The U.S. to Treat Ransomware Attacks as Terrorism, but What Does That Mean?

• The U.S. will now investigate ransomware attacks centrally, making connections and identifying exploits.
• Some think this will make ransomware attacks more cumbersome to deal with, while others hope they will thin out in the U.S.
• The matter is complicated as several antagonistic forces come into play, so the outcome is somewhat unpredictable.

The U.S. Department of Justice has announced that all ransomware incidents will now be treated as terrorism, being assigned with the ultimate level of investigatory effort in an attempt to curb the problem and reduce the number and severity of the attacks. In practice, this means any ransomware investigation across the U.S. will be handled and coordinated from a special task force in Washington, which will attempt to make connections and correlations between actors and attacks.

In the case that any hackers are arrested, they will face charges of terrorism - which is a class C felony punishable by up to 10 years of imprisonment, on top of the usual computer fraud act violations and unauthorized access that incur their own punishments. The authorities hope that this alone would be a deterrent for the actors. Still, the truth is, not many of those ransomware hackers are ever identified, let alone arrested and prosecuted.

In a recent interview with a Russian channel, REvil stated that getting classified as terrorists doesn’t mean anything for them, nor will it affect their operations. The notorious group of actors also pointed out that if the U.S. moves forward with this new legislation, it will only restrict victims from paying the ransoms quickly and getting back to business, so it will only make the effects of the ransomware attack worse.

This is, of course, a different view from what the Americans are hoping to achieve with the new approach, and how the landscape will shape depends on the dynamics that’ll come into play. If ransomware payments are treated as terrorist financing, some countries will face international consequences for paying ransom to actors. Also, if American firms don’t pay, hackers will gradually stop hitting them.

Dirk Schrader, Vice President at New Net Technologies tells us:

Clearly, this is not a one-side coin, and there are opposing factors that are bound to affect the result. Some believe it’s a solid step in the right direction, and others think it will just make matters worse. For the U.S. law enforcement authorities, it is a response to a situation that has been out of control for way too long now, and responding with something is far better than doing nothing. If the system is evaluated as inadequate or negative, the U.S. state will have a basis to build upon and develop a better approach.