The Office of Foreign Assets Control (OFAC) has issued an advisory for businesses who may find themselves victims of ransomware attacks. The advisory warns that making payments to cyber criminals could violate anti-money laundering sanctions. It also applies to incident response and insurance companies that help facilitate ransomware payments.
The sudden announcement from the U.S. Treasury department has alarmed some businesses who are now left wondering if they will face penalties for paying ransom demands and whether Cyber insurance is still viable. In truth, nothing has fundamentally changed. This advisory simply reiterates what we already knew.
Longstanding Regulations
OFAC maintains a Specially Designated Nationals and Blocked Persons List, and any person or institution in the U.S. that does business with someone on that list, knowingly or unknowingly, may face civil liability. These regulations, however, have been in place for some time.
OFAC likely issued the advisory in response to the dramatic increase in ransomware attacks this past year, which went up by 50% worldwide in just the past three months, according to research conducted by Check Point Software Technologies Ltd. In light of these concerning numbers, OFAC is simply urging businesses to make sure they are in compliance with federal regulations if and when they decide to make ransom payments, to ensure they are not paying criminals on the Blocked Persons List. The U.S. government is well aware of the complications of ransomware attacks, and of the costs involved for businesses. All businesses are urged to follow federal guidance and report any attack to the authorities.
What the Advisory Means for You
In order to make ransom payments that are in compliance with U.S. law, businesses – and the firms and insurers that facilitate ransom payments – need to reference lists maintained by OFAC and immediately report the event.
Businesses need to make sure they are doing their due diligence in the wake of a ransomware attack. Utilizing Cyber insurance and the reputable law firms and forensic incident response vendors provided by insurers is the easiest way to do this. These vendors will coordinate reporting to law enforcement and ensure cooperation with any steps they are instructed to take by federal authorities. Being able to demonstrate this timely compliance may be the most important factor OFAC considers.
Furthermore, the forensic vendors understand the process and are required to abide by their own compliance measures and can provide a report of their efforts. They should demonstrate that they performed automated and manual searches of publicly available threat intelligence for sanctions, including the Blocked Persons List on the OFAC website, and the consolidated lists of sanctions from the European Union and the United Nations Security Council.
OFAC can still choose to pursue sanctions even after weighing these mitigating factors, but doing this thorough due diligence will help businesses make a strong case for themselves by demonstrating their intent to follow the law.
Future OFAC Actions
Will OFAC decide to increase scrutiny of ransomware payments, or prevent businesses from making them altogether? That doesn’t appear to be the case. OFAC is opposed in principal to making ransomware payments, believing that it encourages cyber criminals to conduct more attacks and does not guarantee future protection. However, it also recognizes that some businesses will have to pay to avoid huge business interruption costs. Other federal entities such as the FBI are willing to focus more on disrupting cyber threats than enforcing OFAC rules.
For all intents and purposes, this advisory was simply a timely reminder to make sure that businesses and their vendors are reporting attacks and following federal guidance. And during a time when we are facing unprecedented spikes in ransomware attacks, making sure that we are doing our due diligence to protect ourselves and clients from risk is something we should all be doing in any case.
Want to learn more?
Find me on LinkedIn, here.
Connect with the Risk Strategies Cyber Risk team at cyber@risk-strategies.com.
Email me directly at rrosenzweig@risk-strategies.com.