This article is part of the On Tech newsletter. You can register here to receive it weekdays.
Ransomware attacks can be very devastating, and they only get worse and worse.
This form of cybercrime involves hackers breaking into computer networks and locking in digital information until the victim pays for it. Hospitals paralyzed by ransomware attacks were forced to reject patients, and a pipeline of natural gas was forced offline for two days last year.
My colleague, Nicole Perlroth, has spent years documenting the proliferation of cyber attacks, including ransomware. She talked to me about steps the US government and individual organizations could take to better prevent it. Nicole tried to hope but she had a discouraging diagnosis of the root cause of ransomware: the US failed to invest in its defense.
Shira: Did ransomware attacks become more common or did it just seem that way?
Nicole: It got worse. We have seen an increase in attacks, more types of organizations targeted, and tens of millions of dollars in ransom demands. And ransomware gangs are attacking us in more visceral ways than ever before.
Pandemic made things worse. Companies, schools, and other organizations have had to provide virtual employees. That has created more opportunities for crime.
In just the last few months in the United States, ransomware gangs have attacked large businesses, schools and universities, local governments, hospitals, and the police. And they became more brazen. A relatively new turning point is that criminals threaten to make organizations’ data publicly available if they don’t pay.
What are some consequences of ransomware attacks?
The criminals recently targeted a Florida police department and leaked records including a folder labeled “dead” with photos of the bodies from the crime scene.
The worst thing I’ve ever seen happened at the University of Vermont Medical Center. The hospital is unable to treat some chemotherapy patients because an attack wiped out their records. Nurses say it has been one of the worst experiences of their careers.
How can people justify hurting cancer patients or leaking photos of dead people?
I have no words for this that can be printed in a home newspaper.
What is the United States doing to prevent or slow down ransomware?
We are not trying very hard. The United States is the country most heavily targeted by cybercriminals and the nation that is targeted, but we are not doing the same. We mainly give instructions to companies and government agencies to prevent ransomware attacks and hope for the best. It doesn’t work.
What should I do instead?
There is no silver bullet, but there are some steps that might help. The US government may designate ransomware as a national security threat on par with terrorism, which will attract more intelligence resources to counter it. Countries that provide safe havens for ransomware gangs like Russia can be penalized or restricted from traveling to the United States. That will put pressure on countries to hunt down ransomware criminals inside their borders.
We may also require companies and government agencies attacked by ransomware to disclose them publicly. The Treasury Department may consider prohibiting victims from paying the ransom. Most ransomware gangs require payment in Bitcoin and it can help track criminals if the banking industry “Know your customer” rules and anti-money laundering laws are enforced with exchanges. electronic money.
And we need a 911 hotline for ransomware victims. Organizations often do not know who to call when they are targeted.
What can ransomware compromised organizations do to prevent them?
If companies, government agencies, and organizations require all employees and others accessing their computer networks to use strong passwords, password managers, and multi-step authentication, then a long way to stop network attacks.
It will also be useful if required organizations have copies of their digital records and back them up on a regular basis. Victims will not have to pay to recover their own data. The government can also create tax credits or other financial incentives for companies and government agencies that take those steps.
I don’t want to blame the victims, but why haven’t the companies and public agencies implemented such protections?
Many essential services are run by small organizations that don’t have the resources or the ability to do the basics. Hospitals, schools, and US governments are common targets for ransomware because they tend to use older software with irreparable security vulnerabilities.
This sounds grim.
I don’t want people to feel hopeless. But yes, ransomware and other network attacks will only get worse. The central problem is the US lack of urgency and investment to protect digital systems.
Before we go …
Beijing could be the last arbiter in their tech industry: China is trying to force big tech companies to change the behavior they see as anti-competitive. Instead, Chinese internet companies are using the threat of government action to defeat their opponents, my colleague Li Yuan wrote in her latest post. She said that could further strengthen the Communist Party’s power over China’s digital industries.
His threatening rant is illegal: A New York jury concluded that a man who posted threats against members of Congress online but did not act on them was not protected by the First Amendment, Nicole Hong, co. My career reports. Last week in On Tech magazine, Nicole described this case and the line between free speech that provokes hatred and illegal threats.
Big sums of money for Big Tech: Apple and Facebook have made a lot of money so far this year. And Amazon, on its way to hiring, will raise hourly wages for about half a million workers.
Cellists played concerts for some music-loving cows (and humans) in a village near Copenhagen. Cows don’t seem to like Dvorak.
We want to hear from you. Let us know what you think about this newsletter and what you want us to explore. You can contact us at [email protected]
If you have not received this newsletter in your inbox, Please register here.