Why aren't people who use ransomware to extort money from people arrested?
- Using ransomware is illegal, presumably.
- The idea that Bitcoin is anonymous is a myth.
Given this, it seems like they should be arrested. Is there a reason they aren't?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
For the same reason for which other kinds of hackers aren't arrested. They may be trackable by the transactions. Unless they have a good system of money laundering. In addition there's usually the problem with international jurisdiction, etc, etc.
The bitcoin transactions may be run via hacked accounts and/or may be run over multiple accounts that are distributed over the world. There are thousands of ways to make money-streams (partially) untrackable. Bitcoin might only be a single station in the path of the money, till it finally reaches the distributor of the ransomware. This may be of interest, regarding the topic of money-laundering, as it (probably) describes a real-world case.
It's just like with any other new field of illegal activity: arrest one person, two others pop up and take the place. The resources of police are restricted, the number of developers too high, etc... There actually are cases, where ransomware-devs are arrested (see Lukas's answer), but it's pretty tricky due to the points mentioned above and the number of ransomware software in the wild isn't likely to decrease, as long as there's no proper protection against it. As long as it's lucrative, there'll always be people who do it.
As @alexw already pointed out in his comment, the best way to protect yourself would be to regularly backup your data to an air-gapped system. The reason why ransomware still works is closely linked to the main-problem with this solution: it requires a user with a minimum of education on this topic, which is not the case with the average user.
The biggest issue surrounding "cyber" related crimes is that of attribution. The second biggest issues lies in collaboration by law enforcement agencies around the world. Let's look at the first issue, attribution: "Where did it come from/who did it." Many attacks are often chained via multiple connections until the attacker ends up at a destination. E.g.:
Attacker (in Ukraine) --> spam --> System in Spain System in Spain (compromised via spam) --> leverage/compromise system in China China --> scan blocks in the USA --> send data to system in Romania Romanian systems --> compromise system the USA
Someone in the United States (SIEM analyst, forensics individual, etc) will see that someone in Romania is attacking them. The amount of time it would take to figure out what occurred would be too costly. Not only would it be too costly, but because of the second biggest issue (collaboration), there WILL BE a dead end. The ASCII above diagrams spam, phishing, and network/system based attacks.
Let's move over to the second biggest hurdle. Collaboration. So we have data that tells us that someone in Romania 'hacked' / phished / etc our systems. So what? Call any law enforcement agency, and unless the crime runs into the millions, they will not give you the time of day. But let's say they do listen, and they really want to help. This is what will occur: (with days extremely conservative)
Your Law Enforcement (LEA) --> submit subpoena for discovery --> Local court (1 day) Local court grants subpoena --> LEA --> Submit subpoena foreign counterpart in Romania (1 day) Romanian LEA --> determine legal validity / jurisdiction (1 day) Romanian LEA --> good to go --> Subpoena ISP/NSP/etc (1 day) Romanian ISP/NSP --> go to their lawyers to follow the rules (1 day) Romanian ISP/NSP --> here are your logs --> Romanian LEA (1 day) Romanian LEA --> here is your data --> US LEA
US LEA "this attack actually started because this Romanian server was compromised. By someone in China." Do you think that China will deliver any data. See the issue with this? Whether it is bitcoin, phishing, spamming. It is very costly, complex, and time consuming. While many law enforcement organizations understand the complexities, and how bitcoins work, what do you think the outcome would be if say, I was arrested, and I could prove that a "bitcoin" scraping trojan was on my system. That MY system was also compromised. They wasted a lot of time, effort, and money on what?
This is your answer as to why they don't 'trace' the money. Unlike a credit card scam, where say a camera might have recorded someone physically cashing out at a register, things like bitcoin, digital transactions are extremely difficult to investigate and track. Especially when many malware bots/platforms have modules to steal, and or mine bitcoin 'pseudo-anonymously.'