The fight against the scourge of the data privacy world, ransomware, has taken a new turn as the U.S. federal government has issued new guidance making clear that victims of ransomware attacks who opt to pay ransom demands may in turn face government-imposed penalties.

The Basics of Ransomware
Ransomware is a type of computer malware designed to extort ransom payments from its targets.[i] Ransomware acts by infecting a computer, disabling the entire computer or specific functions of the computer, and presenting a message on the computer screen demanding a ransom payment in exchange for regaining the computer's functionality. Ransomware has taken on many different forms throughout its history and has continued to evolve, presenting one of the greatest threats to data privacy across all industries in which private information is digitally stored.

Modern ransomware hackers take advantage of online pre-payment methods and virtual currencies, which act similarly to online prepaid functions.[ii] The computer user – or, more commonly in large organizations, the organization's insurer or cyber forensic response team – loads funds into an online account (to which the hacker has access), using his or her own credit card. The hacker then retrieves the funds and decides whether to unlock the victim's computer or dishonor the agreement. The U.S. government has, in the past, urged organizations not to pay ransoms to ransomware hackers, but did not take any overt action to prevent organizations from paying ransoms.

The U.S. Department of Treasury's New Advisory
On October 1st, 2020, in the face of rising ransomware attacks throughout the Covid-19 pandemic, the U.S. Department of Treasury published its Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments.[iii] The Advisory notes that institutions often involved in facilitating payments to ransomware hackers, including cyber insurers, digital forensics firms, and financial institutions are part of the ransomware problem in that they encourage hackers to continue deploying the virus and that these institutions may actually be in violation of the Department of Treasury's Office of Foreign Assets Control (OFAC) sanctions regulations. Specifically, OFAC designates malicious actors under its cyber sanctions program and prohibits U.S. organizations from providing material support to these malicious actors. Several active cybercriminal organizations as well as the developers of certain, successful ransomware variants have been labeled as malicious actors by OFAC and thus financial payments to these actors are prohibited.

In the context of a ransomware attack, the victim of the attack, their insurer, a digital forensics organization hired to provide support, a financial institution, or any other entity (although not explicitly mentioned in the advisory, law firms who assist in these payments would also likely be subject to the same rules) involved in the attack response would be prohibited from making any form of payment to the hacker in exchange for the release and/or non-disclosure of the compromised data if the hacker has been designated a malicious actor under OFAC's cyber sanctions program. The clear issue that arises here is that determining the identity of a ransomware hacker is often beyond the ability of non-government organizations, particularly when these organizations are primarily concerned with protecting their compromised data and mitigating the harm of an ongoing ransomware attack. In deciding whether to make a ransom payment, cyber response teams will now need to weigh the possibility of penalties if they cannot ascertain the identity of their attacker.

Determining the Penalty Amount
The Department of Treasury Advisory provides guidance on the penalties that may be imposed on those who pay ransomware hackers as well. Importantly, the Advisory makes clear that entities may be held liable for payments to ransomware hackers even if they are unaware of a legal violation under a strict liability scheme. The Advisory also references a penalty schedule provided in 31 C.F.R. part 501, appx. A[iv] with the severity of the monetary penalty dependent on the amount paid to a ransomware hacker.

OFAC has discretion regarding whether, and to what extent, it will penalize entities making payments to ransomware hackers. The factors OFAC will weigh in determining the severity of a penalty for violating this prohibition are found in the Code of Federal Regulations[v] and include: (1) whether the violation of OFAC's regulation was willful or reckless; (2) whether the at-fault party was aware of its own conduct; (3) the harm to the goals of OFAC's cyber sanctions program; (4) the characteristics specific to the at-fault party, including their size and commercial sophistication; (5) whether the party had a cyber compliance program in place; (6) the remedial actions taken by the party; and (7) the party's cooperation with OFAC throughout the investigative process.

Impact on the Insurance Industry
An essential player in an organization's ransomware response, the organization's insurer, should pay particularly close attention to the new advisory and any regulations which may arise from this new policy. Insurance coverage has become a critical piece of an organizations' preparation for possible ransomware attacks. Some policies insure against financial losses, as well as provide the aid of forensic and IT security response teams in managing an ongoing attack. This all-encompassing approach has led to insurers becoming necessary parts of an organization's response and recovery efforts.

Insurers will need to be cognizant of the potential penalties they may incur if they attempt to negotiate with ransomware hackers. Insurers should work to have controls in place to prevent prohibited payments and work with the insured and counsel in creating a response plan in light of the advisory. Further, the new advisory may pressure insurers to place stricter preventative requirements on their insureds, such as requiring their insureds to undergo preventative compliance training, as mentioned in the advisory and specified under in 31 C.F.R. part 501, appx. A, in an effort to mitigate any potential penalties they may face under the advisory. Insurers should also be active in providing competent counsel as part of response to ensure compliance with the advisory.

Conclusion
While the Advisory represents the federal government's approach to curb ransom payments to hackers, at the same time, the Advisory raises several additional hurdles for entities enduring a ransomware attack as well as the response teams in place to aid ransomware victims. Organizations maintaining valuable data should take a proactive approach by implementing cyber legal compliance programs in anticipation of a ransomware attack. Such programs should incorporate OFAC's seven-factor analysis to limit any potential liability to the federal government, while also promoting the organization's primary goal of protecting sensitive, at-risk data.

This advisory presents a policy shift in the government's approach to handling the ransomware problem and insurers will need to shift accordingly. While potential liability has existed in the past for any party making payments to organizations designated as malicious actors or terrorist groups by the U.S. government, there has been no explicit guidance on this issue in the ransomware context in the past. Unfortunately, any non-government entity will struggle to ascertain the identity of a ransomware hacker – let alone to determine if they have been designated a malicious actor by OFAC. This advisory will add another step to an already complex and stressful time for ransomware victim. Also, considering that time is of the essence in ransomware situations, the added, difficult step of identifying the malicious actor will create difficult decisions as insurers and response teams balance the threat of data loss with the threat of sanctions.

Avery Dial is a partner and co-chair of the Data Privacy & Cybersecurity Practice Group at Kaufman Dolowich & Voluck LLP.

Henry Norwood is a litigation associate at Kaufman Dolowich & Voluck.

[i]. How to Protect Your Networks from Ransomware, U.S. Gov. 2 (last updated 2016), https://www.justice.gov/criminal-ccips/file/872771/download.

[ii]. Gavin O'Gorman & Geoff McDonald, Ransomware: A Growing Menace, Symantec Security Response 2 (2016), https://www.01net.it/whitepaper_library/Symantec_Ransomware_Growing_Menace.pdf.

[iii]. Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments, U.S. Dept. of Treasury (Oct. 1, 2020), https://home.treasury.gov/system/files/126/ofac_ransomware_advisory_10012020_1.pdf.

[iv]. 31 C.F.R. part 501, appx. A.

[v]. Id.

The views and opinions expressed in this article are those of the authors.