The latest cyberattack, apparently emanating from Russia again, has hit at least 20 software firms affecting at least 1,000 businesses. It follows a cyberattack that left parts of the U.S. without adequate gasoline supplies for several days, and one on the Irish public health system. There are undoubtedly many more attacks that go unreported, if only because the victims do not wish to advertise their willingness to pay ransom.
And so the obvious question arises: How is all this supposed to stop? For an answer, it’s useful to apply some game theory.
The scalability of the internet can be a major virtue. But it also makes it easier for vices to proliferate. There are now the equivalent of venture capital markets to help fund ransomware attacks.
Consider street crime, for example. There is a natural limit to it if only because most people have better options than to pursue such a life, and many who do so are simply not good at it and get caught. What’s more, street crime is constrained by the need for physical presence; you can only commit so many carjackings in a month.
In the cyber realm, these constraints do not apply. In low-wage, low-trust countries, such as Russia, you can just hire more hackers to pull off more attacks. Even if the perpetrators can be identified, Russia doesn’t seem so eager to help U.S. law enforcement. Other havens for cybercriminals could emerge.