eBay sellers can no longer use PayPal under new terms

New terms of use for eBay have come into effect which mean the online auction house will now pay sellers directly rather than through PayPal.

PayPal was acquired by eBay in its early days in 2002, and the two firms have worked in partnership ever since.

The changes mean that while eBay buyers can still pay with PayPal, sellers will be paid straight into their bank accounts.

But some sellers have threatened to stop using the service over the move.

EBay’s forums have several posts from sellers who say they are reluctant to use the new system and give eBay direct debit access to their personal bank accounts.

But the new terms, effective from 1 June, say the new “managed payments” system is compulsory, and the company has the power to limit or remove listings from sellers who refuse to use it.

The company says the new system is simpler, convenient, and gives buyers more payment options – and the rollout will be gradual.

It marks a significant change in an almost two-decade partnership with PayPal, which split from eBay in 2015.

What’s changing?
The managed payments system means that PayPal fees will no longer be added to the process, though eBay has made its own fees slightly higher.

But the company claims most people will pay the same as – or less than – before.

The new system is 12.8% of the final amount including delivery, plus 30p in the UK ($0.30 in the US). The old system was 10% for eBay, plus PayPal’s fees, plus 30p. The difference favours the new system to the tune of pennies for most transactions.

The move also means that buyers will automatically have access to every payment option available – including credit and debit cards, Apple Pay, Google Pay, PayPal, and PayPal Credit.

eBay boosted by Christmas surge in online orders
Regulators allowed to take down eBay listings
However, payments will now take two working days to be transferred, while PayPal was usually on the same day.

The feature has been rolled out since about 2018, an eBay spokesperson said – with business sellers moving first. An estimated four million sellers are already using it.

The deadlines for all users are phased – so while many sellers are required to move to the new system from 1 June, others will receive a message from eBay in the coming weeks and months.

What’s the problem?
The terms and conditions make using the new system mandatory.

In part, the reluctance is because eBay has a strong reputation for protecting buyers – sometimes at the expense of sellers. Some unscrupulous fraudsters have been known to buy a product on eBay, swap it for a damaged or different item, and return the package demanding a refund.

Some sellers believe eBay regularly sides with the buyer in such cases – and fear that refunds would be taken out of their bank accounts under the new system.

Late last year, ahead of the impending change, another forum user wrote: “They are so heavily biased in the buyer’s favour… I am simply not prepared to switch to this new [system] and give eBay direct access to my bank account.”

EBay, for its part, says the direct debit scheme adheres to the same rules any other direct debit, such as a phone bill. That means customers will have advance notice of how much is being taken out, and any incorrect or fraudulent payments should be refunded.

Other users were confused by the switching process requiring them to enter their online banking usernames or passwords. But those credentials are only used by the bank. The company says it does not have any actual direct access to sellers’ bank accounts.

Noisy appliances: How loud is your house?

In a residential street in south London, dozens of household appliances are being put through their paces – not to measure how well they work, but how loud they sound.

The room we’re in is officially a laboratory. There’s no soundproofing in sight: noise bounces gleefully off the sort of hard surfaces and shiny floors you’ll find in many modern homes.

A device shaped like a human head is rigged up to a monitor displaying colourful graphs, recording every whizz, rattle and beep.

Environmental consultancy firm Quiet Mark has spent the last 10 years awarding its colourful “Q” logo to the quietest household appliances in every category you can think of – from hairdryers and air purifiers to kettles and washing machines.

It’s something of a labour of love for founder Poppy Szkiler, whose grandfather, John Connell, established the Noise Abatement Society in 1959.

She says that since the start of the Coronavirus pandemic, people have become a lot more conscious of the noise inside their homes.

“It’s becoming a mega-trend,” she says.

“People are looking to create more peaceful homes because life has become literally under one roof.”

Now the firm, which describes itself as a consumer champion, is looking to change the way we measure sound. Currently when you shop for an appliance, if it does have a noise rating, that figure will be in decibels – and that tells you how loud it is.

Ms Szkiler says about 40 decibels (dB) is ideal for inside the home.

However, 40dB of a smooth, consistent hum is very different from 40dB of clunking, rattling or screeching.

Currently, though, unless you work in the field of acoustic sciences, there’s no consumer-friendly measurement for overall sound quality.

Quiet Mark is on a mission to change that and is currently researching ways to include sound quality in the rating it awards the products it assesses.

“In addition to decibels, we are measuring tumble dryers, which often have a big droning sound, and we’re measuring jeans – and how the buttons hit the centre of the drum – to measure the sound quality, the pitch and tonality. And we are seeing which appliances are best insulated and isolated, for the best noise reduction within our home,” she explains.

There isn’t even a term for it yet – but there is a demand.

Quiet Mark is already listed on the sites of various UK retailers, including Argos, Littlewoods and John Lewis.

John Lewis’s technology director, Laurence Mitchell, says there are more than 10,000 searches a month for appliances that include the term “quiet” on the retailer’s website.

There’s a “quiet revolution” tab on John Lewis’s appliances page, and washing machines and kettles are the devices most likely to be linked to the search.

But he says consumers should be prepared to pay more for a quieter life.

“If you look at things like appliances, to have a lower noise level you may need things like an inverter direct-drive motor (which reduces the number of motor components, and therefore noise, particularly in washing machines), or increased dampening, and of course those things come with a cost,” he says.

Part of the difficulty in finding the right way to label sound quality is that it’s such an individual experience – what’s music to my ears may be painful to yours.

And on a serious note, continued exposure to loud noise has been linked to health conditions, including heart problems.

People who are neurodiverse may also find some sound challenging.

For example, Tom Purser, of the National Autism Society, says that autistic adults and children process sensory information – including sound – differently.

“For some autistic people, it will mean certain types of noise, certain tones, certain frequencies will be almost painful to them. But for some, there will be certain types of noise and sounds they really enjoy and find themselves seeking,” he says.

“It’s a very difficult experience when the world is full of so many different sorts of sound and noise on a daily basis.”

Poppy Szkiler admits she appreciates the sound of silence – the quieter her home environment, the better for her. She hopes that manufacturers will take note of a wider demand for tech that is seen but barely heard.

“There’s huge levels of integrity and wonder in engineering,” she says.

“Acoustic engineering is just as important as energy efficiency, or the way something looks, or its performance.”

Twitter: Social media giant lists new ‘Blue’ subscription service

Twitter has listed a new subscription service on app stores, in an indication that the social media giant is preparing to trial the offering soon.

“Twitter Blue” is listed as an in-app purchase, priced at £2.49 in the UK and $2.99 in the US.

Twitter has given no further details, and declined to confirm online claims that the service could allow users to “undo” tweets.

It previously said it was working on special features for paid subscribers.

Twitter adds ‘tip jar’ to pay for good tweeting
Twitter tells users to be nice and think twice
Twitter finds racial bias in image-cropping AIT
The firm wouldn’t comment directly on the listing but highlighted to the BBC that it had previously announced plans to diversify its revenue sources.

Although “Twitter Blue” is now listed on app stores, it isn’t yet fully enabled for users.

The BBC understands that pilot offerings of the subscription service are likely to start soon although it is unclear which countries it will be available in first.

According to technology blogger Jane Manchun Wong, who claims to be the first paying user of the service, it includes an “undo tweet” feature as well as a “reader mode” to make reading long threads easier. But Twitter has declined to confirm her claims.

The social media giant told the BBC that increasing “revenue durability” is the company’s top objective.

The firm also plans to continue developing and experimenting with other ways to diversify its revenues beyond advertising this year and further ahead.

These plans could also include subscription services and other ways to offer individuals and businesses access to special features on the platform.

Twitter has also made clear that it will continue to focus on growing its advertising business.

Last month, the company launched a new “tip jar” feature that allowed people to send money to others on the social network.

Twitter said the feature was “an easy way to support the incredible voices that make up the conversation”.

To begin with, only a select group of people can receive tips – a group Twitter said was made up of “creators”, journalists, experts, and non-profits.

The function adds a small icon to a user’s profile – on mobile devices only for now – with a drop-down menu for other payment providers such as PayPal, Venmo, or the Cash App, the latter two of which are popular in the United States.

But the announcement was not without controversy. Because the payment is made through those external systems, some Twitter users noticed that tipping a PayPal account lets the recipient know the postal address of the tip sender.

In other cases, the recipient’s email address could be seen, whether or not any money was sent.

Reporting by Peter Hoskins.

You might also be interested in:
Facebook and Twitter’s chief executives were asked during a US Senate hearing in November if there was evidence of their platforms being addictive.

Legality of collecting faces online challenged

Clearview AI, a US firm with a database of three billion facial images from the internet, is facing a new legal challenge from privacy campaigners.

Privacy International and others argue its methods of collecting photos and selling them to private firms and the police “go beyond what we could ever expect as online users”.

Clearview has said is has no contracts with any EU-based customers.

It said it had complied with requests to remove images of EU citizens.

Under GDPR rules, European citizens can ask the company if their faces are in its database and request that their biometric data is no longer included in searches.

Five such requests were submitted by privacy campaigners.

“We have voluntarily processed the five data access requests in question, which only contain publicly available information, just like thousands of others we have processed,” said Clearview.

It added that it had “helped thousands of law enforcement agencies across America save children from sexual predators, protect the elderly from financial criminals, and keep communities safe.”

It said that national governments had expressed “a dire need for our technology” to help investigate crimes such as money laundering and human trafficking.

‘Plain wrong’
The legal challenge, supported by the Hermes Center for Transparency and Digital Rights, Homo Digitalis and noyb was submitted to data regulators in France, Austria, Italy, Greece and the UK.

The New-York-based start-up uses an automated image scraping tool to collect any images containing human faces that it detects on the web. These are run through its facial recognition software and stored on a database, access to which is sold on to private companies and law enforcement agencies.

“Clearview seems to misunderstand the internet as a homogeneous and fully public forum where everything is up for grabs,” said Lucie Audibert, a legal officer at PI. “This is plainly wrong. Such practices threaten the open character of the internet and the numerous rights and freedoms it enables.”

“Just because something is online does not mean it is fair game to be appropriated by others in any way which they want to – neither morally nor legally,” said Alan Dahi, data protection lawyer at noyb.

“Data protection authorities need to take action and stop Clearview and similar organisations from hoovering up the personal data of EU residents,” he added.

Prof Alan Woodward, a computer scientist at Surrey University, said the case will open a complicated legal debate “about who owns images placed online and how possible it is to enforce any rights if the images are taken across a national boundary”.

And there will be more fundamental questions about whether Clearview is invading privacy “by using these images in their database to enable government agencies to identify individuals”, he said.

Californian opt-out
Clearview AI is no stranger to controversy and has faced a flurry of legal challenges.

The UK and Australian data regulators launched a joint probe last year, while Sweden has fined its national police authority for using the firm’s technology to identify people.

In February, Canada’s federal privacy commissioner Daniel Therrien ended a year-long investigation into the firm, concluding that it collected images without user knowledge or consent and demanding that it delete photos of Canadians from its database. During the investigation, Clearview announced it would no longer operate in Canada.

In the US, the American Civil Liberties Union is pursuing a lawsuit against the company in Illinois while Californian data laws mean users in the state can opt out of having their data sold, via a form on Clearview’s website.

The firm came to prominence in January 2020 when a New York Times investigation revealed its business practices.

Shortly afterwards, Twitter, Facebook and YouTube demanded that Clearview stop collecting images from its platforms.

The business has deals with hundreds of police forces in the US.

WhatsApp: Facebook-owned app goes to court over India privacy rules

WhatsApp is suing the Indian government over new digital rules that will force the messaging service to violate privacy protections.

It said rules that require tracing the origin of chats were the equivalent of keeping a “fingerprint of every single message sent on the service”.

In February, the government introduced new guidelines to regulate content on social media and streaming platforms.

India is WhatsApp’s largest market with about 400 million users.

The government’s rules for social media said that messaging platforms would need to make provisions for the “identification of the first originator of the information”.

Whatsapp filed a plea in the high court in Delhi asking it to declare the new rule unconstitutional.

In a statement, a WhatsApp spokesperson said that the rules “would break end-to-end encryption and fundamentally undermine people’s right to privacy”.

“We have consistently joined civil society and experts around the world in opposing requirements that would violate the privacy of our users. In the meantime, we will also continue to engage with the government of India on practical solutions aimed at keeping people safe, including responding to valid legal requests for the information available to us,” WhatsApp said.

According to the messaging service, traceability of texts would force private companies to collect and store billions of messages sent each day for the sole purpose of turning it over to law enforcement agencies.

Why India wants to track WhatsApp messages
The Indian government’s war with Twitter
It says that it would be impossible to understand the context and origin of a particular message as people generally see content on social media or websites and copy-paste them into chats.

The messaging service also said that tracing the origin of a message cannot be implemented in a foolproof way and would be highly susceptible to abuse.

On 25 February, the government rolled out sweeping regulations for social media and video streaming platforms, requiring them to remove any content flagged by authorities within 36 hours.

Social media platforms with more than five million users would be required to appoint a compliance officer, a nodal contact officer and a resident grievance officer.

In addition, they would have to track the originator of a particular message if asked by a court or the government.

Platforms like Twitter, Facebook and Whatsapp were given three months to comply with these rules.

However, the Indian Express newspaper reported that Facebook, Instagram and Twitter had not appointed officers as government regulations dictated.

Tesla fined in Norway over battery issues

A court in Norway has fined Tesla after a software update issued in 2019 slowed down battery charging speeds and affected the number of miles some of its vehicles could travel between charges.

The case was brought by 30 customers, reports Norwegian news platform Nettavisen.

The fine amounts to 136,000 Norwegian Krone (£11,500) for each complainant.

Tesla did not file a response, Nettavisen said, but it may now appeal.

The BBC has contacted Tesla for comment.

The change affected Tesla Model S vehicles made between 2013 and 2015. The battery involved has not been manufactured since 2016.

Despite being designed to “protect” the batteries, the update both reduced range, and affected battery charging speeds at Supercharger stations for some Tesla owners, the complainants argued.

One customer, David Rasmussen, told the website Electrek that the range on his Tesla Model S had dropped from 247 miles to 217 miles within five weeks of downloading the update.

In 2016, Tesla made out-of-court settlements with 126 customers in Norway who said their vehicles did not match up to the claims made by the firm in its marketing material, reported Reuters.

Three years of GDPR: the biggest fines so far

It’s been three years since the introduction of Europe’s data privacy and security law on 25 May 2018.

GDPR governs the way organisations that operate within the EU can use, process and store consumers’ personal data.

At first smaller firms and start-ups feared they did not have adequate resources to fully comply with its rules.

Other critics suggested the legislation relied too much on consumers knowing and understanding their rights.

Since its launch, hundreds of millions of euros worth of fines have been handed out by information commissioners around Europe.

Offences have included retailers misrepresenting the way they use CCTV cameras to monitor employees, and companies not complying with the “right to be forgotten” law.

The legislation replaced older data protection laws, and while it was drafted in Europe, regulators can fine organisations anywhere in the world which target or collect data in the EU.

There are two tiers of penalties, with a maximum of 20m euros (£17.29m) or 4% of global revenue.

The money collected is used to fund public services. Here are the biggest fines recorded so far:

  1. British Airways (211.7m euros)
    British Airways was fined in 2019 after users of its website were directed to a fraudulent site.

Through the data breach, hackers were able to harvest the personal data of about 500,000 consumers.

The leaked data included login and travel booking details, names, addresses and credit card information.

The Information Commissioner’s Office (ICO) said the hack was the result of British Airways’ negligence.

Alex Cruz, the airline’s chairman and chief executive, said it was “surprised and disappointed” in the ICO’s initial findings.

“British Airways responded quickly to a criminal act to steal customers’ data. We have found no evidence of fraud/fraudulent activity on accounts linked to the theft, he said.

“We apologise to our customers for any inconvenience this event caused.”

  1. Marriott International Hotels (110.3m euros)
    British hotel chain Marriott International was fined in 2018 in relation to a hack dating back to 2014, but not uncovered until four years later.

The hack exposed the personal details of about 300 million customers including credit card information, passport numbers and dates of birth.

Following an investigation, the ICO ruled that Marriott had failed to do enough to safeguard its systems.

  1. Google (50m euros)
    Google was one of the first companies to be hit by a substantial GDPR fine.

It was fined after a French regulator ruled that the company had failed to make its consumer data processing statements easily accessible to its users.

The tech giant was also found guilty of not seeking the consent of its users to harness their data for targeted advertising campaigns.

  1. H&M (35.3m euros)
    H&M was fined by German regulators in 2020 after it was found to have been secretly monitoring hundreds of its employees.

If workers took holiday or sick leave, they were required to attend a meeting with senior staff at the retail giant on their return.

These meetings were recorded, and made accessible to H&M managers without the knowledge of staff.

The data collected from the interviews was used to make a “detailed profile” of workers, which then influenced decisions concerning their employment.

  1. Amazon (35m euros)
    Amazon was fined by a French regulator over cookie consent violations.

It was found that the tech giant had deposited cookies on users’ devices without their permission.

It also failed to provide enough information about the cookies, or how visitors to its French website could refuse them.

Where does GDPR money go?
In the UK, all penalties handed out by the ICO are paid into a central government fund which belongs to the Treasury.

The Consolidated Fund is the government’s general bank account at the Bank of England.

It was established in 1787 with the purpose of being “one fund into which shall flow every stream of public revenue and from which shall come the supply of every service”.

This means that just like tax revenue, GDPR fines are used to fund public services.

The majority of other countries in the EU use a similar structure.

Rob Elliss, from tech company Thales, says that despite success so far in handing out substantial fines, GDPR will face more challenges in a post-Covid world.

“When GDPR was first drafted, the legislation did not necessarily account for the adoption of new technologies and rapid migration to the cloud brought on by the pandemic,” he said.

“In this remote working era, businesses needed to digitally transform almost overnight just to keep the lights on, without necessarily incorporating security in the design of new systems and processes.”

Covid: Sniffer dogs could bolster screening at airports

Sniffer dogs could contribute to efforts to prevent the spread of Covid as society reopens, according to scientists.

As part of a trial, dogs were trained to recognise a distinctive odour produced by people with the virus, but undetectable to the human nose.

This could come in useful for screening at airports or mass events.

But the dogs’ findings would have to be confirmed by lab testing, the researcher said.

Although the dogs correctly picked up 88% of coronavirus cases, they also incorrectly flagged 14% of people as having the virus when no Covid was present.

Dogs can have up to 100,000 times the smelling ability of humans and have long been used to sniff out drugs and explosives.

Recent research has shown dogs – particularly breeds like spaniels and retrievers – can detect the unique scents of diseases including cancer, Parkinson’s and malaria.

As part of the current canine screening trial, six dogs were trained to recognise the smell produced by people with Covid-19 using worn socks, face masks and t-shirts of various materials.

They were rewarded with treats when they correctly guessed whether the sample was from an individual who had tested positive or negative.

Some of the people in the negative group had common cold viruses, to make sure the dogs were able to distinguish Covid from other respiratory infections.

The dogs were able to sniff out the disease even when it was caused by different variants, and when the person had no symptoms or only had very low levels of the virus in their system.

Dr Claire Guest, Chief Scientific Officer at charity Medical Detection Dogs, which trained the animals, said the results were “further evidence that dogs are one of the most reliable biosensors for detecting the odour of human disease”.

They picked up roughly 88% of positive cases – meaning, for every 100 cases, the dogs failed to recognise just 12 infected people.

But out of 100 people who did not have Covid, the dogs wrongly suggested – via the sniff test – that 14 of them were infected.

So if one person on a plane of 300 passengers has Covid, the dogs are likely to correctly identify the person with coronavirus, but may also wrongly indicate that another 42 people are infected.

It means a proportion of infections will be missed, and some people will be told they have the virus when they don’t. This is the case for all tests to different extents, but the canine method incorrectly tells a lot more people they have the virus than the type you swab up your nose.

So the research team does not recommend dogs alone are used to sniff out positive cases.

But they believe the dogs could be an additional screening tool alongside more conventional tests. They say dog screening, followed by swab testing, will pick up 91% of infections.

The real potential advantage, though, is speed: even the quickest tests take 15 minutes to show a result, while dogs can sniff out the disease in seconds.

Two dogs could screen 300 people in half an hour, researchers say.

This could make the sniff test “a suitable method for mass screening”, argues Prof Logan at the London School of Hygiene & Tropical Medicine, which conducted the research alongside the University of Durham.

In theory, people could be screened as they queue for a flight or to enter an event, and anyone flagged up by the dogs would need to take a PCR test – the more accurate type of swab tests which is processed in a lab.

This could cut down on the numbers having to enter hotel quarantine.

Dogs could also potentially be used in areas where there isn’t currently much screening, such as busy train stations, to help prevent a super-spreading event.

The research is at an early stage so it still needs to be reviewed by other scientists before it can be published and, in the next phase of the study, tried out on infected people – rather than bits of sock.

Tech Tent: Did e-Estonia beat the virus?

It is probably the world’s most digital government, with just about every state service online.

But did that mean Estonia was better prepared than other nations to deal with the coronavirus?

On this week’s Tech Tent the Estonian President gives us her verdict on how an e-nation battled Covid-19.

The tiny Baltic state has just 1.3m citizens, and as Tech Tent has found on previous visits, just about every interaction with their government can take place on their ultrafast broadband connections.

So when the time came to impose restrictions on the movements of its citizens, Estonia was well prepared.

President Kersti Kaljulaid tells us that “e-school” was something her children and others were already accustomed to using to check the next day’s work assignments – “now there was also a Zoom link where you could go to school.”

Similarly, people were used to interacting with the whole healthcare system online.

“We added one button so people could start their own sick leave,” she explains. “Later, the doctor called back and verified symptoms and sent the person to testing, which means that there was no risk that sick people gathered in doctors’ offices and spread the virus.”

And it seemed to work – until it didn’t.

Throughout most of 2020, Estonia’s Covid-19 cases and deaths remained at very low levels, among the best in Europe. Then, as the winter arrived, they began to take off – and by February “we did go at one point to the top of the tables in Europe,” the president admits.

So what went wrong?

“People want to be together,” she explains. The virus spread most quickly among 20-24-year-olds.

“They have all the digital skills, many of them work in jobs which allow distant working, but you know, having a glass of wine on Zoom – this didn’t really work very well.”

Who wants a digital vaccine passport?
Bye-bye Silicon Valley?
Big Tech and the future of work
Estonia has the spring outbreak under control, and in the league table of Covid-19 deaths per 100,000 Estonia is below the UK and Germany. But it has a far higher death rate than Asian hi-tech countries such as South Korea and Taiwan.

One explanation may be that while Estonia’s government is, in theory, collecting vast amounts of the kind of data that would allow it to track its citizens and the progress of the virus precisely, it is also keen to guarantee their privacy.

“The Estonian government has promised its citizens that it is not looking into the data unless citizens give their permission,” President Kaljulaid says.

Meanwhile, South Korea used data from credit cards, CCTV and mobile phone masts to track people infected with the virus, and the Taiwanese police monitored phone locations to make sure people stayed in quarantine, and came knocking on their doors when their batteries went flat.

Such a level of surveillance would not be acceptable in Estonia, or in many other Western countries.

More evidence, then, that technology is not a silver bullet in the fight against the virus – much depends on the context in which it is used and the norms of human behaviour.

Young Estonians may be digitally savvy and well-informed about how the virus spreads, but they would still rather meet for a drink face-to-face than stare at a webcam in yet another Zoom encounter.

Ransomware: Should paying hacker ransoms be illegal?

A cyber-crime spree wreaking havoc around the world has reignited calls for governments to ban ransom payments to hackers.

Ransomware criminals are holding computer systems hostage on a daily basis, demanding large payments from victims to restore order.

The CEO of Colonial Pipeline has admitted his company paid hackers nearly $4.5m last week after their attack forced the firm to stop transporting fuel.

But research from Bitcoin analysts Elliptic suggests this is just a drop in the ocean.

Since last August, the hackers responsible, DarkSide, have made at least $90m in ransom payments from about 47 victims, Bitcoin records show.

Irish health system targeted twice by hackers
US pipeline hackers ‘didn’t mean to create problems’
Foreign Secretary issues warning on cyber-attacks
And DarkSide is just one of at least a dozen prolific ransomware gangs making vast profits from holding companies, schools, governments and hospitals to ransom.

They work anonymously so are hard to track down.

And many operate in countries unwilling to arrest them.

Law-enforcement agencies
Ransomware attacks prevent victims accessing computer systems or data until a ransom is paid.

Law-enforcement agencies around the world are increasingly urging victims not to pay.

But paying ransoms is not illegal.

And many organisations pay in secret.

Now, the Ransomware Task Force (RTF) global coalition of cyber-experts is lobbying governments to take action.

It has made nearly 50 recommendations to curb the crime spree but couldn’t agree over whether countries should ban ransom payments.

And we asked two members why.

‘Banning payments would result in a pretty horrific game of ‘chicken”
Rapid7 community and public affairs vice-president Jen Ellis says: “Most people agree, in an ideal world, the government would prohibit paying ransoms.

“Since ransomware is a profit-motivated crime, this would hopefully discourage the crime altogether.

“And no-one would be faced with funding organised crime.

“The problem is, we don’t live in an ideal world.

“In the world we do live in, banning payments would almost certainly result in a pretty horrific game of ‘chicken’, whereby criminals would shift all their focus towards organisations which are least likely to be able to deal with downtime – for example hospitals, water-treatment plants, energy providers, and schools.

“The hackers may expect the harm to society caused by this downtime to apply the necessary pressure to ensure they get paid.

“They have very little to lose by doing this – and potentially a big payday to gain.

“Let’s say the government creates a fund to support these organisations so they don’t have to pay.

“If that happens, the attackers could then just switch their focus to small businesses and non-profit organisations which don’t have the resources to protect themselves.

“They could face complete ruin if they don’t pay.

“Faced with declaring bankruptcy, these organisations may consider making a payment in secret, which would then place them even further at the mercy of the criminals, who could threaten to publicise it.

“Overcoming these problems is not straightforward.

“It will take time, education, and sustained investment.

“Prohibiting payments is a great goal to shoot for.

“But we must be pragmatic in our approach to ensure we do not create significant economic and societal harm.”

‘A payment ban would take some burden off organisations’
Cyber Threat Alliance president and chief executive Michael Daniel says: “The case for prohibiting ransom payments is clear.

“Ransomware attacks are primarily motivated by profit.

“And without profit, attackers will shift away from this tactic.

“Further, ransom profits are used to fund other, even more dangerous crime, such as human trafficking, child exploitation, and terrorism.

“Finally, payments beget more attacks, reinforcing the tactic’s utility.

“No organisation wants to pay a ransom.

“Instead, they feel they have no choice, whether it’s due to the threat of insolvency, reputational damage stemming from service interruptions, or the potential for loss of life or wide-scale economic disruption.

“Indeed, from a purely short-term, organisational viewpoint, paying a ransom is often an economically rational decision.”We need to break this cycle and deprive the ransomware ecosystem of ‘fuel’.

“A payment ban would take some burden off organisations, by removing payment as a legal possibility.

“As a result, well designed prohibitions would provide targeted organisations with leverage to push back against their attackers.

“Such prohibitions should not be implemented immediately.

“in fact, such bans should only be put in place after governments have established effective victim-support mechanisms.

“Payment prohibitions should be part of a broad-based campaign to improve prevention, deterrence, disruption, and response.

“Those arguing against bans make an excellent point about the potential heavy cost organisations attacked during a transition period could face, potentially even going out of business or facing enormous pressure to restore service.

“Therefore, for payment bans to achieve their intended effect, governments will have to provide companies with the resources and support to withstand these attacks.”