The UK government has proposed new legislation to ban ransomware payments for public sector organisations and operators of critical national infrastructure (CNI), introducing mandatory incident reporting requirements for other sectors. The measure aims to disrupt the financial ecosystem underpinning cybercrime and protect essential public services by making them less attractive targets for ransomware attacks. According to the Home Office, “The ban would target the business model that fuels cyber criminals’ activities and makes the vital services the public rely on a less attractive target for ransomware groups.”
Background and Details
- The proposed ban applies to publicly funded bodies, including parts of the NHS, education, and CNI operators.
- Private sector organisations are not included in the ban but will be required to report ransomware incidents.
- Centralised reporting is expected to enhance intelligence-sharing and coordination against ransomware threats.
Consultation Results
| Stakeholder Group | Support for Ban | Support for Reporting |
|---|---|---|
| Public sector & CNI consultation respondents | 72% | 63% (reporting from other bodies) |
The government’s decision follows broad support during the consultation period, where 72% of respondents agreed with a targeted ban for public sector and CNI organisations. Moreover, 63% supported mandatory incident reporting for entities outside the ban. The proposals extend current policy—where ransoms are already not paid by central government—to additional public functions and arms-length bodies.
Implications and Expert Insights
- Experts note that while the move could disrupt cybercriminal activity, it may result in attackers shifting focus toward private sector organisations not covered by the ban.
- Many public sector bodies have historically been targeted due to weaker cybersecurity and reliance on legacy systems.
- Chris Atkinson of PA Consulting commented: “The banning of ransomware payments by UK public bodies and formalizing of ransomware reporting will have a positive impact. It will help disrupt cyber criminals and give UK authorities even greater visibility of the problem. It will not be the end of ransomware though… these [attacks] could increase” in other sectors.
- Enforcement aligns with international efforts such as the US-led Counter Ransomware Initiative, where 40 countries have pledged not to pay ransoms.
Despite the policy, ransomware remains only one vector of cybercrime—fraud, theft, and money laundering continue to pose significant risks. There are instances where public authorities have paid more for remediation than the original ransom demand, illustrating the complex decisions faced when managing cyber incidents. Law enforcement agencies, such as the FBI, strongly advise against paying ransoms, and paying could constitute an offence under counter-terrorism or organised crime laws.
Further Reading
- Common Issues with Casino Withdrawals
- PayPal Tightens UK Account Rules for Payouts
- UK Watchdogs Tighten Their Grip on Apple Pay & Google Pay
- FCA Mandates Daily Safeguarding for Payment Firms
- Safe Online Casinos
For more background, see the original source at ITPro.
