US Officials Considering How to Deal with Ransomware Payments
2021-06-27
LRC
TXT
大字
小字
滚动
全页
1American business leaders are looking for advice on how to deal with ransomware - a kind of software designed to seize a computer system until money is paid.
2The question is whether payments should be made for ransomware attacks.
3But the U.S. government has not yet given clear rules or policies on the issue.
4Eric Goldstein is a top cybersecurity official in the Department of Homeland Security.
5Goldstein told a congressional hearing last week, "It is the position of the U.S. government that we strongly discourage the payment of ransoms."
6Discourage means to try to make people not want to do something.
7Goldstein told lawmakers that paying a ransom does not guarantee that you will get your data back or that stolen files will be safe.
8He added even if the criminals keep their word, the money will be used to pay for the next round of attacks.
9But current laws do not punish business for making ransomware payments.
10Refusing to make the payments would be bad for businesses, however, especially for small and medium-sized companies.
11And the effect of non-payment could be serious for the U.S. itself.
12Recent well-known ransomware attacks led to a shortage and high gas prices in the eastern U.S. and threatened the nation's meat supplies.
13The issue has left public officials searching for an answer.
14Congress is now looking at legislation requiring immediate reporting of ransomware attacks to federal officials.
15The idea is that such reporting would help identify those responsible and even help get back some of the ransom money.
16Recently, U.S. law enforcement recovered most of the $4.4 million that Colonial Pipeline paid to a gang of criminal hackers called DarkSide.
17That was the first time the U.S. government has said that it had recovered money from the Russia-based gang.
18Last week, U.S. President Joe Biden met with Russian President Vladimir Putin in Geneva to talk about several issues including cybersecurity.
19Biden said he gave Putin a list of 16 "critical infrastructure" items, including energy and water systems, that are considered off-limits to criminal activities.
20Without additional action soon, however, experts say ransomware attacks will continue to increase.
21U.S. Energy Secretary Jennifer Granholm said this month that she supports banning payments.
22But she did not know whether Congress or the president would.
23Some of the strongest supporters of a payment ban are those who know ransomware criminals best - cybersecurity experts.
24Lior Div is the head of Boston-based Cybereason. He compared ransomware criminals to digital-age terrorists.
25"It is terrorism in a different form, a very modern one," Div said.
26A 2015 British law forbids United Kingdom-based insurance firms from paying back companies for terrorism ransom payments.
27Some believe this idea should be applied to ransomware payments.
28Adrian Nish is the threat intelligence chief at BAE Systems.
29Nish noted that "terrorists stopped kidnapping people because they realized that they weren't going to get paid."
30U.S. law forbids material support for terrorists,
31but the Justice Department in 2015 waived the threat of criminal prosecution for citizens who pay terrorist ransoms.
32Some ransomware victims have refused to make payments at a high cost.
33One is the University of Vermont Health Network, where the bill for recovery and lost services after an October attack was around $63 million.
34Ireland, too, refused to negotiate when its national healthcare service was hit last month.
35Five weeks later, healthcare information technology in the nation of 5 million remains badly damaged.
36Most ransomware victims end up paying.
37Insurance company Hiscox says over 58 percent of its affected customers pay the ransom.
38And leading cyber insurance company Marsh McLennan says about 60 percent of its affected U.S. and Canadian customers pay theirs.
39But paying does not guarantee anything near full recovery.
40In a study of 5,400 technology decision-makers from 30 countries,
41the cybersecurity company Sophos found that on average, ransom-payers got back just 65 percent of the encrypted data.
42In a separate study of nearly 1,300 security professionals,
43cybersecurity company Cybereason found that 4 in 5 businesses that chose to pay ransoms suffered a second ransomware attack.
44I'm John Russell.
1American business leaders are looking for advice on how to deal with ransomware - a kind of software designed to seize a computer system until money is paid. 2The question is whether payments should be made for ransomware attacks. But the U.S. government has not yet given clear rules or policies on the issue. 3How to respond? 4Eric Goldstein is a top cybersecurity official in the Department of Homeland Security. Goldstein told a congressional hearing last week, "It is the position of the U.S. government that we strongly discourage the payment of ransoms." Discourage means to try to make people not want to do something. 5Goldstein told lawmakers that paying a ransom does not guarantee that you will get your data back or that stolen files will be safe. He added even if the criminals keep their word, the money will be used to pay for the next round of attacks. 6But current laws do not punish business for making ransomware payments. Refusing to make the payments would be bad for businesses, however, especially for small and medium-sized companies. And the effect of non-payment could be serious for the U.S. itself. 7Recent well-known ransomware attacks led to a shortage and high gas prices in the eastern U.S. and threatened the nation's meat supplies. The issue has left public officials searching for an answer. 8Congress is now looking at legislation requiring immediate reporting of ransomware attacks to federal officials. The idea is that such reporting would help identify those responsible and even help get back some of the ransom money. 9Recently, U.S. law enforcement recovered most of the $4.4 million that Colonial Pipeline paid to a gang of criminal hackers called DarkSide. That was the first time the U.S. government has said that it had recovered money from the Russia-based gang. 10Last week, U.S. President Joe Biden met with Russian President Vladimir Putin in Geneva to talk about several issues including cybersecurity. Biden said he gave Putin a list of 16 "critical infrastructure" items, including energy and water systems, that are considered off-limits to criminal activities. 11Without additional action soon, however, experts say ransomware attacks will continue to increase. 12Cybersecurity experts 13U.S. Energy Secretary Jennifer Granholm said this month that she supports banning payments. But she did not know whether Congress or the president would. 14Some of the strongest supporters of a payment ban are those who know ransomware criminals best - cybersecurity experts. 15Lior Div is the head of Boston-based Cybereason. He compared ransomware criminals to digital-age terrorists. "It is terrorism in a different form, a very modern one," Div said. 16A 2015 British law forbids United Kingdom-based insurance firms from paying back companies for terrorism ransom payments. Some believe this idea should be applied to ransomware payments. 17Adrian Nish is the threat intelligence chief at BAE Systems. Nish noted that "terrorists stopped kidnapping people because they realized that they weren't going to get paid." 18U.S. law forbids material support for terrorists, but the Justice Department in 2015 waived the threat of criminal prosecution for citizens who pay terrorist ransoms. 19Standing up against attacks 20Some ransomware victims have refused to make payments at a high cost. 21One is the University of Vermont Health Network, where the bill for recovery and lost services after an October attack was around $63 million. 22Ireland, too, refused to negotiate when its national healthcare service was hit last month. Five weeks later, healthcare information technology in the nation of 5 million remains badly damaged. 23Most ransomware victims end up paying. Insurance company Hiscox says over 58 percent of its affected customers pay the ransom. And leading cyber insurance company Marsh McLennan says about 60 percent of its affected U.S. and Canadian customers pay theirs. 24But paying does not guarantee anything near full recovery. In a study of 5,400 technology decision-makers from 30 countries, the cybersecurity company Sophos found that on average, ransom-payers got back just 65 percent of the encrypted data. 25In a separate study of nearly 1,300 security professionals, cybersecurity company Cybereason found that 4 in 5 businesses that chose to pay ransoms suffered a second ransomware attack. 26I'm John Russell. 27Frank Bajak reported on this story for the Associated Press. John Russell adapted it for Learning English. Hai Do was the editor. 28________________________________________________ 29Words in This Story 30cybersecurity - n. the art of protecting computer networks, devices, and information 31ransom - n. money that is paid in order to free someone who has been captured or kidnapped 32encrypt - v. to change (information) from one form to another especially to hide its meaning 33customer -- n. someone who buys goods or services from a business