Can Biden do anything to stop ransomware attacks?
First there was Colonial Pipeline. Then the worlds largest meat supplier. And this weekend, a ransomware group called REvil struck another business, demanding $70 million in payment to unlock the systems of software company Kaseya. By attacking Kaseya, these hackers exploited all of its clients, meaning dozens and dozens of businesses experienced the cyberattack, from a Swedish grocery store chain to schools in New Zealand. This isnt REvils first strike (they were reportedly behind the meat processor hack), and it followed a similar playbook as other ransomware attacks: hold systems hostage  maybe a huge business, maybe a hospital system, maybe a local government  and then demand payment to unlock them. But this REvil ransomware attack is one of the biggest yet. Its a sign that these cyber extortions are only getting worse. What to do about ransomware attacks is a big, complex problem. A major challenge is that though the attacks are usually carried out by criminal groups, these organizations often operate, if not at the direction of, then at least with the tacit approval of the governments in the countries theyre based in. Russia is the big one. While its not publicly known exactly where REvils hackers are located, the group speaks Russian and is thought to operate out of either Russia or another former Soviet state. Its suspected ties to Russia are bolstered by the fact that REvil reportedly uses code that checks to make sure its targets are not located in a country thats part of the Commonwealth of Independent States  an organization of former Soviet countries that includes Russia. But unlike Russian state hackers who, say, interfere in US elections at the behest of Russian President Vladimir Putin, experts say these criminal groups instead just benefit from Putins benign indifference. They can do whatever they want to do, as long as they dont target Russia. Biden brought this up with Putin during their summit last month. Responsible countries need to take action against criminals who conduct ransomware activities on their territory, Biden said after the meeting. That message may not have gotten through, though, if this weekends REvil attack is any indication. To get a better sense of what tools the Biden administration does have, and what needs to happen at a foreign policy level, I spoke to Christopher Painter, a former federal prosecutor of cyber crimes and a former top US cybersecurity diplomat. Foreign cooperation, Painter said, was a key component to making progress, as both the ransomware groups and their victims exist all over the world. Cybercrime is almost always an international issue, he said. Even if I was a criminal in New York, and I was attacking someone in New York, Id route my communication through five different countries to make it hard to find me. So with that, international cooperation and commitment is really paramount.  A transcript of our conversation, lightly edited for length and clarity, follows. Christopher Painter  It is largely criminal groups who are getting into computers through any number of potential vulnerabilities, and then they essentially lock the systems  they encrypt the data in a way that makes it impossible for you to see your files. And they demand ransom, they demand payment. In exchange for that payment, they will give you  or they claim, they dont always do it  they claim theyll give you the decryption keys, or the codes, that allow you to unlock your own files and have access to them again. That is what traditionally we say is ransomware. Thats been going on for some time, but its gotten much more acute recently. There is another half of that, which is that groups dont just hold your files for ransom, they either leak or threaten to leak or expose your files and your information  your secrets and your emails, whatever you have  publicly, either in an attempt to embarrass you or to extort more money out of you, because you dont want those things to happen. So its split now into two tracks, but theyre a combined method of getting money. Jen Kirby  Weve recently had some high-profile ransomware attacks, including this recent REvil incident. Christopher Painter  Weve seen this going on for some time. I was one of the co-chairs of this Ransomware Task Force that issued a report recently. One of the reasons we did this report was were trying to call greater attention to this issue. Although governments and law enforcement were taking it seriously, it wasnt being given the kind of national-level priority it deserved. It was being treated as more of an ordinary cybercrime issue. Most governments attention is focused on big nation-state activity  like the SolarWinds hack [where suspected Russian government hackers breached US government departments], which are important, and we need to care about those. But were very worried about this, too. Its especially become more of an issue during the pandemic, when some of the ransomware actors were going after health care systems and health care providers. That combined with these big infrastructure attacks  the Colonial Pipeline clearly was one of them. Another one was the meat processing plants. Another one was hospital systems in Ireland. You also had the DC Police Department being victimized by ransomware. These things are very high profile. When youre lining up for gas because of a ransomware attack, and you cant get your food because of a ransomware attack, that brings it home as a priority. And then, of course, you have what happened this past weekend. So ransomware has not abated, and it continues to get more serious and hit more organizations. Christopher Painter  It was what they call a supply-chain attack. If you went just after a municipality or business, you only have one entity targeted. This REvil attack allowed the malicious code to spread to all the organizations that the company [Kaseya] serviced, and so that will affect them and make them all targets and victims of this. Christopher Painter  The advantage of this system is by going after this one point of vulnerability, theyre able to access and victimize lots of victims all over the place. They have lots of different targets they can go after. Theyll still go after high-value targets and ones that can maybe pay a lot. But this certainly gave them, it looks like, many, many victims. Jen Kirby  There are reports that REvil is based in Russia or another Eastern European country allied with Russia. Christopher Painter  Theyre all over the map. There are countries that provide safe havens to them. Some of them do it because they didnt have the capability to go after them or the resources. And for those countries, you want to build better capacity. You want to do joint investigations, you want to help them. There are others  and Russia falls in this category  where, at best, theyre turning a blind eye to these groups. Theyre providing safe havens more wittingly. They may not track what these groups are doing that closely, but at the same time, they dont seem to care about it or take action, as long as those groups arent going after targets in Russia. Thats somewhat in line with Putins larger international view, which is causing disruption and chaos in the West. Now, there is this range of state responsibility where sometimes groups are acting at the behest of the countries, of the states, so theyre proxy actors. Sometimes, theres corruption involved  so even though states are not sanctioning groups, individuals are being paid off. Christopher Painter  Biden said theres no evidence that the Colonial Pipeline group was acting on the Kremlins behalf. That doesnt mean that the state doesnt have responsibility when theyre essentially allowing these groups to operate with impunity. Theres been all these international processes on cyber for years now, particularly at the United Nations. Back in 2015, there were a number of cyberspace voluntary norms adopted. But theres some language in those reports that really validates that if malicious conduct is coming from a country, theres an expectation to take steps to try to control it. That just reinforces this idea that you cant just say, Hey, not me, and wash your hands. There are reasonable expectations  and certainly Biden drove that home with Putin. Christopher Painter  To some extent. Countries shouldnt allow terrorists to operate in their territory, particularly when were having these infrastructure attacks that can be really debilitating. Christopher Painter  Now, the harder part of that issue is that getting Russia to do anything is not that easy. We traditionally havent been very good at getting Russia to change its calculus. But thats one thing we have to do. If theyre going to continue to provide safe haven, weve got to use every tool we have and work with our allies and partners. Its not just us, because other countries are victims too. On the positive side, Putin is more likely to do something about this because its not him. If you tell him to do something about SolarWinds or election interference, thats one thing. He might say, Fine. Theres at least a glimmer of hope. Christopher Painter  I think Russia is one of the main ones. Theres some other countries they operate in that weve seen in the past  other actors in Eastern Europe and other places. But Russia has certainly been one of the primary ones. Jen Kirby  As you suggested, its not like Putin is the most responsible global actor. Christopher Painter  We havent been that good at it. In the last administration, President Donald Trump questioned whether Russia was even responsible for stuff, so whatever people in that administration were doing  whether it was sanctions or anything else  was undercut by the president saying, I dont know if Putins responsible. At least we now have strong, clear messaging. That obviously makes a big difference if youre trying to change the calculus of another country to get them to act. When the Obama administration did intellectual property negotiations with China, it took about two years to get them to come to the table. We indicted some of their Peoples Liberation Army officers, we threatened sanctions. Right on the eve of the summit, [President Xi Jingping] sent a delegation to negotiate with us. We were able to reach a deal, which actually had some effects for a couple of years before things fell apart with China more generally, because we used all the tools we had. We didnt make it a cyber issue; we made it an issue with the overall relationship between the US and China. President Barack Obama said back then, Look, this is a big enough issue that its a core issue in our relationship, and were willing to take friction in the overall US-China relationship. We need to do the same with other countries, including Russia. Now, there are not as many levers to pull with Russia as there are with China. China cares more  at least they used to  about their global reputation. But we havent really gone after the things that Putin cares about, like his own money flows. We can look at other areas outside the cyber area that Putin wants; youre only going to change his behavior if its something that appeals or its something he wants to avoid. We havent used all the tools we can. What you need is a sustained, strategic effort. And not just by us but [also] working with others to ratchet up the pressure  Germany, Europe, the UK. The G7 has a very strong statement on this, NATO had strong statements on this, which I think were good. You can think even about other capabilities, potentially using US Cyber Command tools to disrupt these groups, similar to what was done with the Internet Research Agency [the Russian troll farm that spread political propaganda] in the 2018 election, apparently from documents that were leaked.  Youve got to be very, very careful about this. You dont want to violate international law. You have to be worried about escalation. But if you said to Russia, Look, take action, and maybe we have to take action if you dont. Its something that has to at least be on the table. Christopher Painter  These ransomware attacks are violations of US law. If we can get our hands on these guys, we could clearly prosecute them. There are gaps where countries dont have good cybercrime laws. Weve been pressing that for a long time. But thats not really whats happening here. In this case, its more a safe-haven issue. Christopher Painter  The United Nations is mostly focused on nation-state activity. Its things like, Dont attack the critical infrastructure of a country in peacetime, dont go after the emergency response teams, or like ambulances or hospitals, supply-chain issues. To the extent the state is complicit in these activities and are using them as proxies, those kinds of rules of the road would apply. Theres still work to be done at that UN level on what is international law in this space, what are the rules of the road with nation-state activity. But these ransomware attacks are criminal activities. And its illegal when they do this. Jen Kirby  So one way to disincentivize these ransomware attackers is to put that systematic and strategic international pressure on their hosts, like Russia. Christopher Painter  The reason these groups are doing this is [that] theyre getting money easily. And the risk is very small. And when other criminals see how successful these groups are, more will come. If we made it much harder for them to get money, then theyre likely to turn to something else and away from this. But we havent done that. Now, there are complications in that. That was one area where our Ransomware Task Force  which had like 60 people, including former government officials, people from the insurance industry, people from security companies  couldnt reach a consensus. There were some who said, Cut off the money and youre going to cut off the groups. There are others who said that would victimize the victims more if we did that. It puts a hardship  maybe not on the big companies that can afford it, but the small- to medium-sized businesses. So what we suggest in the report is sort of a glide path, including making resources available for companies to help them not pay the ransom but restore their systems. We also said there are certain things that should be in place. For instance, we think there should be a mandatory obligation to report ransomware payments. There is not [one] now, and we dont even know of a lot of ransomware events that happen. That also helps governments, law enforcement agencies, and others to trace these down, because you have to give details of what youve been asked for, how you sent the money, things that they took, things that will help law enforcement efforts, either in hunting these people or disrupting their operations. Victims should consider alternatives before paying. I think one of the problems now [is that] companies arent ready for this, but there are resources out there. Theres something called The No More Ransom Project that Europol [the EUs law enforcement agency] operates. One of the things they do is, they can sometimes provide keys to help decrypt without paying the ransom. So making those resources more accessible to folks is important. And then going after cryptocurrency  not going after cryptocurrency as a thing, because whatever you think of cryptocurrency, its here to stay  but forcing existing obligations like know-your-customer rules so its harder for those payments made to these criminals to be used. You have to have different points of attack. Jen Kirby  You mentioned some resources like No More Ransom. Christopher Painter  Theres been some good multinational operations  like one Europol was involved in, the US was involved in  in taking down some of the ransomware infrastructure, called Emotet. That was a pretty big operation that had an effect for a short period of time. Other big security firms have been working on this, but I dont think theres been a huge breakthrough. Christoper Painter  We need a better sense of that. Its very possible this is flowing into all kinds of other illegal enterprises. The Office of Foreign Assets Control at the US Treasury has warned of exactly this, saying, Be careful, because you might be violating the OFAC rules if youre paying ransom, because it could go to some of these foreign groups that have sponsored terrorism and other things.  Thats caused some stir, because some potential victims were like, Well, how do we know? But thats exactly the problem. Christopher Painter  I think weve kind of reached a tipping point. I think the tipping point happened when we had the Colonial Pipeline attack, once it started focusing on things everyday people understand. It was critical infrastructure that could have resulted in death and injury. That, I think, changed the game and got peoples attention. You had ransomware rush to the top of the agenda of the G7. I used to be involved in G7, and you know how those groups work  usually, to get something on the agenda you have to work on it for six or eight months. For it to appear suddenly, when you had climate change and Covid as the main topics, is pretty remarkable. And then the NATO and the Putin summits, where it jumped to the top of the agenda. And then in the US, the Department of Justice has been doing work on this. The Department of Homeland Security has launched a 60-day sprint focusing on this. I think the White House is really focused on this. You had those commitments made in those forums like the G7 and NATO, which talked about national plans going forward. I think the US and other countries are now thinking of this as a national security issue. But were not set up to respond fully yet. That started the wheels; theyre moving relatively quickly to get there. Its still going to take time. This is not something were going to be able to solve overnight. Its going to take some sustained work and pressure.