A recent Ride the Lightning (RTL) blog post entitled “If You Are Hit by Ransomware, Do You Negotiate? If So, How?”, featured Sensei’s Sharon Nelson in an ALPS blog post. ALPS  is the nation’s largest direct writer of lawyer’s malpractice insurance.

 Excerpt:

The following post was originally published on October 1 on ridethelightening.senseient.com:

 If You Are Hit by Ransomware, Do You Negotiate? If So, How?

Man, that’s a good question. Why would you ever pay? Especially if you have good backups?

As cybersecurity expert Bruce Schneier notes in a blog post, there are solid arguments for and against paying a ransom.

Arguments cited by Schneier for making a ransomware payment include:

• Payment is the least costly option;
• Payment is in the best interest of stakeholders (e.g. a hospital patient in desperate need of an immediate operation whose records are locked up);
• Payment can avoid being fined for losing important data;
• Payment means not losing highly confidential information; and
• Payment may mean not going public with the data breach.

The arguments against making a ransomware payment include:

• Payment does not guarantee that the right encryption keys with the proper decryption algorithms will be provided;
• Payment further funds additional criminal pursuits of the attacker, enabling a cycle of ransomware crime;
• Payment can do damage to a corporate brand;
• Payment may not stop the ransomware attacker from returning;
• If victims stopped making ransomware payments, the ransomware revenue stream would stop and ransomware attackers would have to move on to perpetrating another scheme; and
• Using Bitcoin to pay a ransomware attacker can put organizations at risk. Most victims must buy Bitcoin on entirely unregulated and free-wheeling exchanges that can also be hacked, leaving buyers’ bank account information stored on these exchanges vulnerable.

See the ALPS blog here. 

Read the entire RTL blog post here.

“Video and Audio Deepfakes: What Lawyers Need to Know” by Sensei’s Sharon Nelson and John Simek was recently featured as a guest blog post in the Massachusetts Law Office Management Assistance Program’s (Mass LOMAP) blog. Mass LOMAP helps attorneys licensed, or soon to be, in Massachusetts to implement professional office practices and procedures.

Excerpt:

 We’re wrapping up Cybersecurity Awareness Month with an overview on what lawyers need to know about one of the most unnerving cybersecurity threats of our time: Deepfakes.

 We thank Sharon D. Nelson, Esq. and John W. Simek at Sensei Enterprises, Inc. for this helpful guest post!

If some nefarious person has decent photos of your face, you too (like so many unfortunate Hollywood celebrities) could appear to be the star of a pornographic video. If someone has recordings of your voice (from your website videos, CLEs you have presented, speeches you’ve given, etc.), they can do a remarkably good job of simulating your spoken words and, just as an example, call your office manager and authorize a wire transfer – something the office manager may be willing to do because of “recognizing” your voice.

Unnerving? Yes, but it is the reality of today. And if you don’t believe how “white hot” deepfakes are, just put a Google alert on that word and you’ll be amazed at the volume of daily results.

Political and Legal Implications

We have already seen deepfakes used in the political area (the “drunk” Nancy Pelosi deepfake, a reference to which was tweeted by the president), and many commentators worry that deepfake videos will ramp up for the 2020 election. Some of them, including the Pelosi video, are referred to as “cheapfakes” because they are so poorly done (basically running the video at 75 percent speed to simulate drunkenness), but that really doesn’t matter if large numbers of voters believe it’s real. And the days when you could tell a deepfake video by the fact that the person didn’t blink are rapidly vanishing as the algorithms have gotten smarter.

In August 2019, the Democratic National Committee wanted to demonstrate the potential threat to the 2020 election posed by deepfake videos so it showed, at the 2019 Def Con conference, a video of DNC Chair Tom Perez. The audience was told he was unable to come but would appear via Skype. Perez came on screen and apologized for not being in attendance—except that he had said no such thing. It was a deepfake.

Read the entire article here.