WIREDGOV

As organised cybercriminal attacks escalate and threaten national security and social order, should the private sector get (limited) authorisation to take the gloves off?

The threat posed to the UK by serious organised cybercrime continues to increase in scale and become more sophisticated. Given that the cybercrime threat has worsened year-on-year for several decades, this is a somewhat cliché statement. Nonetheless, the disconnect between the scale of the issue and the resources to combat it is stark. A report earlier this year suggested that the reported number of cybercrime incidents rose three times faster than recruitment of suitable law enforcement personnel. The real figure is likely to be higher, given that many incidents against individuals and organisations may go unreported.

The UK government has undertaken a range of actions that should be lauded, including but not limited to: reducing the likelihood of incidents by raising resilience through a range of voluntary and obligatory measures; reducing the impact of incidents by providing rationed incident response assistance (429 incidents in one year alone) or financial support for supply chains (in the case of the Jaguar Land Rover incident); and taking the fight to the adversary through disruptive operations and enforcement, particularly in partnership with allies.

However, the cybercrime – and particularly ransomware – threat has evolved over time to more-efficiently extract funds from victims whilst navigating increased pressure from governments and law enforcement agencies. The status quo of hundreds of impactful attacks where data is stolen and/or maliciously encrypted is unacceptable. The cumulative societal costs of incidents can be measured not only in lost revenue or productivity, but also through psychological and physiological harms and a fracturing of a cornerstone of liberal order: the idea that the state can protect its citizens and bring criminals to justice. Additionally, whilst fears of ‘systemic’ cyber should not be overplayed, there is a distinct possibility of a future catastrophe; a Category 1 cyber incident that has a sustained impact on UK societal services, up to and including threat to life.

Against this backdrop, the UK government is moving ahead with ransomware legislation that will A) introduce a mandatory incident reporting regime to improve the government’s data on the scale and breadth of ransomware incidents and B) prohibit select organisations from making ransom payments. Notably, these measures place burdens on the victims of crime, rather than the perpetrators.

Click here for the full press release