New York state senators have drafted two bills this month that propose a ban on paying ransomware attackers with tax-payers money.
New York Refuses to Negotiate with Criminals
In April of 2017, the National Security Agency (NSA) was hacked by an unidentified team of hackers who called themselves the Shadow Brokers. The Shadow Brokers were able to steal all the NSA’s top secret hacking tools, including zero-day exploits, and other tricks of the trade that the agency used to target terrorists for espionage. These stolen tools were sold on the dark web to the highest bidders, by the cybercriminals.
Ever since then, there has been an epidemic of ransomware attacks on local and state governments, businesses and other organizations who have sensitive data. The hackers are able to use tools stolen from the NSA, like the Eternal Blue malware, to encrypt all the files on an infected machine, and then they demand a ransom, usually in Bitcoin, for the keys to decrypt the data. Many victims have paid, and others have chosen to permanently lose the data by not paying.
Municipal targets like local and state governments often choose to pay the ransoms and recover data at the expense of city budgets, and tax revenues. The new bill S7246, introduced by New York Senator, Phil Boyle, would restrict government access to funds in order to pay ransoms in cities with a population under a million residents.
A second bill, S7289, was proposed by New York Senator, David Carlucci, just days later. This bill would create funds to update the country’s ageing cybersecurity infrastructure and make local and state sytems less vulnerable to ransomware attacks. Together, these bills are NY’s one-two punch combo to knock out ransomware attacks.
Ransomware attacks are now the preferred cybercrime of hackers
Ransomware attacks, or cryptojacking as they’re also known, have been exponentially increasing worldwide. In one such attack, the city of Sacramento, California’s Regional Transit system was targeted by hackers. The city chose not to comply as the hack didn’t affect a majority of RT passengers. Hackers look to target systems of critical infrastructure in many of these types of attacks.
In another attack, a federal maritime facility had its IT systems infected and encrypted by the Ryuk ransomware. In another incident, the Port of San Diego was targeted in 2018. The US Coast Guard was investigating the hack, and again the hackers demanded a ransom paid in Bitcoin.
In yet another ransomware attack, the Leominster Public Schools District in Massachusetts had to pay a ransom to unlock their data after hackers demanded over $10,000 USD. The funds were paid out of taxpayer money for the school’s budget, exactly the kind of event the two bills in NY are aimed to prevent.
The most recent ransomware attack took place a matter of days ago. Bird Construction of Ontario, Canada, became the latest victim when its files were encrypted by cybercriminals. The multimillion dollar firm has been a federal contractor, which has constructed police stations, and defense installations. So far not very much information about the attack has been released, but it illustrates that ransomware is a growing problem.
Do you think these two new laws will curb ransomware attacks? Let us know in the comments!
Images via Shutterstock