The National Cyber Security Centre (NCSC) and the Information Commissioner’s Office (ICO) have shared a joint letter with the Law Society after increases in ransomware payments.
In the letter, solicitors are being asked to play their part in keeping the UK safe online by helping to tackle a rise in payments being made to ransomware criminals. The Law Society has been asked to remind its members of their advice on ransomware and emphasise that paying a ransom will not keep data safe or be viewed by the ICO as a mitigation in regulatory action. The NCSC – which is a part of GCHQ – and the ICO state that they have seen evidence of a rise in ransomware payments, and that in some cases solicitors may have been advising clients to pay, in the belief that it will keep data safe or lead to a lower penalty from the ICO.
The Law Society have been asked to clarify to its members that this is not that case, and that they do not encourage or condone paying ransoms, which can further incentivise criminals and will not guarantee that files are returned.
Tackling cyber crime, in particular ransomware, is at the heart of the National Cyber Strategy which was launched in December 2021 and which aims at increasing capability of law enforcement partners so they can better respond to cyber attacks. For instance, the National Cyber Crime Unit (NCCU) within the National Crime Agency (NCA) was created to bring together law enforcement experts into a single elite unit. There is also an established network of regional cyber crime units (ROCUs) to provide access to specialist capabilities across the country.
NCSC CEO Lindy Cameron said:
“Ransomware remains the biggest online threat to the UK and we do not encourage or condone paying ransom demands to criminal organisations.
“Unfortunately we have seen a recent rise in payments to ransomware criminals and the legal sector has a vital role to play in helping reverse that trend.
“Cyber security is a collective effort and we urge the legal sector to work with us as we continue our efforts to fight ransomware and keep the UK safe online.”
John Edwards, UK Information Commissioner, added:
“Engaging with cyber criminals and paying ransoms only incentivises other criminals and will not guarantee that compromised files are released. It certainly does not reduce the scale or type of enforcement action from the ICO or the risk to individuals affected by an attack.
“We’ve seen cyber crime costing UK firms billions over the last five years. The response to that must be vigilance, good cyber hygiene, including keeping appropriate back up files, and proper staff training to identify and stop attacks. Organisations will get more credit from those arrangements than by paying off the criminals.
“I want to work with the legal profession and NCSC to ensure that companies understand how we will consider cases and how they can take practical steps to safeguard themselves in a way that we will recognise in our response should the worst happen.”
In response, the Law Society have published repeated the message in the most recent edition of the Professional Update .
If you experience a ransomware attack or other cyber crime, then you should report this directly as an ongoing incident to Action Fraud (on 0300 123 2040 which is available 24/7), Information Commissioner’s Office (for data breaches under the GDPR), or to the NCSC for any major cyber incidents. Law enforcement will then be able to mitigate the impact of the attack and secure evidence that can assist an investigation.
The NCSC has a wide range of guidance on mitigating the ransomware threat, for example advising companies to keep offline back-ups. All of its advice can be found on its ransomware pages. The ICO recently updated ransomware guidance can be found on its website.
The joint letter to the law Society can be read here.
Those who are subscribers to the Infolegal InfoHub will find guidance on ransomware related issues.