CNN is reporting that the White House intends to hold a 30-country meeting on ransomware. The focus is on law enforcement collaboration and cutting down on payments. The current open question – will Russia participate? The first meeting will happen virtually.
Europol has made two arrests in Ukraine against ransomware operators, in coordination with the FBI, French police, and Ukrainian national police. The UK is planning to invest 5 billion pounds in a “Cyber Force” which will be focused on performing retaliatory attacks. Their focus will be tier one attacks – critical infrastructure in hostile states like Russia, China, and North Korea.
Congress is looking into the decision not to share the Kaseya decryption keys by the FBI – the House Committee on Oversight and Reform has demanded a briefing from the FBI over the matter.
The House also saw a new bill introduced to direct Homeland Security to identify which digital infrastructure that, if attached, would impact safety and security. They’re asking the question – which of the 16 sectors currently labeled as critical are really essential.
There’s more budget there – the SANS institute and Nozomi Networks report a survey saying that companies are investing more in industrial control system cybersecurity. 47% report their ICS security budgets have increased over the past two years. And 36% note remote access services as the initial vector for attack.
And finally, a new lawsuit from a patient whose pregnancy was impacted by ransomware. Teiranni Kidd filed the suit claiming that Springhill Medical Center did not disclose critical patient safety-related information, including the fact that hospital operations and patient safety were compromised by the attack. The baby was diagnosed with severe brain damage at birth and died nine months later.
Those lawsuits are going to become more and more the story. This isn’t the first link to a human death from ransomware, and it won’t be the last. The consequences will be going up … and more importantly, the floor of what acceptable will be before we have discussions of criminal negligence. This case here flirts very close to my prediction of such a case to happen this year.
I included several moves on the law enforcement front to show the pattern – not all proposed laws will happen. Some… will. I think the FBI scrutiny wont go far – see my earlier statement that helping victims isn’t the primary job of the Bureau of Investigation – and the critical infrastructure focus is more important. The laws happen, then more enforcement of them.