Cyber Attacks Against Public Entities and Laws Banning Payments 

Late last year, Suffolk County, New York was forced offline due to a ransomware attack. As a result of the attack, 911 calls had to be taken down by hand, police had to radio in crime report details rather than emailing them and office staff had to use fax machines to transmit information. After 2 months, the county was still suffering from its cyber paralysis with officials admitting that more data than originally believed had been compromised, stating that personal information including driver’s license numbers associated with 470,000 traffic violations were exposed. During the months long shutdown of the county’s IT systems, essential county functions could not be completed as usual. Though Suffolk County had expended some $6.5 million in cyber security initiatives and conducted cyber-attack simulations drills, the recent hack revealed online vulnerabilities including the use of legacy systems, common in the public sector due to lack of funds to perform expensive upgrades.^xi Following the release of an investigation of the incident late last year, what is clear is that the county had been warned of a flaw exposing its data to hacking and did not perform necessary work to repair it. ^xii

In November 2021, to combat ransomware attacks against public entities, North Carolina’s legislature passed the first law in the nation prohibiting state and local government entities from using public funds to pay ransomware demands of cyber criminals.^xiii The law is broad in scope and includes provisions forbidding public entities from even communicating with malicious actors following ransomware attacks. Instead, the law requires public attack victims to consult with the North Carolina Department of Information Technology. A similar bill was passed in 2022 in Florida.^xiv Unlike the NC bill, the Florida law imposes new security standards on local governments that must be met by 2025 and that are based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework.^xv

Passage of these bills are not without controversy, however. Though designed to prevent attacks (since it becomes illegal for hackers’ ransom demands to be paid with public funds), at present there is no real-world evidence of the laws’ effectiveness in reducing the number of attacks. The fact of the matter is that just as in the case of the HBCU discussed above, there is a lack of funds available to prevent and remediate ransomware attacks at many public sector institutions. Although other states are considering legislative bans on public sector ransomware payments, paying the ransom is the fastest and cheapest way for many victims of ransomware attacks to avoid catastrophic failure or having to rebuild their entire systems from the ground up at a cost usually far greater than the ransom payment, which is often covered by cyber insurance. Without requirements in laws banning ransomware payments that the public entities have backup systems and data encryption to minimize ransomware damage, “there is little reason to believe that payment bans actually lead to an overall positive outcome.”^xvi

Some policy experts believe that laws banning ransomware payments will backfire by forcing attackers to switch to even more destructive tactics.  According to the CEO of Token, a large cyber security firm, “Almost all attacks are for financial gain and when you take that away, hackers will shift their efforts to targets with higher ROI (return on investment), like any smart business would. Government agencies will still be targets for attacks where the primary purpose is to damage or cripple US infrastructure, which is the goal of many attacks sponsored by nations that are enemies of the US.” ^xvii

Time will tell if other states fall in line with the 2 states that are hoping legislative bans on ransomware payments will spare public sector institutions from being victimized. However, policy arguments against them are worth consideration and may well carry the day.