UK Mandatory Ransomware Incident Reporting

•
January 14, 2025    

The British government is weighing legislation requiring the mandatory reporting of all payments to ransomware groups, as well as banning public sector entities outright from paying extortion demands.

See Also: Live Webinar | 10 Strategies to Tackle Alert Fatigue with Smarter SOC

Ransomware attacks continue to cause massive disruption for private businesses and the public sector, which in the U.K. includes the National Health Service. Such attacks typically involve systems rendered inert by crypto-locking malware, data theft and a ransom demand tied with an often misleading promise of a data decryptor and pledge to delete stolen data.

The Home Office, responsible for the safety and security of the U.K., on Tuesday launched a consultation set to run until April 8 that will consider three “of the moment” proposals pertaining to ransomware:

• Payment bans for some sectors: One goal of banning public sector and critical national infrastructure entities from paying ransoms would be to make these sectors “unattractive to ransomware criminals,” the Home Office said.
• Notice of intent to pay: Any organization not covered by an extortion payment ban would have to disclose its intention to pay. The government could block any payment that crosses legal red lines such as funding a group or an individual likely subject to international sanctions. Disclosure would also allow authorities to render “live” assistance.
• Mandatory incident reporting: Victims of ransomware attacks would have to report that fact to the government within a specific timeframe, although unspecified reporting thresholds may apply.

Kudos to British government officials for fielding these proposals, especially as ransomware groups look set to not only keep causing mass disruption but also recording record profits.

“If these proposals become legislation, it would represent the most significant intervention against ransomware by any national government to date,” said Jamie MacColl, cyber research fellow at the Royal United Services Institute, a defense and security think tank based in London.

Proposals: Multiple Good Ideas

Requiring any organization that pays a ransom to report that fact to the government is a long-standing law enforcement request. Cybercrime groups love to operate from the shadows, not least to hide the true scale of their attacks, as well as the societal impact and losses incurred due to these attacks. Given that many ransomware groups operate from in or around Russia, which never extradites citizens to face foreign charges, having better knowledge of attacks is a crucial tool for helping police to disrupt them.

Recent success stories include the disruption of formerly high-flying group LockBit, as well as the sanctions being imposed against it and the members of cybercrime group Evil Corp (see: LockBit and Evil Corp Targeted in Anti-Ransomware Crackdown).

Better knowledge of attacks is also useful for tracing cryptocurrency flows, as well as tying individuals and the groups they work with to specific wallets (see: Europol Details Pursuit of LockBit Ransomware Affiliates).

Requiring organizations to signal any intent to pay a ransom is also a good move, and the Home Office said one impetus for this would to be ensure that victims receive expert guidance and advice before it’s too late.

This strategy has proven effective, not least to help counter extortionists’ use of psychological pressure to try and make victims pay quickly and quietly.

In the U.S., ransomware responders have seen a downward trend in victims paying a ransom as a “just in case” move. They credit the FBI and a concerted effort by the bureau to better assist victims. “We can put a cyber-trained FBI agent on nearly any doorstep in this country within one hour, and we can accomplish the same in more than 70 countries in one day through our network of legal attaches and cyber assistant legal attaches,” testified Bryan Vorndran, assistant director of the FBI’s Cyber Division, before a House committee in 2022.

In the U.K., the National Crime Agency and National Cyber Security Center support victims who notify them of attacks. The NCSC said it helped organizations respond to 430 cyber incidents from September 2023 through August 2024, of which 13 were ransomware incidents “deemed to be nationally significant and posed serious harm to essential services or the wider economy.”

Ensuring these agencies’ collective expertise is being used to help support more victims would be a very positive step.

Here’s What Needs Rethinking

A cautionary note: other aspects of the U.K. government’s consultation sound unrealistically optimistic. For example, the proposal to ban ransomware payments by public sector and critical national infrastructure entities is being mooted in part for “making them unattractive to ransomware criminals.”

This is largely wishful thinking, given that many ransomware groups and their affiliates often attack first and figure out whose network it might be later. Even if such opportunistic attacks don’t lead to a ransom payoff, a high-profile victim is unfortunately still useful for incessantly self-promoting cybercriminals’ brand-building.

Also unclear is how getting government approval to pay a ransom may work in practice. MacColl said this would require government and law enforcement agencies “to be uncharacteristically dynamic in responding to requests to make a payment.”

Currently in the U.K., as in the U.S., whether to pay or not is a business decision. In some cases, paying may be the only way to recover data and not go out of business. “If the government refuses requests to make a payment, it also raises the question of whether the government will step in to financially support victims who can’t afford operational downtime,” MacColl said.

Any counter-ransomware proposal with the potential to bottleneck an organization’s response is, of course, something to be avoided.

Regardless, kudos again to the U.K. government for fielding fresh proposals. These are relevant and pertinent questions to ask in the quest to better combat the seemingly nonstop spate of ransomware attacks being used to target and disrupt Western organizations.