Should we ban ransomware payments? It’s an attractive but dangerous idea

17 August 2023

Cointelegraph By Christos Makridis

A successful cyberattack on critical infrastructure — such as electricity grids, transportation networks or healthcare systems — could cause severe disruption and put lives at risk.

Our understanding of the threat is far from complete since organizations have historically not been required to report data breaches, but attacks are on the rise according to the Privacy Rights Clearinghouse. A recent rule from the United States Securities and Exchange Commission should help clarify matters further by now requiring that organizations “disclose material cybersecurity incidents they experience.”

As the digital world continues to expand and integrate into every facet of society, the looming specter of cyber threats becomes increasingly more critical. Today, these cyber threats have taken the form of sophisticated ransomware attacks and debilitating data breaches, particularly targeting essential infrastructure.

A major question coming from policymakers, however, is whether businesses faced with crippling ransomware attacks and potentially life threatening consequences should have the option to pay out large amounts of cryptocurrency to make the problem go away. Some believe ransoms be banned for fear of encouraging ever more attacks.

Following a major ransomware attack in Australia, its government has been considering a ban on paying ransoms. The United States has also more recently been exploring a ban. But other leading cybersecurity experts argue that a ban does little to solve the root problem.

Ransomware and the ethical dilemma of whether to pay the ransom

At the most basic level, ransomware is simply a form of malware that encrypts the victim’s data and demands a ransom for its release. A recent study by Chainalysis shows that crypto cybercrime is down by 65% over the past year, with the exception of ransomware, which saw an increase.

“Ransomware is the one form of cryptocurrency-based crime on the rise so far in 2023. In fact, ransomware attackers are on pace for their second-biggest year ever, having extorted at least $449.1 million through June,” said Chainalysis.

Even though there has been a decline in the number of crypto transactions, malicious actors have been going after larger organizations more aggressively. Chainalysis continued:

“Big game hunting — that is, the targeting of large, deep-pocketed organizations by ransomware attackers — seems to have bounced back after a lull in 2022. At the same time, the number of successful small attacks has also grown.”

The crippling effect of ransomware is especially pronounced for businesses that heavily rely on data and system availability.

Ransomware revenue is up. (Chainalysis)

The dilemma of whether to pay the ransom is contentious. On one hand, paying the ransom might be seen as the quickest way to restore operations, especially when lives or livelihoods are at stake. On the other hand, succumbing to the demands of criminals creates a vicious cycle, encouraging and financing future attacks.

Organizations grappling with this decision must weigh several factors, including the potential loss if operations cannot be restored promptly, the likelihood of regaining access after payment, and the broader societal implications of incentivizing cybercrime. For some, the decision is purely pragmatic; for others, it’s deeply ethical.

Attacks by organization type. (Chainalysis)

Should paying ransoms be banned?

The increasing incidence of ransomware attacks has ignited a policy debate: Should the payment of ransoms be banned? Following a major ransomware attack on Australian consumer lender Latitude Financial, in which millions of customer records and IDs were stolen, some have begun to advocate for a ban on paying the ransom as a way of deterring attacks and depriving cybercriminals of their financial incentives.

In the United States, the White House has voiced its qualified support for a ban. “Fundamentally, money drives ransomware and for an individual entity it may be that they make a decision to pay, but for the larger problem of ransomware that is the wrong decision… We have to ask ourselves, would that be helpful more broadly if companies and others didn’t make ransom payments?” said Anne Neuberger, deputy national security advisor for cyber and emerging technologies in the White House.

There are good reasons not to pay a ransom, but good reasons to pay as well. (Pexels)

While proponents argue that it will deter criminals and reorient priorities for C-suite executives, critics, however, warn that a ban might leave victims in an untenable position, particularly when a data breach could lead to loss of life, as in the case of attacks on healthcare facilities.

“The prevailing advice from the FBI and other law enforcement agencies is to discourage organizations from paying ransoms to attackers,” Jacqueline Burns Koven, head of cyber threat intelligence for Chainalysis, tells Magazine.

“This stance is rooted in the understanding that paying ransoms perpetuates the problem, as it incentivizes attackers to continue their malicious activities, knowing that they can effectively hold organizations hostage for financial gain. However, some situations may be exceptionally dire, where organizations and perhaps even individuals face existential threats due to ransomware attacks. In such cases, the decision to pay the ransom may be an agonizing but necessary choice. Testimony from the FBI recognizes this nuance, allowing room for organizations to make their own decisions in these high-stakes scenarios, and voiced opposition to an all out ban on payments.”

Another complicating factor is that an increasing number of ransomware attacks, according to Chainalysis, may not have financial demands but instead focus on blackmail and other espionage purposes.

“In such cases, there may be no feasible way to pay the attackers, as their demands may go beyond monetary compensation… In the event that an organization finds itself in a situation where paying the ransom is the only viable option, it is essential to emphasize the importance of reporting the incident to relevant authorities.”

“Transparency in reporting ransomware attacks is crucial for tracking and understanding the tactics, techniques and procedures employed by malicious actors. By sharing information about attacks and their aftermath, the broader cybersecurity community can collaborate to improve defenses and countermeasures against future threats,” Koven continues.

Could we enforce a ban on paying ransomware attackers?

Even if a ban were implemented, a key challenge is the difficulty in enforcing it. The clandestine nature of these transactions complicates tracing and regulation. Furthermore, international cooperation is necessary to curb these crimes, and achieving a global consensus on a ransom payment ban might be challenging.

Banning ransomware payments risks criminalizing victims. (Pexels)

While banning ransom payments could encourage some organizations to invest more in robust cybersecurity measures, disaster recovery plans and incident response teams to prevent, detect and mitigate the impact of cyberattacks, it still amounts to penalizing the victim and making the decision for them.

“Unfortunately, bans on extortions have traditionally not been an effective way to reduce crime — it simply criminalizes victims who need to pay or shifts criminals to new tactics,” says Davis Hake, co-founder of Resilience Insurance who says claims data over the past year shows that while ransomware is still a growing crisis, some clients are already taking steps toward becoming more cyber-resilient and able to withstand an attack.

“By preparing executive teams to deal with an attack, implementing controls that help companies restore from backups, and investing in technologies like EDR and MFA, we’ve found that clients are significantly less likely to pay extortion, with a significant number not needing to pay it at all. The insurance market can be a positive force for incentivizing these changes among enterprises and hit cybercriminals where it hurts: their wallets,” Hake continues.

The growing threat and risk of cyberattacks on critical infrastructure

The costs of ransomware attacks on infrastructure are often ultimately borne by taxpayers and municipalities that are stuck with cleaning up the mess.

To understand the economic effects of cyberattacks on municipalities, I released a research paper with several faculty colleagues, drawing on all publicly reported data breaches and municipal bond market data. In fact, a 1% increase in the county-level cyberattacks covered by the media leads to an increase in offering yields ranging from 3.7 to 5.9 basis points, depending on the level of attack exposure. Evaluating these estimates at the average annual issuance of $235 million per county implies $13 million in additional annual interest costs per county.

One reason for the significant adverse effects of data breaches on municipalities and critical infrastructure stems from all the interdependencies in these systems. Vulnerabilities related to Internet of Things (IoT) and industrial control systems (ICS) increased at an “even faster rate than overall vulnerabilities, with these two categories experiencing a 16% and 50% year over year increase, respectively, compared to a 0.4% growth rate in the number of vulnerabilities overall, according to the X-Force Threat Intelligence Index 2022 by IBM.

Read also


Features

Bitcoin payday? Crypto to revolutionize job wages… or not


Features

Powers On… Why aren’t more law schools teaching blockchain, DeFi and NFTs?

A key factor contributing to this escalating threat is the rapid expansion of the attack surface due to IoT, remote work environments and increased reliance on cloud services. With more endpoints to exploit, threat actors have more opportunities to gain unauthorized access and wreak havoc.

“Local governments face a significant dilemma… On one hand, they are charged with safeguarding a great deal of digital records that contain their citizens’ private information. On the other hand, their cyber and IT experts must fight to get sufficient financial support needed to properly defend their networks,” says Brian de Vallance, former DHS assistant secretary.

“Public entities face a number of challenges in managing their cyber risk — the top most is budget. IT spending accounted for less than 0.1% of overall municipal budgets, according to M.K. Hamilton & Associates. This traditional underinvestment in security has made it more and more challenging for these entities to obtain insurance from the traditional market.”

Cybersecurity reform should involve rigorous regulatory standards, incentives for improving cybersecurity measures and support for victims of cyberattacks. Public-private partnerships can facilitate sharing of threat intelligence, providing organizations with the information they need to defend against attacks. Furthermore, federal support, in the form of resources or subsidies, can also help smaller organizations – whether small business or municipalities – that are clearly resource constrained so they have funds to invest more in cybersecurity.

Toward solutions

So, is the solution a market for cybersecurity insurance? A competitive market to hedge against cyber risk will likely emerge as organizations are increasingly required to report material incidents. A cyber insurance market would still not solve the root of the problem: Organizations need help becoming resilient. Small and mid-sized businesses, according to my research with professors Annie Boustead and Scott Shackelford, are especially vulnerable.

“Investment in digital transformation is expected to reach $2T in 2023 according to IDC and all of this infrastructure presents an unimaginable target for cybercriminals. While insurance is excellent at transferring financial risk from cybercrime, it does nothing to actually ensure this investment remains available for the business,” says Hake, who says there is a “huge opportunity” for insurance companies to help clients improve “cyber hygiene, reduce incident costs, and support financial incentives for investing in security controls.”

Encouragingly, Hake has noticed a trend for more companies to “work with clients to provide insights on vulnerabilities and incentivize action on patching critical vulnerabilities.”

“One pure-technology mitigation that could help is SnapShield, a ‘ransomware activated fuse,’ which works through behavioral analysis,” says Doug Milburn, founder of 45Drives. “This is agentless software that runs on your server and listens to traffic from clients. If it detects any ransomware content, SnapShield pops the connection to your server, just like a fuse. Damage is stopped, and it is business as usual for the rest of your network, while your IT personnel clean out the infected workstation. It also keeps a detailed log of the malicious activity and has a restore function that instantly repairs any damage that may have occurred to your data,” he continues.

Ransomware attacks are also present within the crypto market, and there is a growing recognition that new tools are needed to build on-chain resilience. “While preventative measures are important, access controlled data backups are imperative. If a business is using a solution, like Jackal Protocol, to routinely back up its state and files, it could reboot without paying ransoms with minimal losses,” said Eric Waisanen, co-founder of Astrovault.

Ultimately, tackling the growing menace of cyber threats requires a holistic approach that combines policy measures, technological solutions and human vigilance. Whether a ban on ransom payments is implemented, the urgency of investing in robust cybersecurity frameworks cannot be overstated. As we navigate an increasingly digital future, our approach to cybersecurity will play a pivotal role in determining how secure that future will be.

Mandatory disclosure and the threat of getting sued may force companies to improve cybersecurity. (Pexels)

Emory Roane, policy counsel at PRCD, says that mandatory disclosure of cyber breaches and offering identity theft protection services are essential, but it “still leaves consumers left to pick up the pieces for, potentially, a business’ poor security practices.”

But the combination of mandatory disclosure and the threat of getting sued may be the most effective. He highlights the California Consumer Privacy Act.

“It provides a private right of action allowing consumers to sue businesses directly in the event that a business suffers a data breach that exposes a consumer’s personal information and that breach was caused by the business’ failure to use reasonable security measures,” Roane explains. That dovetails with a growing recognition that data is an important consumer asset that has long been overlooked and transferred to companies without remuneration.

Greater education around cybersecurity and data sovereignty will not only help consumers stay alert to ongoing threats — e.g., phishing emails — but also empower them to pursue and value more holistic solutions to information security and data sharing so that the incidence of ransomware attacks is lower and less severe when they do happen.

Bans rarely work, if for no other reason than enforcement is either physically impossible or prohibitively expensive. Giving into ransoms is not ideal, but neither is penalizing the entity that is going through a crisis. What organizations need are better tools and techniques – and that is something that the cybersecurity industry, in collaboration with policymakers, can help with through new technologies and the adoption of best practices.

HackersHackingPaymentsRansomware

Read also

  

You might also like

US stablecoin bill gets update ahead of Senate banking group vote  
US stablecoin bill gets update ahead of Senate banking group vote  

US Senate Banking Committee is set to vote on a Republican-led stablecoin framework bill on March 13, after it was updated following consultation with committee Democrats.GOP Senator Bill Hagerty, one of the bill’s co-sponsors, said on March 10 that he introduced an update of the Guiding and Establishing National Innovation for US Stablecoins (GENIUS) Act, which would go to a Banking Committee vote on March 13.He added that the updated bill saw bipartisan consultation. The bill is co-sponsored by Republican Senators Cynthia Lummis and Tim Scott, who is also chair of the Banking Committee chair, along with Democrats Kirsten Gillibrand and Angela Alsobrooks.“The updated version of the GENIUS Act makes significant improvements to a number of important provisions, including consumer protections, authorized stablecoin issuers, risk mitigation, state pathways, insolvency, transparency, and more,” Gillibrand said in a statement.Hagerty first introduced the bill in early February. It aims to bring issuers of US dollar stablecoins with market caps over $10 billion — currently only Tether (USDT) and Circle’s USDC (USDC) — under Federal Reserve regulations. Those under $10 billion could opt into state-level regulation.Web3 learning app EasyA co-founder Dom Kwok said on X that the latest version of the GENIUS Act, shared by FOX Business reporter Eleanor Terrett, gives “US-issued stablecoins a competitive advantage.”He added that the bill now holds foreign stablecoin issuers to “extra high standards” in areas such as reserve and liquidity requirements, money laundering checks and sanctions checks.Source: Dom Kwok“Most foreign issuers will find these standards hard to meet,” which gives Circle’s USDC and Ripple Labs’ Ripple USD (RLUSD) “an upper hand,” he said.Related: Crypto needs policy change more than Bitcoin reserve — ExecsCrypto lawyer and Hogan & Hogan partner Jeremy Hogan came to the same conclusion in a separate X post, saying the bill’s requirements, particularly around reserves and Anti-Money Laundering checks, “all fall neatly for RLSUD and USDC.”The GENIUS Act still has a way to go before becoming law. The Senate Banking Committee will have to vote to pass the bill and it will then be put to a full Senate floor vote where it could be debated.If it passes the Senate, it will head to the House. If the House doesn’t change the bill, then it will be sent to President Donald Trump to sign into law or veto.Magazine: How crypto laws are changing across the world in 2025 

Trump crypto push could hurt Europe’s financial stability: Top EU official  
Trump crypto push could hurt Europe’s financial stability: Top EU official  

Finance officials in the European Union are concerned US President Donald Trump’s embrace of digital assets could affect Europe’s monetary sovereignty and financial stability.“The US administration is favorable toward cryptocurrencies and especially dollar-denominated stablecoins, which may raise certain concerns in Europe,” European Stability Mechanism (ESM) managing director Pierre Gramegna said at a Eurogroup press conference on March 10. Gramegna cautioned that the US crypto pivot “could eventually reignite foreign and US tech giants’ plans to launch mass payment solutions based on dollar-denominated stablecoin,” adding, “And if this were to be successful, it could affect the euro area’s monetary sovereignty and financial stability.”  The ESM “supports the ECB’s urgency in making the digital euro a reality to safeguard Europe’s strategic autonomy — this digital euro is today more necessary than ever,” he added.The ESM is an intergovernmental organization established by member states of the euro area, helping countries overcome financial crises and maintain long-term financial stability and prosperity.Pierre Gramegna speaking on US crypto threat. Source: YouTube“Policy developments in other jurisdictions can have important consequences for us here in Europe,” concurred Irish finance minister Paschal Donohoe. “These discussions are fundamentally linked to our own autonomy and to the resilience of our currency,” he added, stating that a European central bank digital currency (CBDC) was now critical to staying ahead of the curve.In February, the European Central Bank said it was expanding the development of its CBDC payment system to settle transactions between institutions. The ECB has been exploring CBDCs since 2020, including a consumer-facing retail digital euro and wholesale cross-border settlement between central banks.Meanwhile, Trump has spoken out against a Federal Reserve CBDC, signing an executive order in January to establish a crypto working group while prohibiting the “establishment, issuance, circulation, and use” of a US CBDC. Related: Crypto academics slam controversial ECB paper blasting BitcoinThe ECB has also rejected the idea of adding Bitcoin (BTC) to its monetary reserves or allowing other European central banks to do so. In late January, ECB President Christine Lagarde said that the reserves of central banks have to be “liquid, secure and safe,” implying that they would not include crypto assets. She added that she was “confident” that Bitcoin would not enter the reserves of banks under the European Council. Magazine: Bitcoin’s odds of June highs, SOL’s $485M outflows, and more: Hodler’s Digest

Web3 devs, gamers, investors thrive despite India’s crypto policy hurdles  
Web3 devs, gamers, investors thrive despite India’s crypto policy hurdles  

India’s contribution to the global Web3 ecosystem — primarily in software development, gaming, investments and startup funding — increased year-on-year despite an absence of locally tailored crypto regulations.India’s share of global Web3 developers grew from 5% to 12% in the last 10 years, second only to the United States as of 2024, according to the India Web3 Landscape Report 2024 by Hashed Emergent, shared with Cointelegraph.Developer growth in India since 2015. Source: Hashed EmergentSpeaking to Cointelegraph, Tak Lee, CEO and Managing Partner at Hashed Emergent, pointed out four key factors driving India to the top of global crypto adoption: retail crypto transactions on centralized services, highest trading volumes, institutional adoption and retail DeFi transactions.Gen Z dominates the Web3 developer landscape in IndiaThe growth is driven by the younger generation, as roughly 80% of all blockchain developers in India are between 18 and 27 years of age. The Indian developers in DeFi, Payments, AI and SocialFi prefer Solana as the go-to blockchain.Ton, Aptos and Base are steadily gaining momentum across other key sectors, driven by the expanding presence of layer-1 and layer-2 ecosystems, the report noted.Web3 sector and ecosystem trends in India. Source: Hashed EmergentWhile funding opportunities and builder initiatives like hackathons support initial growth, Indian developers have pointed out employers’ lack of willingness to pay salaries that match global industry standards. The challenges faced by Web3 gaming projects are the extremely high cost of customer acquisition (CAC) to onboard Web3 users and the lack of quality gameplay beyond financial incentives to retain Web2 gamers. “Therefore, several of these games are now focusing on having great quality games before integrating blockchain mechanics or tapping into Indian gamers’ craze for RMG,” Lee explained.Related: Indian town adopts Avalanche blockchain for tamper-proof land recordsIn contrast, investments into the Indian Web3 landscape saw a 224% increase in 2024 compared to the previous year — sourced from various avenues such as local funds, ecosystem funds and corporate venture arms of leading exchanges.Lee told Cointelegraph that the lack of growth capital in the Web3 world, along with the absence of traditional venture/growth/private equity funds, makes it difficult for Indian firms to raise capital, adding:“Therefore, entrepreneurs explore crowd sales as a way to fund their future growth. Some renowned projects may also explore crowd sales due to higher valuations offered but this is extremely rare and done by the extremely blue chip founders who can raise money from retail with ample certainty and high volumes.”Funding in India’s Web3 finance sector. Source: Hashed EmergentCompared to the previous years, the substantial growth in Web3 investments in 2024 “signals a gradual recovery, with investors focusing on emerging areas of decentralized finance,” the report said.India is a global hub for founders and developers, currently home to the second-largest developer market and third-largest founder base globally. Some of the main barriers preventing large-scale investments, according to Tak, have to do with the “slower than anticipated growth of some of these startups .“ Unclear regulations and compliances also hinder Web3 investments in India. Growing Web3 against all oddsDespite an active high-tax environment on cryptocurrency, small-scale crypto investments saw an uptick in India. Traders generally preferred small, frequent trades, with 96% maintaining positions less than $12 with an average of 11x-20x leverage. Females represented 1 in 10 futures traders in India, highlighting the scope for greater participation. The report called for reforms in crypto tax deductions and reporting in addition to the need for federal guidance and tax implications:“India must overcome its negative policy perception that stifles innovation and instead focus on identifying and addressing the pain points faced by stakeholders with effective regulation that will incentivize the Web3 sector to grow and thrive.”Indian Web3 firms call for progressive regulation for all stakeholders. Source: Hashed EmergentThe policy wish list for the Indian Web3 includes the regulatory framework for virtual asset service providers (VASP), tax rationalization, streamlined banking and payment access for Web3 companies, exemptions from VASP regulations and clarity on existing regulations.Recent regulatory initiatives like URL blocking of locally unlicensed crypto exchanges have resulted in the influx of funds to self-custodial solutions (decentralized exchanges) or domestic exchanges, which are regulated under Indian law.Magazine: Mystery celeb memecoin scam factory, HK firm dumps Bitcoin: Asia Express

Open chat
1
BlockFo Chat
Hello 👋, How can we help you?
📱 When you've pressed the BlockFo button, we automatically transfer to WhatsApp 🔝🔐
🖥️ Or, if you use a PC or Mac, then we'll open a new window to load your desktop app.