The Right to Defy Criminal Demands: Negligence and Ransom Demands

I've just finished up a rough draft of my The Right to Defy Criminal Demands article, and I thought I'd serialize it here, minus most of the footnotes (which you can see in the full PDF). I'd love to hear people's reactions and recommendations, since there's still plenty of time to edit it. You can also see previous posts (and any future posts, as they come up), here.

[* * *]

A robber's demand, "Give me the money or I'll kill/rape/injure your coworker/customer" (see this post), is closely linked to a ransom demand. Surprisingly, there appears to be no caselaw on whether an employer has the duty to pay ransom if an employee is kidnapped (or else risk negligence liability). Nor is there any caselaw on whether a company has the duty to pay ransom if hackers break into its computers and threaten to release customer data. (Assume the defendants took reasonable care in protecting their employees and securing their computers at the outset, so the company isn't liable for its failure to prevent the hack at the outset, but the kidnapping or hacking took place despite that reasonable care.)

The logic of the Kentucky Fried Chicken decision suggests that there too the target of the ransom demand wouldn't have a duty to comply. Indeed, the concern that "[r]ecognition of a duty to comply with an unlawful demand would be contrary to public policy as it would encourage similar unlawful conduct" may be especially apt in ransom cases.

A typical robber of a fast-food restaurant may often not engage in careful risk-benefit balancing, and may likely be unaware of the legal pressures under which such businesses are laboring. But kidnappers and ransomware hackers are more likely to be sophisticated planners, so encouraging ransom payments may well increase the incentive to commit such crimes.

For this reason, some countries outlaw ransom payments. Some U.S. states are considering doing the same, and the FBI Director has likewise urged companies to stop paying ransom to hackers. But even if ransom payments aren't legally forbidden, the law shouldn't in essence demand them.

And to the extent that such crimes are committed by criminal organizations, paying ransom can help fund future crimes, including in some instance terrorism. Indeed, some such ransom payments are already outlawed by American law if they are known to go to entities that are subject to various governmental sanctions.

There are two other possible distinctions between the ransom situation and KFC that might point in different directions. On one hand, robberies, as even the KFC dissent noted, "are stressful and unpredictable encounters, frequently fast paced, in which those being robbed are forced to decide and act, often instantaneously, upon necessarily incomplete information about the situation that confronts them." This may call for more latitude in judging which reactions are "reasonable" under the circumstances; perhaps ransom demand targets have enough time for reflection that they don't require such extra latitude. On the other hand, ransom demands can be for millions of dollars, not just the likely small amount of cash in the till. On balance, I don't think these distinctions should make a legal difference.

Comments

[John F. Carr]

I think during the Trump administration the federal government reminded the public that ransom payments to designated foreign terrorists were as illegal as any other payments or material support. Then they tried to walk it back.

[Rossami]

I don't remember the Trump administration saying that, though they may have. I very explicitly remember the FBI and others under the Biden administration saying exactly that as part of their attempt to demonize and control bitcoin. It was a "friendly reminder" about the scope of OFAC.

[dwb68]

"The logic of the Kentucky Fried Chicken decision suggests that there too the target of the ransom demand wouldn't have a duty to comply. Indeed, the concern that "[r]ecognition of a duty to comply with an unlawful demand would be contrary to public policy as it would encourage similar unlawful conduct" may be especially apt in ransom cases."

There is a whole cottage industry of Kidnap and Ransom (K&R) insurance. Every large company takes out insurance on their high value employees. K&R insurance is big business.

This seems to me to be against public policy. Various countries have tried to outlaw it. If you are a multinational though its fairly easy to forum shop. Groups know about the insurance and tailor their demands knowing that they will get paid.

If an employer takes out insurance on some employees, or insures some corporate assets from hacking/theft, it seems to me, that changes the liability issue. They lose the right to refuse payment ransom when the non-insured assets/employees are taken hostage.

[ReaderY]

Once we enter the world of kidnappings and ransom demands, we are very far from my special exception. My exception involved demands to stop conduct society regards as wrong and/or especially provocative, and which a state could (if it wanted to) itself require to be stopped, or punish for doing in the first place, if no demand had been made.

This is not that.

[Á àß äẞç ãþÇđ âÞ¢Đæ ǎB€Ðëf ảhf]

I hadn't thought of this before, and wonder how far it leads. It backed me up to yesterday (or the day before?) where one court ruled that non-compliance could not make one responsible for the harm done by the criminal.

That court ruled that non-compliance with criminal extortion cannot make one responsible for third party harm on the grounds it encourages further criminal activity. Does this extend to someone who opens a door and facilitates escape when the criminal demands it, thus helping a criminal kidnap a hostage? What about simply getting out of the way of a criminal waving a gun? What about a carjacking victim who obeys the order to get out of their car?

[Rev. Arthur L. Kirkland]

The good news is that so far this discussion has mentioned Kentucky Fried Chicken several times but neither trap house nor former Pres. Obama once.

Progress!

[TwelveInchPianist]

What does Kentucky Fried Chicken have to do with President Obama, Arthur?

[Not Unreasonable]

There's the matter of $400 million former President Obama sent to Iran the same day Iran released some hostages. https://www.cnn.com/2016/08/03/politics/us-sends-plane-iran-400-million-cash/index.html

[ReaderY]

As hinted at in my comment on Professor Volokh’s post, in cases like robbery, kidnapping, or rape I might be more inclined to agree with Professor Volokh on the policy issues. But I would still be obligated to say as a judge that such laws pass rational basis, even if I might disagree with the policy behind them.

Rape is a special case that might merit attention. The court’s cases suggest a constitutional right not to be raped that might overcome any state-imposed duty to submit or liability for not submitting. This would come directly from the court’s privacy cases, assuming they survive Dobbs. In addition, under pre-Smith analysis there could be a religion claim for people with a religious obligation to die (or resist until death) rather than commit adultery or homosexual acts. And of course, under the Alito interpretation of Smith, enforcing only when third parties are hurt would not only make a duty to submit not generally applicable, it would also appear to override any claim the state might make that the safety interest is compelling based on a pre-Smith understanding of compelling.

One reason I doubt the stste would have a compelling interest here is that the safety interest is somewhat speculative. We don’t actually know that compliance means no-one will get hurt. There is a probability that this will be the case, making the call a rational one. But it definitely might not turn out to be the case. And the lack of certainty cuts somewhat against being conpelling.

I also agree that it’s a good policy argument that it’s not reasonable to expect people threatened with force to react cooly or think about the needs of third parties. But it could also rationally be argued the other way.

[NOYB2]

Nor is there any caselaw on whether a company has the duty to pay ransom if hackers break into its computers and threaten to release customer data.

Obviously, there is no legal obligation to pay ransom under criminal law because Congress has not passed such a law.

But in civil litigation, you are responsible for the damages you cause to others, and penalties are determined as a multiple of those damages. If hackers can obtain customer data, that is always 100% the fault of the company holding that data, no exceptions. So, the company has no obligation to pay ransom, but it might well reduce damages and penalties doing so.

Sadly, the legal system erroneously tends to view “hacking” as if it is something that can happen to companies even of they took reasonable care; that is wrong. Furthermore, the legal system often undervalues the cost of data released. They should be valued on customer hourly pay multiplied by the number of hours it costs each customer to deal with the breach. This probably amounts to hundreds of dollars per released personal information.

For kidnapping of employees, the situation depends on whether the kidnapping was due to the employer’s negligence. But again, it is not a question of “rights”, it’s a question of actual harm and actual damages that the employer is responsible for. Paying ransom may reduce the damages and penalties the employer has to pay even if there is no duty under criminal law to actually pay ransom.