“If we ban ransom payments now, you’re putting US companies in a position to face yet another extortion, which is being blackmailed for paying the ransom and not sharing that with authorities,” Vorndran said at a Senate Judiciary Committee hearing on ransomware.
The debate over outlawing ransomware payments illustrates the broader challenge facing policymakers as they seek to clamp down on a crime that takes advantage of a victim’s financial incentives: It can often be more tempting to pay in hopes of resolving the problem quickly, cybersecurity experts say, compared to refusing to negotiate, having to restore data from backups and risking the release of sensitive information online.
While US officials have sought to discourage ransomware victims from paying, they have struggled to find effective ways to deter that behavior. The Treasury Department has made it a potential sanctions violation to send a ransomware payment to an entity under US sanction, but that restriction does not apply to non-sanctioned recipients.
“It’s a really complicated conversation, but it’s our position that banning ransom payments is not the road to go down,” Vorndran added.
In April, the Institute for Security and Technology released a report by the Ransomware Task Force — which is composed of government officials, cybersecurity experts and businesses — that did not make a specific recommendation on whether to ban ransomware payments. It was the only issue not to receive a recommendation in the report.
“If we were to prohibit payments now, the ecosystem is simply not ready,” said Philip Reiner, CEO of the Institute for Security and Technology, at a House Energy and Commerce subcommittee hearing on ransomware last week.
The Justice Department hopes Congress will step in by injecting some transparency into ransom trends. Businesses should have to disclose attacks to the US government that involve ransomware, critical infrastructure or “other high-impact breaches,” said Richard Downing, deputy assistant attorney general for DOJ’s criminal division.
“We think reports should be prompt and should include details of any ransom demand or payment,” Downing continued. And victims should be given legal protections for sharing the attack information with the government, he said.
DOJ’s call for mandatory reporting requirements mirrors legislation recently introduced by Sens. Mark Warner, Marco Rubio and Susan Collins that would impose a 24-hour cyber-reporting requirement on federal agencies, contractors and critical infrastructure operators.
Sen. Sheldon Whitehouse faulted industry lobbyists for helping to create the current ransomware crisis, citing the largely voluntary and self-regulatory approach surrounding cybersecurity that he said led to Colonial Pipeline’s compromise.
“Over and over again, groups like the US Chamber of Commerce have come in and said, ‘Don’t regulate us, we’re against all this cyber regulation. We don’t want any of this, make it all go away. We’re against this bill, we’re against that bill. We’re going to tell the [Senate Majority] Leader to block this legislation if it tries to go forward,'” said Whitehouse. “And so we now have a situation in which you have critical infrastructure companies fail at meeting basic standards of cyber hygiene and we’re okay with that, as a legal matter … We don’t have to regulate everybody in the world, but if you’re critical infrastructure, we should no longer tolerate this voluntary regime with big companies who know that their infrastructure is critical and who fail.”