Biden Boosts Sanctions Powers to Target Cyber Underground

An executive order the Biden administration published during its final days in power includes provisions to improve and expand U.S. sanctions against the ransomware and hacking criminal underground, a top White House official said Thursday.

See Also: 2023 Ransomware Preparedness: Key Findings, Readiness and Mitigation

The order expands Department of Treasury authorities to sanction anyone complicit in ransomware operations, cyberattacks targeting critical infrastructure or unauthorized hackings of U.S. systems. The expanded authority will enable the government to target the sophisticated networks of financial facilitators and services that support ransomware hacking, said Carrol House, special advisor for cybersecurity and critical infrastructure policy at the White House National Security Council.

“We needed to make sanctions more effective to be able to punish cyber actors and the broader ecosystems that’s really propping them up,” House said during an event hosted by the Center for Cybersecurity Policy and Law and the White House on the executive order, adding that the expanded authorities “make sure that we can be more responsive to today’s dynamic threat space.”

“The specialization that we’re seeing in these increasingly sophisticated ecosystems includes a whole scope of other activities,” House said, referring to the web of money launderers, illicit infrastructure providers and brokers who enable ransomware groups and cyber criminals to operate with impunity. “We needed to make sure that the full scope of that type of activity would be able to be covered underneath the cyber sanctions authorities.”

The executive order, which also uses federal purchasing power as a lever for forcing cybersecurity improvements in industry and promotes federal adoption of digital identity documents like mobile driver’s licenses, comes just days before Washington’s transition of power (see: Final Biden Cybersecurity Order Will Face Political Hurdles).

The sanctions provisions could be a popular element of the order for the incoming Trump administration, which has signaled an aggressive stance toward China, the driving force behind a series of high-profile cyberattacks and espionage campaigns in recent years targeting U.S. federal networks, critical infrastructure and telecommunications systems.

Nation-state threat actors have used ransomware-as-a-service to fund third-party resources for cyber espionage by extorting victims through data exfiltration and dissemination, said Jim Routh, chief trust officer at cloud security firm Saviynt.

“Sanctions have been used as a tool to combat the spread of ransomware, but the results are mixed,” Routh told Information Security Media Group.

Biden’s final cybersecurity order includes a variety of eleventh-hour actions ranging the expanded sanctions authorities to requiring the federal government to exclusively procure internet of things devices endorsed by a new Federal Communication Commission cybersecurity labeling program (see: White House Launches US Cyber Trust Mark for IoT Devices).

Deputy National Security Advisor Anne Neuberger said during a Wednesday media briefing the goal of the final order “is to make it costlier and harder for China, Russia, Iran and ransomware criminals to hack, as well as to also signal that America means businesses when it comes to protecting our businesses and our citizens.”

Neuberger added that the order focuses on “pretty bipartisan goals” and key initiatives to give the next White House “the best possible foundation” for national cybersecurity.