Deal with ransomware the way police deal with hostage situations

Publication Type: 
Other Writing
Publication Date: 
March 25, 2020

When faced with a ransomware attack, a person or company or government agency finds its digital data encrypted by an unknown person, and then gets a demand for a ransom.

As that type of digital hijacking has become more common in recent years, there have been two major ways people have chosen to respond: pay the ransom, which can be in the hundreds of thousands of dollars, or hire computer security consultants to recover the data independently.

Those approaches are missing another option that we have identified in our cybersecurity policy studies. Police have a long history of successful crisis and hostage negotiation – experience that offers lessons that could be useful for people and organizations facing ransomware attacks.

Understanding the problem

In the first nine months of 2019, more than 600 U.S. government agencies – including entire municipal governments – suffered ransomware attacks. Louisiana Governor John Bel Edwards was forced to declare a state of emergency following ransomware attacks on state government servers that caused widespread network outages at many state agencies, including the Office of Motor Vehicles and the departments of Public Health and Public Safety.

Many of those victims chose to pay the ransom demanded by whoever hijacked their data. Lake City, Florida, for instance, paid US$460,000 to unlock its data.

Other targets, like the city of Baltimore, chose to fight back instead of paying the ransom. Rather than handing the attackers the $76,000 they demanded, Baltimore paid more than $10 million to purchase new equipment and absorbed more than $8 million in lost revenue from taxes and fees that went unpaid while systems were down.

Those moves were in line with FBI advice saying that paying the ransom could increase the likelihood of additional attacks, both on previous targets and new ones.

More recently, the FBI has softened its stance to open the door to the paying of ransom in certain cases, but to always report doing so to law enforcement. Although the agency still underscores that paying a ransom does not guarantee that the encrypted files will be recovered, or that the victim will not be targeted again, it does recognize that “all options” should be considered in these cases.

Read the full piece at The Conversation