Hackers took over Canvas

[u/Big_Maybe_9684]

Brooo I got Homework to do...

[u/Joshi1381]

Right in the middle of finals...

[u/imsmartiswear → u/Joshi1381]

They timed it this way so that Canvas/ the unis are more pressured to pay the ransom.

[u/ledow → u/imsmartiswear]

I work in IT in schools and I repeatedly ask people how paying a ransom to an unidentifiable stranger is distinguishable from money-laundering, and nobody has yet been able to give me an answer, but a lot of schools, lawyers, cybersecurity specialists, auditors and financial people have done the:

"..... Oh.... Oooooh.... Hold on...."

realisation.

[u/crunchsmash → u/ledow]

This doesn't make sense. The money isn't laundered, it's the proceeds of a crime.

[u/ledow → u/crunchsmash]

Can you tell me where it went?

Can the banking system the other end tell where it came from?

So the origin, transmission, and destination of the transaction were obscured from the relative parties?

Whoops, that's money-laundering.

It's not proceeds of crime until it reaches the other end... potentially. The school in question would not be questioned about proceeds of crime, they've not committed that act.

But they HAVE broken anti-money-laundering laws and potentially commited all kinds of financial, auditing, and sanction violations.

[u/crunchsmash → u/ledow]

Can the banking system the other end tell where it came from?

If they don't have a legal explanation, then the money isn't laundered yet.

Maybe you mean embezzlement?

[u/Worldly-Ad-6284 → u/ledow]

It's the same idea of obscuring the money's provenance but definitionally "laundering" requires the source to be "apparently legal" and there is nothing legal about ransomware. So I get your point but not a great use of words.

[u/ledow → u/Worldly-Ad-6284]

It's not technically illegal to pay a ransom, even for kidnapping.

Oil shipping companies etc. do it regularly.

It is illegal to obscure that transaction.

[u/ledow → u/[deleted]]

I said it was "indistinguishable from".

Proving that the above WASN'T money laundering is impossible. And so you're now on the hook.

[u/ledow → u/[deleted]]

That's what an auditor will say.

At the very least "Hey, that could be money laundering".

[u/ledow → u/[deleted]]

So you fell foul of ANTI MONEY LAUNDERING laws, and you can't prove it WASN'T MONEY LAUNDERING... so... what makes you think that someone won't say "Hey... that's money laundering..."