We're right behind Computer Misuse Act reforms for busting ransomware gangs, says UK infosec industry

British infosec businessees mostly support beefing up the Computer Misuse Act to directly tackle the ransomware crisis – while reform campaign CyberUp has written to Home Secretary Priti Patel offering “support” for “a renewed, forward looking framework”. A number of firms that spoke to The Register expressed firm support for …

[Richard 12]

Paying a ransom is already illegal sometimes

Under the Proceeds of Crime Act 2002, and the Terrorism Act 2000.

https://publications.parliament.uk/pa/ld200809/ldselect/ldeucom/132/9031112.htm

And frankly, if my mum was in an ICU that got "shut down" by ransomware I would still be demanding that they do NOT pay any ransom.

If only because I could not possibly trust any of the "decrypted" files.

Nuke the site from orbit and restore from a backup. It's genuinely the only way to trust the system ever again.

[Pascal Monett]

"wary of criminalising the payment of ransoms by victims"

Didn't the FBI go through all those kinds of arguments already when they they pushed for criminalizing kidnapping ransoms ?

I seem to recall that that had a pretty good effect.

[Mike 137]

"...use of backups"

'“Another approach,” he offered, “is to provide victims with incentives to find ways other than paying ransoms to restore their files, such as the use of backups.”'

Very few organisations I've worked with actually test their backups. They assume they're good until they find they're not. Apart from which, if (as is typical) it can take a few days or more to find out you've been done, your automatic scheduled backups could quite possibly be useless. The one vital protection that nobody seems to mention is vigilance so you find out and respond immediately if someone is attempting to break in.