UK government considering mandatory reporting for ransomware attacks

The British government wants all organizations that become victim of a ransomware attack to report this. Victims who wish to pay ransom, will have to seek a license before they are allowed to pay any extortion payments.

That’s what multiple sources with knowledge of the matter tell The Record.

One of the reasons the UK government is pondering this new policy, is to get a grasp of the true scale of the problem, which is a known unknown for policymakers for years. Last year, the National Cyber Security Centre (NCSC) and the Information Commissioner’s Office (ICO) warned that more and more ransomware victims were keeping the security incidents to themselves.

With a ban on ransom payments by vital organizations in the critical national infrastructure, the authorities hope to discourage hackers from attacking such parties and monetizing from them.

It is yet unclear how the licensing regime would work. The sources The Record spoke expect that the mandatory reporting requirement will potentially help ransomware victims to realize they had alternatives to making extortion payments. However, at the same time they have voiced concerns that the application process could be a hindrance for companies for a speedy recovery. The licensing regime could potentially increase the damage and disruption caused by a ransomware attack.

UK government wants to strengthen its global response to ransomware

It’s unlikely the government will be able to introduce any new bills to the British Parliament anytime soon. The public consultation process, which is a pivotal feature of the British legislation, has yet to take place. The opposition Labour Party moreover has not yet set out its policy position on ransomware or other cybersecurity issues.

A government spokesperson told The Record that preventing ransomware attacks is “a key priority” and that the United Kingdom is “well prepared to respond” to the issue.

“The UK is also strengthening the global response to ransomware, securing an unprecedented international agreement to denounce payments. We will continue to work with our international partners, law enforcement agencies and industry on this vital issue”, the spokesperson added.