In 74BC a band of pirates made a terrible mistake when they captured a ship off the coast of Asia Minor, now Turkey. They kidnapped one of the passengers, a young Roman citizen named Julius Caesar, along with his entourage, and demanded a ransom of 20 talents (about 650kg in silver) for his release. Caesar, in his mid-20s and on his way to study rhetoric in Rhodes, burst out laughing. Didn’t they know who he was? He was worth 50 talents, not a mere 20! Unsurprisingly the pirates agreed to this higher ransom, and released some of Caesar’s associates to raise the money.
Pirates were the scourge of the Mediterranean, bribing their way around efforts to suppress them. But despite their fearsome reputation, Caesar refused to be intimidated. He told them to be quiet when he wanted to sleep, “as if the men were not his watchers, but his royal bodyguard”, writes Plutarch. He joined in their games and regaled them with speeches and poetry, mocking them as illiterate barbarians. Once he was free, he said, he would execute the lot of them. According to Plutarch, “the pirates were delighted at this, and attributed his boldness of speech to a certain simplicity and boyish mirth.”
When Caesar’s friends arrived with the ransom the pirates released him. He went straight to Miletus, a city on the coast of Asia Minor, raised a fleet and returned to the pirates’ camp. After helping himself to their treasure, he captured most of the pirates, took them to the city of Pergamon and asked the local governor to execute them. When the governor wavered, Caesar had the pirates crucified, even though he lacked permission to do so.
Like all entrepreneurs, criminals must constantly reassess the relationship between risk and reward
Later in his career Caesar used this story to illustrate the need to be tough on pirates, rather than turn a blind eye or demand a cut of their profits. But the anecdote has another lesson, one that is still relevant 21 centuries on. Like all entrepreneurs, successful criminals must constantly reassess the relationship between risk and reward.
Caesar’s captors had a poor grasp of the economics of extortion. Their hostage was more valuable than they bargained for: though young, Caesar was already a distinguished soldier, lawyer and orator. His aunt had been married to Gaius Marius, a famous general and seven times consul of Rome. His father had been governor of Asia Minor (which may explain why the people of Miletus were so willing to help). The pirates underestimated the risk they were taking by kidnapping him – with fatal consequences.
Medieval knights wore coats of arms on shields and armour which, in showing what illustrious family they came from, indicated their value as a hostage. This labelling system made them less likely to be killed in battle: they were worth more if captured alive.
King Richard I of England was kidnapped in 1192 on his way home from the crusades. Henry VI, the Holy Roman Emperor, demanded 45 tonnes of silver (the origin of the phrase “a king’s ransom”). Henry played his hand well: he made Richard swear an oath of allegiance to him, ignored the pope’s objections that he had imprisoned a crusader, then used the ransom to fund an invasion of Sicily. He correctly judged both risk and reward.
In the 20th century kidnapping evolved into a criminal enterprise on a mind-boggling scale. Abducting the children of rich families made headlines, from the baby son of aviator Charles Lindbergh in 1932, to Patty Hearst, heiress to a media fortune, in 1974. Then criminals realised that it made more sense to kidnap a higher number of lower-profile targets. In Argentina in the 1970s, guerrillas began kidnapping executives at big companies. Employers were reluctant to negotiate and paid whatever they were asked, which encouraged more kidnappings and caused ransoms to spiral upwards. In one case $60m was handed over – the highest known ransom paid in modern times.
In the 20th century kidnapping evolved into a criminal enterprise on a mind-boggling scale
The kidnappers’ bonanza didn’t last. Companies started to take out insurance against kidnapping and ransom, which meant they’d be reimbursed if ransoms were paid. But insurance companies demanded control of negotiations, and provided their own experts to negotiate with kidnappers. Skilled negotiators, who are trained to calm criminals and reduce the risk of harm to captives, may haggle a ransom down by 90%. With companies no longer willing to pay up instantly, the number of kidnappings fell. Holding hostages for longer increased the direct cost for kidnappers and made it more likely that they’d be caught. The rewards of kidnapping fell and the risks increased.
That didn’t stop some from having a go. In the 2000s the collapse of the government during the civil war in Somalia left waters unpoliced. Pirates took boat crews hostage and demanded ransoms from shipping firms, which – like the Argentine companies – initially caved in to their demands. The average ransom paid doubled between 2009 and 2011. Once again insurers stepped in, negotiating smaller ransoms, sharing information to ensure consistency of payments, and requiring companies to employ security guards on their ships. An international coalition also began operating naval patrols off the Somali coast. Piracy no longer made economic sense.
Modern kidnappers have pivoted from people to data. In “ransomware” attacks, cyber-criminals break into networks, encrypt data and demand money to unscramble everything. They have crippled meat-packing firms, hospitals and oil pipelines: in May 2021 a ransomware attack disrupted fuel supplies to America’s east coast (the pipeline company paid 75 bitcoin, or $4.4m, to recover its data). There are many more attacks we don’t know about.
Kidnapping data is less risky than kidnapping people and the rewards can be large. Barriers to entry are low, with criminals needing little technical expertise. “Initial access brokers” break into networks and sell their backdoor pass on the dark web, where you can also buy ransomware software. You can even outsource the business of negotiating a ransom. Probing companies’ networks for vulnerabilities is quick and easy and there are millions of potential victims.
Ransomware attackers have few overheads: cyber-criminals were pioneers of WFH
There are few overheads: cyber-criminals were pioneers of WFH and can operate from anywhere in the world. No wonder there has been a huge increase in ransomware attacks during the pandemic. According to Chainalysis, a cyber-security firm, the amount paid in bitcoin ransoms quadrupled between 2019 and 2020, to around $350m.
What should the authorities do? As always, they need to change the criminals’ economic incentives, by making the risks larger and the rewards smaller. They could make organisations disclose cyber-attacks, shaming them into tightening up security. They could ban insurers from reimbursing ransom payments. They could impose sanctions on countries that harbour cyber-criminals, like Russia, Iran and China.
They could also try “cyber-retaliation” – giving criminals a taste of their own medicine. In July REvil, a ransomware operation suspected to be based in Russia, went offline, which experts suspect may have been the result of an offensive operation by Western powers. (Others think the Russian government shut the group down, worried it had gone too far, or that the criminals might simply be lying low before relaunching under a different name.)
Data-kidnappers may demand ransoms in cryptocurrency rather than piles of silver, but the economics of extortion are the same as in ancient times. Though Caesar’s captors didn’t understand the relationship between risk and reward, modern kidnappers certainly do. And so do those trying to stop them. To get the upper hand, hit cyber-criminals where it hurts: their profit margins. ■
Tom Standage is deputy editor of The Economist
ILLUSTRATIONS: BRETT RYDER
From pirates to ransomware: the secret economics of extortion - The Economist
Read More
No comments:
Post a Comment