Security Experts Call for Ransomware Payment Ban

A former cyber security chief says governments should ban organizations from paying money to ransomware gangs. Ciaran Martin likened such payment to bans on paying terrorist kidnappers.

The call has had a mixed response, with critics calling it an unfair constraint on business freedoms.

Martin was the first head of the United Kingdom's National Cyber Security Centre. That's an organization overseen by the country's intelligence services that advises businesses and the public on cyber security threats.

Ransomware has become a business worth an estimated $20 billion a year to criminals who gain access to computer networks and then encrypt files. The growth is partly through an expansion in tactics: as well as demanding payment to restore access to the files, some gangs also threaten to publicly expose any sensitive data on the networks.

A United States-led program has already seen 40 governments around the world agree not to pay ransoms in such cases. Many governments also advise businesses to never pay ransoms, with the logic being that it increases the incentive for future attacks. (Source: itpro.com)

Comparisons To Terrorism

Now Martin has told The Times that governments should make it illegal for businesses to pay money to ransomware gangs. He likened it to existing bans in some countries on businesses paying money to terrorist groups who have kidnapped staff members.

There's something of a chicken-and-egg situation as Martin noted such a ban would be more effective if governments offered more support to help businesses improve cyber security to prevent ransomware attacks.

Australia has considered such a ban but put it on hold for two years to give businesses time to improve their defenses.

Cultural Attitudes Vary

The Times suggests the idea of a legal ban on ransomware payments would be particularly unpopular in the US, which in turn influences attitudes in other countries. That's partly because the US is particularly wary of constraints on how businesses operate. (Source: thetimes.co.uk)

Another issue is that private healthcare companies in the country are prime targets for ransomware. Public health concerns may make lawmakers wary about removing even the slim possibility that ransomware gangs might live up to their promises to restore data after payment.

What's Your Opinion?

Do you support a ban on businesses paying ransoms? Is it more important to create a united front against cyber crime or to let organizations make their own decisions about payments? Are their more effective ways that governments could combat ransomware?