United Kingdom Bans Public Sector from Paying Ransomware Ransom, but Debate Continues on Criminalizing Victims.
On July 22, the UK Government issued proposals to completely prohibit public authorities and critical national infrastructure operators from paying ransom in ransomware attacks.
According to the UK Home Office, this move aims to disrupt cybercriminals' business model while protecting essential public services such as healthcare, energy, and local government. This ban is broader than previous regulations, which were limited to central government departments.
The proposals were published after a public consultation from January to April, attracting a total of 273 responses. Nearly 75% of participants agreed that the ban is reasonable. However, a major point of contention emerged around the issue of applying penalties to victims.
Although most opinions support applying sanctions, concerns remain about potentially criminalizing victims and the lack of consensus between civil and criminal sanctions. The Home Office stated it will continue to consider the most appropriate and balanced approaches.
This ban is driven by the ransomware situation identified by the UK National Cyber Security Centre (NCSC) as the most serious and disruptive threat to the country. Recent attacks, such as the June incident targeting the Synnovis laboratory disrupting numerous surgeries and medical appointments, and the October 2023 attack that completely paralyzed the British National Library's system, have highlighted the urgency of this issue.
While the UK opts for a strict approach, other countries have more diverse strategies. In the US, the Republican Party in the House recently proposed cutting the budget for SEC regulations requiring companies to report cybersecurity incidents within four days.
In contrast, Australia has enacted a law requiring mandatory reporting when receiving ransom demands, while refusing to criminalize payments. The lack of consensus among countries reflects the complex challenge of balancing deterring cybercrime and protecting ransomware victims.
