Ciaran Martin, the founding CEO of the UK’s National Cyber Security Centre (NCSC), has reignited calls for governments, including the British administration, to implement a ban on ransom payments to hackers in an opinion piece published in The Times.

Martin likened the practice of paying ransoms to financing terrorist activities, emphasising the urgent need to curtail the flourishing criminal ransomware industry.

“Ransomware is by far the most damaging cyber threat to most businesses right now. We have to find a way of making a ransom payments ban work,” Martin said. “That is the urgent task to which the British and other governments should apply themselves.”

Ransomware attacks have reached unprecedented levels, and a survey conducted by Proofpoint also revealed that approximately 58% of businesses confronted with such attacks opt to pay the ransom, with British companies exhibiting an even higher propensity at 82%.

While Martin’s proposal for a ban on ransom payments encounters opposition, with concerns over victim criminalisation and enforcement feasibility, he advocates for a collaborative effort among governments to establish a support framework for affected organisations. This framework could potentially include financial assistance for entities unable to recover from attacks.

Despite reservations, a growing number of cybersecurity experts endorse the call for a ban on ransom payments. 

In the United States, where ransomware attacks proliferate, state legislatures are exploring similar bans despite federal government caution. The FBI, however, has expressed reservations, fearing that clandestine ransom payments may expose companies to further exploitation.

Recommended reading

• What are the Wider Implications of Ransomware Payments?
• Repeat Ransomware Attacks Common, Even if You Paid Up
• Private Branch Exchange Networks at Risk, NCSC Says

While the UK government has reiterated its opposition to paying ransoms to cyber-criminals, it emphasises the significance of international collaboration in combating cyber threats. A Home Office spokesperson reiterated the UK’s stance against ransom payments and highlighted recent joint efforts to disrupt the activities of ransomware groups.

“We have been clear that we do not pay ransoms to cyber-criminals nor do we condone or recommend businesses or victims of cyber-attacks doing so,” the spokesperson said.

Last year, a coalition of 40 countries, spearheaded by the US, pledged to never pay cyber-criminal ransoms and to collectively work toward disrupting their financial systems.