The UK government is considering banning public organizations from paying ransomware demands as it seeks to strike a "significant blow” to cyber criminal operating models.
The consultation follows a series of serious ransomware incidents at NHS bodies, the British Library, Royal Mail and more, that have caused severe real world disruption and cost millions in recovery costs.
Consultation documents from government officials noted that ransomware is considered the "greatest of all serious and organized cyber crime threats, the largest cybersecurity threat, and is treated as a risk to the UK's national security."
To fight back, the Home Office is running a consultation centered around three proposals.
These include mandatory requirements to report ransomware incidents and a ransomware payment prevention scheme that would require notification of intention to pay and offer support to help victims avoid paying.
The government already prohibits ransomware payments by its own departments, and the third option would seek to extend that across all public bodies — including the NHS — and organizations deemed critical national infrastructure (CNI) and perhaps even their suppliers.
One consideration, the consultation report notes, is coming up with the right measures to encourage compliance with the ban — in other words, how to punish any public or CNI organisation that pays ransomware criminals.
The consultation is considering making non-compliance a criminal offence or making use of civil penalties, such as fines or banning leadership from being a member of a board.
However, the consultation document notes: "The Home Office welcomes views on other measures that could be used to encourage compliance with the ban."
Fighting back against ransomware
The aim of the legislation is to deter future ransomware attacks by cutting down the amount of money threat groups earn as well as to make it easier for authorities to disrupt and investigate attacks, the government said.
"Reducing the spread of ransomware attacks, and undermining the criminals’ business model, requires an entirely new approach, and one that will help the UK to lead the world in fighting back against the increasing risks posed by this crime to our society and economy,” the report states.
Because of that, tackling the threat of ransomware requires a coordinated approach.
"With an estimated $1bn flowing to ransomware criminals globally in 2023, it is vital we act to protect national security," said security minister Dan Jarvis.
"These proposals help us meet the scale of the ransomware threat, hitting these criminal networks in their wallets and cutting off the key financial pipeline they rely upon to operate."
The consultation runs until April.
Does paying ransoms work?
Paying ransoms to threat actors can be a dangerous option for organizations that have fallen prey to a cyber attack. Despite paying, research shows many victims find they cannot recover all stolen data, and in some instances threat actors have still leaked sensitive information.
The National Cyber Security Centre (NCSC) has previously said it does not believe such ransoms should be paid, but doing so is not illegal unless the victim is aware that the money is funding terrorism.
"This consultation marks a vital step in our efforts to protect the UK from the crippling effects of ransomware attacks and the associated economic and societal costs," said Richard Horne, CEO of the NCSC.
The consultation is only targeted at public organisations or those organisations deemed to have critical national infrastructure, but previous research has suggested as many as a third of private companies have paid out to ransomware groups.
