Is the UK right to ban ransomware payments?

An article in the Financial Times (£) explores whether the government is right to consider implementing a ransom payment ban for operators of critical national infrastructure (CNI) as part of its long-awaited Cyber Security and Resilience Bill (CSR Bill). While intended to deter hackers from extorting money and disabling essential services, critics warn the measure could have severe unintended consequences, forcing managers to choose between breaking the law and allowing vital services to collapse.

The article suggests the government should tread carefully, noting the ban could leave the UK isolated. Before proceeding, key questions must be addressed, including defining critical infrastructure and preventing circumvention by foreign-based owners. Penalising victims or prompting hackers to switch tactics would not enhance security. Instead, the FT advises the government to push for mandatory reporting of payments, as countries such as Australia have adopted. It also recommends distinguishing between ransom payments to criminal gangs threatening to release exfiltrated personal data versus those that disrupt operations, and working with insurers to reduce payments becoming the path of least resistance.

£ - This article requires a subscription.