance industry, much of it based in London, has borne the brunt of the financial cost of the piracy problem, paying out $300m (£191m) in ransoms and associated costs in the last two years alone.

Major obstacles remain before the private navy can set sail, such as the legal status of a private force and it relationship with the Nato-controlled naval fleet. But major shipping companies and key insurers are keen to proceed with the plan. Although private contractors already offer armed teams on board vessels, the idea of a sizeable industry-funded naval force is a major departure and evidence of the strength of feeling there that more needs to be done to counter piracy.

The proposed “private navy” would therefore act in a somewhat similar fashion to the private security contractors operating in Iraq.  It will be important to clarify whether the navy would qualify as a mercenary force.  While mercenaries have historically been an important part of warfare, modern international law discourages mercenaries by withholding from them the protections afforded other combatants.  Article 47, Protocol I of the Geneva Convention regulates mercenaries as follows:

1. A mercenary shall not have the right to be a combatant or a prisoner of war.
2. A mercenary is any person who:
(a) is specially recruited locally or abroad in order to fight in an armed conflict;
(b) does, in fact, take a direct part in the hostilities;
(c) is motivated to take part in the hostilities essentially by the desire for private gain and, in fact, is promised, by or on behalf of a Party to the conflict, material compensation substantially in excess of that promised or paid to combatants of similar ranks and functions in the armed forces of that Party;
(d) is neither a national of a Party to the conflict nor a resident of territory controlled by a Party to the conflict;
(e) is not a member of the armed forces of a Party to the conflict; and
(f) has not been sent by a State which is not a Party to the conflict on official duty as a member of its armed forces.

Somali Pirates

U.S. Forces Free Ship From Somali Pirates

"American officials said the rescue appeared to be the first time the American military had boarded a ship commandeered by Somali pirates, who have been hijacking vessel after vessel off Somalia’s coast and wreaking havoc on some of the busiest shipping lanes in the world.
"The Americans, however, are active in the area. Last year, Navy Seal snipers killed three pirates who were holding an American cargo ship captain in a lifeboat, after he had offered himself as a hostage in exchange for the safety of his crew.
"Despite the intense international naval presence in the region, the pirates are on track to have another banner year, with more than 30 ships hijacked so far in 2010, which has earned them tens of millions of dollars in ransoms. "

However, piracy seems to be becoming fully entrenched in the fabric of Somali political culture: In Somali Civil War, Both Sides Embrace Pirates

"For years, Somalia’s heavily armed pirate gangs seemed content to rob and hijack on the high seas and not get sucked into the messy civil war on land. Now, that may be changing, and the pirates are taking sides — both sides.

"While local government officials in Hobyo have deputized pirate gangs to ring off coastal villages and block out the Shabab, down the beach in Xarardheere, another pirate lair, elders said that other pirates recently agreed to split their ransoms with the Shabab and Hizbul Islam, another Islamist insurgent group.
"The militant Islamists had originally vowed to shut down piracy in Xarardheere, claiming it was unholy, but apparently the money was too good. This seems to be beginning of the West’s worst Somali nightmare, with two of the country’s biggest growth industries — piracy and Islamist radicalism — joining hands."

Brokers for pirate ransom

Suppose your ship were hijacked by Somali pirates, and you wanted to ransom it and the crew. How would you go about it?  You would need a middleman, someone who could get the money to the right pirates, and maybe who played a repeated game with them, to help ensure that the release would go as planned. As it happens, you might become the client of a certain kind of British law firm, whose market is now threatened by the imposition of sanctions against those who deal with certain named Somali pirates. The problem is, it may be impossible to pay a ransom without doing business with the embargoed individuals. The Financial Times reports: Somali crackdown threatens City role on ransoms

"International plans for a legal crackdown on the funding of piracy could scupper a burgeoning City industry.
"The United Nations plans for sanctions on two suspected pirates would hit the often lucrative work of the law firms, insurers and private security companies in London that quietly arrange ransoms to free kidnapped ships and crews."
...
"The government has decided to block the UN plans amid worries they could force shipowners and their advisers to stop paying ransoms or else risk prosecution.


"London’s piracy negotiation business brings together an unusual cast of characters, from hard-bitten security operatives to dapper lawyers making telephone calls to hijacked ships from offices close to the banks of the Thames.


"NYA International, a kidnap response specialist based off Bishopsgate and now part of Aon, the US insurance broker, has advised on more than 20 piracy incidents during the past 18 months or so.


"The leading ship hijack case law firm in terms of numbers of clients is said to be Holman Fenwick Willan, which has offices north-west of the Tower of London.


"James Gosling, partner at HFW, said: “Nobody wants to pay ransoms. But when it’s the only option, what the hell else do you do?” "
...
"The concern about sanctions is that, while they do not explicitly outlaw the payment of ransoms, they make it impossible in practice because of the uncertainty about where money given to pirates will end up.

“The problem is the due diligence,” Mr Roberts said. “How can you possibly know if the money is going to that [sanctioned] person or not?”

"Maritime lawyers in London say they were encouraged by a High Court ruling this year that paying ransoms wasn’t contrary to British public policy, although they admit the argument over the subject is increasingly becoming political rather than legal.

"That is why the capital’s community of piracy-related businesses is appealing to the government to hold firm in stopping the UN proposal and the sanctions it would introduce.

"As one London-based insurer, who asked not to be named, put it: “We would be very concerned if shipowners were denied a means to free pirated ships.

“There are no navies prepared to go all guns blazing to rescue people – and it wouldn’t work, either.” "

Piracy and anti-piracy: recent developments

Russian Destroyer Frees Hijacked Oil Tanker (May 6, 2010)

"Cmdr. John Harbour, a spokesman for the European force, said Thursday that the Russian warship had freed the tanker, the Moscow University, after its crew members locked themselves into the rudder compartment of the ship."

Piracy and armed merchantmen

Why is this headline such an outlier? Cruise ship opens fire to beat back Somali pirates

One reason is that ship owners are concerned about the longer term effects of escalating the level of violence in their encounters with pirates. But, it turns out, there are some market design reasons too (emphasis added):

"There have been calls for commercial ships to be allowed to carry weapons to deter increasingly bold pirate gangs, who are armed with automatic rifles and often rocket-propelled grenades.
But ships with arms onboard are not allowed to dock at non-military ports.
To bypass this rule, some operators are hiring private security teams who board as the ship enters a risky stretch of water and leave once the danger has passed.
Andrew Mwangura, head of the East African Seafarers' Assistance Programme in the Kenyan port of Mombasa, criticised the Melody for carrying guns.
"There are a number of other methods which can be used to deter the pirates, having weapons on board is dangerous because it raises the stakes for the pirates," he said.
"There is a far higher risk that a crew member of a merchant vessel, or a passenger, could die if the pirates feel they must fight harder to win the ship." The International Maritime Bureau said piracy incidents nearly doubled in the first quarter of 2009, almost all of them off Somalia. There were 18 attacks off the Somali coast in March alone.
Pirates have made millions of dollars from seizing ships and taking crews hostage. A Greek ship was released on Saturday after a £1.3 million ransom was paid.
But just hours earlier a German grain carrier was grabbed in the Gulf of Aden. "

Pirate ransom: counterparty risk in the endgame

The NY Times reports that Hijacked Arms Ship Limps Into Port (this is the Ukranian ship full of Russian tanks and other heavy weapons that I blogged about earlier).

An earlier report, Somali Pirates Said to Be Leaving Ship , sheds some light on the negotiations:
"Somali pirates freed a Ukrainian ship carrying tanks and other heavy weapons Thursday after receiving a $3.2 million ransom. The U.S. Navy watched the pirates go but didn't act because the pirates still hold almost 150 people from other crews hostage." ...
"U.S. seamen were inspecting the pirates' departing boats to make sure they weren't taking weapons from the Faina's cargo, Mikhail Voitenko, a spokesman for the ship's owners, said Thursday.
But the Navy was not taking action against the pirates because it did not want members of other crews still in captivity to be harmed, said Cmdr. Jane Campbell, a spokeswoman for the 5th Fleet in Bahrain.
''Even when you release Faina, there are still 147 mariners held hostage by armed pirates,'' Campbell told The Associated Press. ''We're concerned for their well-being.''"

This is the same U.S. Navy one of whose first missions was to fight the Barbary Pirates , an earlier African/Islamic manifestation of piracy. (Do you say a Navy won its wings? spurs? water wings?). So it is very plausible that the pirates worry that, when they release their last hostages, they will face military retaliation against their bases in Somalia.

This will make the endgame tricky.

Pirate ransom: counterparty risk

Arranging to deliver the ransom for the Ukranian ship captured by Somali pirates, and to receive the ship and hostage crew in return is a delicate matter without a legal framework to reduce the counterparty risk (sort of like a drug buy): Mediator Says Ransom Deal Has Been Reached for Pirated Ukrainian Freighter

"Andrew Mwangura, who as head of a Kenyan maritime association has helped mediate the situation, said Sunday that the Somali pirates who captured the freighter more than two months ago and the ship’s owners had agreed on a ransom. He would not reveal the figure, but he said that the only thing left was to figure out how to get the money to the pirates and hand over the ship.
Still, that is no simple feat, given the band of jumpy pirates on board and the half-dozen American and European naval vessels circling the freighter."

The related story in the Telegraph notes that
"The US military has overflown the hijacked vessel several times to take pictures of the crew lined up on the bridge and verify that all were in good health. "

Piracy

The LA Times reports: Somalia's pirate problem grows more rampant

"Entire villages along the coast now engage in piracy. Unemployed youths provide the muscle. Idle fishermen offer boats and knowledge of the coastline. Foreign businessmen provide the money for guns, radios and satellite phones. Islamic hard-liners are lured by the chance to attack Western interests offshore.
The result is a criminal free-for-all. Pirate attacks off the coast of Somalia have tripled over the last three years, with nearly three a week in 2008, maritime officials say. Currently there are about a dozen hijacked ships, with more than 300 crew members, being held hostage. Ransom payments are often as high as $2 million."