VOA慢速英语2021 美国官员考虑如何处理勒索软件赎金（在线收听）

American business leaders are looking for advice on how to deal with ransomware - a kind of software designed to seize a computer system until money is paid.

美国商界领袖正在寻求有关如何处理勒索软件的建议，勒索软件是一种旨在夺取计算机系统控制权直到用户缴纳赎金的软件。

The question is whether payments should be made for ransomware attacks. But the U.S. government has not yet given clear rules or policies on the issue.

问题在于是否应该为勒索软件攻击支付赎金。但是美国政府尚未就此问题出台明确规定或政策。

How to respond?

如何回应？

Eric Goldstein is a top cybersecurity official in the Department of Homeland Security. Goldstein told a congressional hearing last week, "It is the position of the U.S. government that we strongly discourage the payment of ransoms." Discourage means to try to make people not want to do something.

埃里克·戈德斯坦是美国国土安全部的高级网络安全官员。戈德斯坦上周在一场国会听证会上表示：“美国政府的立场是，我们强烈反对支付赎金。”Discourage是指设法让人们不想做某事。

Goldstein told lawmakers that paying a ransom does not guarantee that you will get your data back or that stolen files will be safe. He added even if the criminals keep their word, the money will be used to pay for the next round of attacks.

戈德斯坦对议员表示，支付赎金并不能保证你可以拿回数据或确保被盗文件的安全。他还表示，即使犯罪分子信守承诺，这笔钱也将被用于下一轮攻击。

But current laws do not punish business for making ransomware payments. Refusing to make the payments would be bad for businesses, however, especially for small and medium-sized companies. And the effect of non-payment could be serious for the U.S. itself.

但是现有法律并不会对支付勒索软件赎金的企业做出惩罚。然而拒绝支付赎金对企业不利，尤其是对中小型企业而言。不支付赎金对美国自身也可能会有严重影响。

Recent well-known ransomware attacks led to a shortage and high gas prices in the eastern U.S. and threatened the nation's meat supplies. The issue has left public officials searching for an answer.

最近几次著名的勒索软件攻击导致美国东部地区出现石油短缺和高油价，以及威胁到美国的肉类供应。这个问题让公职人员一直在寻求解决办法。

Congress is now looking at legislation requiring immediate reporting of ransomware attacks to federal officials. The idea is that such reporting would help identify those responsible and even help get back some of the ransom money.

美国国会现在正在考虑立法，要求立即向联邦官员报告勒索软件攻击。想法是这样报告将有助于确定责任人，甚至有助于追回部分赎金。

Recently, U.S. law enforcement recovered most of the $4.4 million that Colonial Pipeline paid to a gang of criminal hackers called DarkSide. That was the first time the U.S. government has said that it had recovered money from the Russia-based gang.

最近美国执法官员追回了科洛尼尔管道公司支付给一家名为DarkSide的黑客犯罪团伙的440万美元中的大部分。这是美国政府首次声称从俄罗斯团伙手中追回资金。

Last week, U.S. President Joe Biden met with Russian President Vladimir Putin in Geneva to talk about several issues including cybersecurity. Biden said he gave Putin a list of 16 "critical infrastructure" items, including energy and water systems, that are considered off-limits to criminal activities.

上周，美国总统拜登在日内瓦会见了俄罗斯总统普京，讨论了包括网络安全在内的几个问题。拜登称他给普京提供了一份名单，列出了16个包括能源和供水系统在内的关键基础设施项目，这些项目被视为犯罪活动禁区。

Without additional action soon, however, experts say ransomware attacks will continue to increase.

然而专家表示，如果不立即采取额外行动，勒索软件攻击将会继续增加。

Cybersecurity experts

网络安全专家

U.S. Energy Secretary Jennifer Granholm said this month that she supports banning payments. But she did not know whether Congress or the president would.

美国能源部长詹妮弗·格兰霍姆本月表示，她支持禁止支付赎金。但是她不知道国会和总统是否会这样做。

Some of the strongest supporters of a payment ban are those who know ransomware criminals best — cybersecurity experts.

赎金禁令 的一些最强烈支持者是最了解勒索软件犯罪分子的网络安全专家。

Lior Div is the head of Boston-based Cybereason. He compared ransomware criminals to digital-age terrorists. "It is terrorism in a different form, a very modern one," Div said.

Lior Div 是总部位于波士顿的Cybereason公司的负责人。他将勒索软件犯罪分子比作数字时代的恐怖分子。他说：“这是一种形式不同的、非常现代的恐怖主义。”

A 2015 British law forbids United Kingdom-based insurance firms from paying back companies for terrorism ransom payments. Some believe this idea should be applied to ransomware payments.

一项2015年出台的英国法律禁止总部位于英国的保险公司向支付恐怖主义赎金的公司做出理赔。有人认为这个观点应该被应用于勒索软件赎金。

Adrian Nish is the threat intelligence chief at BAE Systems. Nish noted that "terrorists stopped kidnapping people because they realized that they weren't going to get paid."

埃德里安·尼斯是BAE Systems公司的威胁情报主管。尼斯指出，“恐怖分子不再绑架人，因为他们意识到他们拿不到赎金。”

U.S. law forbids material support for terrorists, but the Justice Department in 2015 waived the threat of criminal prosecution for citizens who pay terrorist ransoms.

美国法律禁止向恐怖分子提供物质支持，但是美国司法部在2015年撤回了对支付恐怖主义赎金的公民提起刑事诉讼的威胁。

Standing up against attacks

站出来对着干

Some ransomware victims have refused to make payments at a high cost.

一些勒索软件受害人拒绝了支付高额赎金。

One is the University of Vermont Health Network, where the bill for recovery and lost services after an October attack was around $63 million.

受害方之一是佛蒙特大学健康网络，在10月份遭受攻击之后，恢复服务和丢失服务的总损失约为6300万美元。

Ireland, too, refused to negotiate when its national healthcare service was hit last month. Five weeks later, healthcare information technology in the nation of 5 million remains badly damaged.

爱尔兰国家医疗保健服务在上个月受到攻击时也拒绝进行谈判。5周之后，这个拥有500万人口的国家的医疗保健信息技术仍然受到严重破坏。

Most ransomware victims end up paying. Insurance company Hiscox says over 58 percent of its affected customers pay the ransom. And leading cyber insurance company Marsh McLennan says about 60 percent of its affected U.S. and Canadian customers pay theirs.

大多数勒索软件受害者最终会支付赎金。Hiscox保险公司表示，超过58%的受影响客户支付了赎金。领先的网络保险公司Marsh McLennan表示，其受影响的美国和加拿大客户中大约有60%支付了赎金。

But paying does not guarantee anything near full recovery. In a study of 5,400 technology decision-makers from 30 countries, the cybersecurity company Sophos found that on average, ransom-payers got back just 65 percent of the encrypted data.

但是支付赎金并不能保证服务完全恢复。在对来自30个国家的5400名技术决策者进行的一项研究中，网络安全公司 Sophos 发现，支付赎金者平均只拿回了 65% 的加密数据。

In a separate study of nearly 1,300 security professionals, cybersecurity company Cybereason found that 4 in 5 businesses that chose to pay ransoms suffered a second ransomware attack.

在另一项对近1300名安全专家的调查中，网络安全公司 Cybereason 发现，80%选择支付赎金的企业遭受了第二次勒索软件攻击。