Levelling the field: the ‘condemning the condemners’ neutralization technique

The focus of threat actors’ condemnation attempts were members of the cybersecurity industry, journalists, governments, and institutions. In one set of materials, the neutralization consisted of negatively portraying the nature of these entities.

Thus, Babuk called journalists “sick heads” (Announcement 1) and Conti described them as being capable of “sell[ing] their own mother for a bone from bankers or politicians” (Announcement 2). Moreover, Babuk labelled data security agents as “filthy predators” (Ransom Note 3), and Conti boasted that “the neo-fascist alliance between the US and EU kleptocracies” will not stop them (Announcement 3).

Threat actors described these entities as self-centered, driven by self-interests, and not caring for people and their data. Thus, addressing cybersecurity experts, Maze wrote:

Instead of doing something to improve security, those so-called security professionals are trying to get a few Likes.

(Maze, Press Release March 2020)

These are all direct attempts at condemning journalists, cybersecurity experts, and governments and institutions, by negatively framing their moral makeup, work ethic, ideology, and motives.

In another set of materials, the neutralization involved the making of negative portrayals of the actions of these entities. Thus, in the next excerpts, Egregor, Everest, and Maze claim that recovery companies and negotiators are secretly inflating the final prices during ransom negotiations to take a cut for themselves:

 we have facts and proves of some recovery companies who secretly add 10-50% to our price for the client.

(Egregor, Announcement 1)

When hiring third party negotiators listen to what they tell you, try to think, are they really interested in solving your problems or are they just thinking about their profit and ambitions?

(Everest, About Us 1)

While hiring the negotiators from the side, especially those who work on government, and listening to what they tell you, try to think are they really interested in solving your problems or they are just thinking about their own profit and ambitions of the government agency they belong to.

(Maze, Press Release June 2020)

These statements are akin to what Van Lente and Rip (1998) call “forceful fictions”. They are ‘fictive’, in the sense that, clearly, recovery companies and negotiators cannot be reduced to threat actors’ negative portrayals of them. At the same time, they are also ‘forceful’, in that they open space for threat actors’ actions and terms. Namely, by negatively framing the actions of recovery companies and negotiators, the above statements maintain a sense of such entities as foes-in-disguise.

Importantly, the statements are phrased as warnings, emphasizing that a certain harm may come if victims mobilize recovery companies in the negotiation process. The implication is that the victim might be better off without them.

Thus, employments of the ‘condemning the condemners’ neutralization tactic are not simply artifacts of a criminal imaginary. Rather, our analysis suggests that they have the potential to affect the social structure and dynamics of ransom negotiation, often to the effect of securing (and, in some instances, achieving larger) payments from the victim, which resonates strongly with threat actors’ self-characterization as ‘profit-seeking’ (see Figure 2 below). This in turn calls for a serious attention to cyberattacks as socio-technical phenomena, rather than just technical issues, to be understood and resolved technically.

Figure 2: Motivations of threat actors

We observed earlier that threat actors tend to describe ‘condemners’ as profit-seeking and not caring for people and their data. Such claims were often projected against companies – victims to a cybercrime, as in the following example:

The company’s management doesn’t care about the company’s future. It doesn’t care about the data and about its business partners.

(Maze, Press Release April 2020)

These and similar claims were discussed in greater detail in the previous paper, where we focused on ‘denials of the victim’. In the quote above from Maze, the company’s victimhood is not denied, but rather, the cause of its misfortune is being attributed to the company’s management.

However, statements such as the above can also be read as indirect condemnations of the broader system that enables companies (or their management) ‘not to care’ about business partners, people in general, and their data. In the following excerpt, Maze explicitly addresses that system:

The world is a large computer system. But those, who should watch over the safety of that system are irresponsible. Instead of doing their work, they prefer to chat in social networks or watch porn. On the other side, those who have created this system and earn billions using it, they don’t care about the safety of information or privacy problems. The only thing there to care about is to avoid lawsuits and fines for loosing that information.

(Maze, Press Release March 2020)

In the quote above, Maze describes ‘the system’ as corrupt, fundamentally flawed, and therefore in need of fixing. In the following quote, Cl0p assumes the position of a ‘fixer’.

This example of corrupt company who manipulate market and steal knowledge and money from other company and clients. Cl0p fix all this and we make bad corporation pay for their crime even when corrupt government does nothing.

(Cl0p, Leak Page 2)

Following Woolgar (2005), we can think of these statements as enacting a ‘moral universe’ which depicts the responsibilities and expectations associated with the entities which populate it. The statement above, for example, portrays Cl0p as a caring entity, revealing and demonstrating the ‘true nature’ of companies and governments, and forcing them to do better for people.

What we see here is the use of ‘societal critique’ to reposition the threat actor from a mere criminal to a punisher. The statement provides for a reading of what happens to the company, not as an act of violence against an innocent entity, but rather an instance of getting what they deserve.

Threat actors position themselves as moral agents, acting on behalf of ‘the people’, and in this way reframe their behavior as a kind of calling. Put differently, through the statements addressed in this section, threat actors externalize the cause of the criminal act, so that it is no longer about financial motives, for example, but rather about responding to a higher goal.

In these instances, ‘condemning the condemners’ echoes another neutralization technique outlined by Sykes and Matza, ‘appealing to higher loyalties; to which we return in the next paper.