A British cybersecurity expert has called for a ban on ransomware payments to hackers. In an article for The Times, Ciaran Martin, former CEO of the UK’s National Cyber Security Centre (NCSC), has called for the government to outlaw the practice.
Under Martin’s proposal, ransom payments would be made illegal. Any businesses making a payment to ransomware scammers would be prosecuted.
Why should ransom payments be made illegal?
Ransomware is one of the most significant cybersecurity threats today. According to one report, more than $1bn was paid in ransoms in 2023 – and they expect that figure to rise again this year. For hackers, ransomware is a cheap, easy way to generate a lot of money – fast.
Seeing so many ransoms being paid encourages other cybercriminals to launch their own digital extortion campaigns. But Martin believes that if businesses are banned from making payments, financially-motivated ransomware attacks will stop because criminals will no longer be able to receive payment.
As one threat analyst commented, “For as long as ransomware payments remain lawful, cybercriminals will do whatever it takes to collect them. The only solution is to financially disincentivize attacks by completely prohibiting the payment of demands. At this point, a ban is the only approach that is likely to work.”
With no way to pay, and no prospect of receiving payment, criminals will stop using ransomware.
Does everyone agree?
Official UK government advice already states that victims should not pay any ransoms. But the reality is that many businesses could collapse if they are unable to access their IT systems. There is an implicit understanding that in some cases, paying a ransom is the only way out of the situation.
Experts believe that making it illegal to pay ransoms will simply accelerate this trend, bankrupting victims who have no other way of recovering their data. It will take time for new laws to take effect. And ransomware attacks are likely to continue for some time afterwards.
Other sources suggest that victims will simply continue to pay ransoms illegally. Should this happen, both victim and attacker become criminals. Any company paying an illegal ransom also opens themselves to becoming a target for blackmail.
Will anything change?
For the moment, no. Facing pressure from those for and against banning ransom payments, the UK government does not currently have any plans to address the situation in law. It is also worth noting that any such ban would only apply to British companies. Leaving ransomware criminals to target organizations anywhere else.
However, should one nation take a step towards banning ransom payments, it is likely that others follow. Stamping out cybercrime will take coordinated cooperation, but we have seen in the recent past that it can be made to work.
Whether ransom payments are outlawed or not, our advice remains the same. Always ensure that all your devices are properly protected with an antimalware solution like Panda Dome.