UK Government Proposes Ransomware Payment Ban for Public Sector

The UK government is considering new measures to prohibit public sector and critical infrastructure organizations from making ransom payments to hackers. This initiative is part of a consultation process launched by the Home Office, which aims to combat the growing threat of ransomware.

Proposed Ban on Payments

The proposal outlines a "targeted ban" on paying ransoms, affecting entities such as local councils, schools, and NHS trusts. The government asserts that this would "strike at the heart of the cybercriminal business model." This move comes after several public sector organizations, including the NHS, were severely impacted by cyberattacks. Last year, a significant breach involving NHS pathology lab provider Synnovis caused a critical incident, disrupting services and affecting patients' health.

Criminalization of Ransom Payments

The proposals would also extend to critical infrastructure sectors like energy and communications, making it a criminal offense to pay ransoms. Current regulations already prevent UK government departments from doing so.

Mandatory Reporting and Additional Measures

The government plans to implement a mandatory reporting system for ransomware incidents among organizations not subject to the ban. Furthermore, measures are being suggested to block ransom payments to sanctioned groups, bolstering national security efforts. Dan Jarvis, the Security Minister, emphasized the importance of these actions in protecting national interests, noting: "With an estimated $1 billion flowing to ransomware criminals globally in 2023, it is vital we act to protect national security."

Statistics and Law Enforcement Actions

According to the Home Office, the National Cyber Security Center dealt with 430 cyber incidents in the past year, including significant ransomware attacks. Many of these incidents were linked to Russia-affiliated groups, posing an ongoing threat to national infrastructure. The UK's National Crime Agency has taken steps, such as unmasking a member of the notorious LockBit ransomware group.

Consultation Timeline and International Context

The Home Office's consultation will conclude in April 2025, but it remains unclear if the proposals will be formalized in Parliament. Meanwhile, the US government has advocated against ransom payments but has not enacted a national ban. In 2023, a coalition of over 40 countries, led by the US, committed to refusing ransom demands to cut off funding for cybercriminals.