The UK Government’s Home Office has taken a significant step in addressing the rising threat of ransomware in the country by initiating a public consultation on 14 January 2025. The consultation aims to tackle the issue through three key proposals designed to combat the impact and spread of ransomware.
One of the main proposals put forth by the government is the proposal to ban ransomware payments by public sector bodies and owners and operators of Critical National Infrastructure (CNI), which includes vital sectors such as energy, water supply, transportation, health, and telecoms. This ban seeks to prevent the flow of money to ransomware criminals and deter them from targeting UK organizations.
Furthermore, the government is considering the introduction of a ransomware payment prevention regime to cover all potential ransomware payments made from the UK. This would require organizations and individuals who fall victim to ransomware attacks to notify the authorities before making any payments to the attackers. The authorities would then review the notification and potentially block the payment if it violates sanctions or terrorism finance legislation.
Additionally, the government is proposing the implementation of a ransomware incident reporting regime, which would mandate suspected victims of ransomware attacks to report such incidents to the authorities, regardless of whether they intend to pay the ransom. This regime aims to improve intelligence gathering on ransomware attacks and enhance the government’s understanding of the threats in this area.
The UK has been facing a significant challenge with ransomware attacks, with the National Cyber Security Centre and the National Crime Agency identifying ransomware as the most serious cyber crime threat to the country. The WannaCry incident in 2017, which infected thousands of computers worldwide, serves as a stark example of the damaging impact of ransomware attacks.
The government hopes that by implementing these proposals, they can decrease the flow of money to ransomware criminals, increase the ability to disrupt and investigate ransomware actors, and enhance national security by understanding and mitigating the risks posed by ransomware attacks.
However, concerns have been raised about the potential downstream impact of these proposals, particularly regarding how the targeted ban on ransomware payments may affect other economic operators not subject to the ban. There is also discussion about the interaction of these proposals with existing legislation, such as the UK General Data Protection Regulation.
The public consultation on these proposals will remain open until 8 April 2025, after which a response paper will be published. Individuals and organizations are encouraged to provide their feedback on the proposals to help shape the government’s approach to tackling the threat of ransomware in the UK.