A 40-year old man from Ridderkerk in the Netherlands has been arrested for reportedly downloading files accidentally sent to him by the police, then apparently refusing to send them back unless he received a reward.

After the man reportedly downloaded the files, the police reached out and told him to delete them, but “He stated that he would only comply if he received something in return.” Thus, the police chose to arrest the man and search his home for the files

If you send someone digital files, or grant them access and they download them, there’s no “sending them back”. Sure, you can demand they delete every copy, but you’d never even know if they didn’t comply! Even if you cut their power/internet and the police arrive within minutes, they could still copy to an external device, send or upload them, physically transport the device, etc…

From a cybersecurity standpoint, assume a hostile foreign power is using a supercomputer offline to break the encryption on a duplicated drive right now, or whatever the worst-case scenario is. It’s like pee in a swimming pool: once it’s out there, it’s out there…