Trump’s ransomware model

How elite institutions are funding the next attack

Following a string of high-profile payouts from elite universities — and with Harvard still negotiating a half-billion-dollar settlement — the Trump administration is now seeking a staggering $1 billion from UCLA.

That jaw-dropping demand is the predictable result of elite institutions treating authoritarian shakedowns like business deals. These agreements don’t buy peace — they invite continued meddling and set a precedent for the next, even larger ransom.

Harvard’s approach shows how this pattern takes hold. According to The New York Times, Harvard was prepared to pay the administration’s $500 million levy to restore federal research funding — until its Ivy League rival, Brown, agreed to settle its own case for just $50 million. The news reportedly stunned officials in Cambridge, who are now scrambling to renegotiate, alarmed that a competitor had secured a “better” deal.

Treating these payments as “deals” is a mistake — and so is assuming the Trump administration is genuinely interested in treating its targets fairly and applying the rules evenly. Authoritarian bullies don’t negotiate; they extract. The settlements are eye-wateringly profitable shakedowns that will further fuel Trump’s operation. Axios recently calculated that President Trump has squeezed more than $1.2 billion in settlements from elite institutions.

The money these institutions are forking over isn’t sitting in a rainy day fund for the greater common good. Settlement funds will bankroll Trump’s agenda.

Big Law firms have agreed to provide the Trump administration hundreds of millions in legal services. Trump is claiming millions worth of free public service announcements from media companies and funding for his future presidential museum and foundation. Universities are agreeing to give the Trump administration control over their academic programs, hiring, and admissions.

There’s a lesson to be learned from another modern-day shakedown: ransomware attacks. And the best practices for responding are well-established and perfectly applicable here.

When a hospital’s systems are seized by criminals, its leaders face a terrible choice. Paying the ransom might seem like the fastest way to restore order and avoid losing business. Yet the FBI’s advice is unequivocal: Do not pay.

The directive to defeat the ransomware attacks is clearly stated on the FBI’s website:

The FBI does not support paying a ransom in response to a ransomware attack. Paying a ransom doesn’t guarantee you or your organization will get any data back. It also encourages perpetrators to target more victims and offers an incentive for others to get involved in this type of illegal activity.

The billion-dollar demand from UCLA underscores the ransomware logic at work: Once attackers see that targets will pay, they raise the price for the next victim. The Trump administration isn’t just recycling its tactics; it’s scaling them.

Every dollar paid — whether it’s by Harvard, ABC News, or Paramount — greenlights the next round of dictates. No surprise that the Trump administration has set its sights now not only on UCLA but Duke and George Mason University. The strategy is working.

It would also be naive for the ransom-payers to believe a one-time payout will end the harassment. After Skadden paid a settlement to the Trump administration, the firm was reportedly pressured by a Trump ally to provide representation for a client who was allegedly unfairly issued a protective order related to his divorce. Skadden replied it was receiving “many outreaches for assistance … in the wake of our agreement with the White House.”

By paying a political ransom, America's elite institutions are not buying peace.

A settlement doesn't just grant Trump's allies leverage to intervene in an institution's day-to-day work; it's an open invitation for them to come back for more deals. Cash is cold, hard evidence that the target believes they are better off capitulating to the president’s demands than refusing them.

So, what is the alternative? A unified firewall strategy that adopts the same thinking CISA experts advise for ransomware: Invest in and build a system so resilient that the attacker has no leverage. That requires a mutual understanding that no single institution stands alone and that the attacker must not be allowed to play them off against each other.

When it comes to cyberattacks, security professionals will develop a “ransomware kill chain” to identify critical points where the threats can be detected and stopped. Cloudflare has emphasized that “success hinges on a comprehensive, layered defense strategy that addresses every stage of the ransomware kill chain.”

For their part, universities, law firms, and media companies could also create a “settlement kill chain” by hardening themselves — legally, financially, and operationally — against political shakedowns. It would require a shift from competition to solidarity: abandoning rivalries to form a firewall of mutual support, where institutions present a single, unified front against the aggressor. The “settlement kill chain” could include plans to share crisis-communications plans, pool funds to resist federal pressure, and joint commitments not to settle without sector-wide consultation. It’s a collective action approach that treats an attack on a single organization in their shared sector as an attack on them all.

California Governor Gavin Newsom called Trump’s $1 billion demand “extortion” and vowed to “follow a different path.” He’ll need people to help hold the line. The reason UCLA finds itself in this position is that previous targets didn’t.

Doing the necessary organizing to defeat President Trump’s ransomware attacks won’t be easy. But the current strategy of individual appeasement only leads to authoritarian triumph.