US Officials Considering How to Deal with Ransomware Payments

US Officials Considering How to Deal with Ransomware Payments

American business leaders are looking for advice on how to deal with ransomware - a kind of software designed to seize a computer system until money is paid.

The question is whether payments should be made for ransomware attacks. But the U.S. government has not yet given clear rules or policies on the issue.

How to respond?

Eric Goldstein is a top cybersecurity official in the Department of Homeland Security. Goldstein told a congressional hearing last week, “It is the position of the U.S. government that we strongly discourage the payment of ransoms.” Discourage means to try to make people not want to do something.

Goldstein told lawmakers that paying a ransom does not guarantee that you will get your data back or that stolen files will be safe. He added even if the criminals keep their word, the money will be used to pay for the next round of attacks.

But current laws do not punish business for making ransomware payments. Refusing to make the payments would be bad for businesses, however, especially for small and medium-sized companies. And the effect of non-payment could be serious for the U.S. itself.

Recent well-known ransomware attacks led to a shortage and high gas prices in the eastern U.S. and threatened the nation’s meat supplies. The issue has left public officials searching for an answer.

Congress is now looking at legislation requiring immediate reporting of ransomware attacks to federal officials. The idea is that such reporting would help identify those responsible and even help get back some of the ransom money.

Recently, U.S. law enforcement recovered most of the $4.4 million that Colonial Pipeline paid to a gang of criminal hackers called DarkSide. That was the first time the U.S. government has said that it had recovered money from the Russia-based gang.

Last week, U.S. President Joe Biden met with Russian President Vladimir Putin in Geneva to talk about several issues including cybersecurity. Biden said he gave Putin a list of 16 “critical infrastructure” items, including energy and water systems, that are considered off-limits to criminal activities.

Without additional action soon, however, experts say ransomware attacks will continue to increase.

Cybersecurity experts

U.S. Energy Secretary Jennifer Granholm said this month that she supports banning payments. But she did not know whether Congress or the president would.

Some of the strongest supporters of a payment ban are those who know ransomware criminals best — cybersecurity experts.

Lior Div is the head of Boston-based Cybereason. He compared ransomware criminals to digital-age terrorists. “It is terrorism in a different form, a very modern one,” Div said.

A 2015 British law forbids United Kingdom-based insurance firms from paying back companies for terrorism ransom payments. Some believe this idea should be applied to ransomware payments.

Adrian Nish is the threat intelligence chief at BAE Systems. Nish noted that “terrorists stopped kidnapping people because they realized that they weren’t going to get paid."

U.S. law forbids material support for terrorists, but the Justice Department in 2015 waived the threat of criminal prosecution for citizens who pay terrorist ransoms.

Standing up against attacks

Some ransomware victims have refused to make payments at a high cost.

One is the University of Vermont Health Network, where the bill for recovery and lost services after an October attack was around $63 million.

Ireland, too, refused to negotiate when its national healthcare service was hit last month. Five weeks later, healthcare information technology in the nation of 5 million remains badly damaged.

Most ransomware victims end up paying. Insurance company Hiscox says over 58 percent of its affected customers pay the ransom. And leading cyber insurance company Marsh McLennan says about 60 percent of its affected U.S. and Canadian customers pay theirs.

But paying does not guarantee anything near full recovery. In a study of 5,400 technology decision-makers from 30 countries, the cybersecurity company Sophos found that on average, ransom-payers got back just 65 percent of the encrypted data.

In a separate study of nearly 1,300 security professionals, cybersecurity company Cybereason found that 4 in 5 businesses that chose to pay ransoms suffered a second ransomware attack.

I’m John Russell.

Frank Bajak reported on this story for the Associated Press. John Russell adapted it for Learning English. Hai Do was the editor.

________________________________________________

Words in This Story

cybersecurity – n. the art of protecting computer networks, devices, and information

ransom – n. money that is paid in order to free someone who has been captured or kidnapped

encrypt – v. to change (information) from one form to another especially to hide its meaning

customer -- n. someone who buys goods or services from a business