Cyber attack: Government not considering making payment of cyber attack ransom an offence - minister
Tuesday, 18 May 2021
Justice Minister Kris Faafoi says he is not considering making it an offence to pay a ransom or to facilitate payment of a ransom in the event of a ransomware attack.
His comments came after a “cyber security incident” crippled Waikato District Health Board hospitals on Tuesday.
In a statement about midday, the DHB said it was in the early stages of identifying what happened, and was unable to provide further details. It did not say the incident involved ransomware.
Speaking generally about ransomware attacks, Faafoi said the Government’s message was that it was not advisable to pay a ransom.
**READ MORE:
* Fisher & Paykel Appliances a victim of ransomware scourge
* Embarrassed companies hit by ransomware pay up, and keep it quiet
**
“Paying doesn’t guarantee you’ll get your data back and puts you at risk of further attacks,' he said.
Regularly updating software and operating systems and ensuring 'secure segmented back-up data' could help prevent attacks and reduce the consequences if attacks did get through.
Also speaking after the Waikato DHB incident, Brett Callow, a threat analyst at Nelson cyber-security company Emsisoft, said governments needed to find better ways to protect hospitals from cyber attacks.
The quickest way to do that would be to prohibit the payment of any ransom demands, Callow said. 'If the flow of cash stops, the attacks will stop too. It really is that simple.'
Ransomware attacks on healthcare organisations had become increasingly commonplace, could be exceptionally disruptive and put lives at risk, he said.
Commenting a week ago after a ransomeware attack on the Colonial Pipeline fuel pipeline in the United States, Callow said government responses around the world to the worsening ransomeware problem had been underwhelming, and needed to change.
'Hospitals can typically restore the systems needed to get up and running fairly quickly, but complete recovery can take significantly longer.'
Callow agreed the attacks made his blood boil.
'Because what sort of person attacks hospitals, especially in a pandemic? And because why the hell have governments dithered and let it get to this point?”
'Something like this would have been unthinkable not too long ago. Now it’s not even slightly surprising,' he said.
Accenture New Zealand managing director Ben Morgan said that if Waikato DHB’s widespread IT outage was a ransomware attack by malicious actors, then it was certainly one of the most brazen to date.
Last year, ransomware gangs targeted several New Zealand companies in a bid to extract cash, he said, and ransomware attacks were growing in their sophistication and demands.
The attack on the Colonial Pipeline in the US last week led to massive fuel shortages and price increases, showing how widespread and disruptive to critical infrastructure ransomware attacks could be, Morgan said.
“Our advice to organisations is that your people are your first line of defence against any cyber attacks. One compromised account can create a backdoor to an organisation’s IT systems, where gangs can harvest credentials, company data, and lock users out.”
The former head of Britain's GCHQ spy centre, Ciaran Martin, called last week for governments to ban ransomware payments to stop criminals profiting from attacks.
Britain's The Times reported his views after the Irish health service was badly hit by ransomware and the Irish government refused to pay a ransom.
Martin said governments had allowed ransomware to 'spiral in an invisible way'.
''There's no obligation to report to anybody, there's no traceability of payment of cryptocurrency,' he told the newspaper.
In Ireland, minister for public procurement and eGovernment Ossian Smyth told broadcaster RTÉ the incident in that country was “possibly the most significant cybercrime attack on the Irish state”.
It was an international attack. 'What they're attempting to do is to encrypt and lock away our data, and then to try to ransom it back to us for money.'
Taoiseach (Irish PM) Micheál Martin said he had consulted cyber security experts and the state would not be paying a ransom.
Ireland's Health Minister Stephen Donnelly said the incident was having 'a severe impact on health and social care services', although emergency services continued.