View all newsletters
Receive our newsletter - data, insights and analysis delivered to you

Law enforcement is ‘failing to protect governments against ransomware’

Authorities are failing to protect the public sector from growing tide of ransomware, says former UK security adviser.

By Claudia Glover

Law enforcement agencies are failing to protect government against ransomware attacks, according to a former security adviser to the UK government.

Paddy McGuinness OBE, who was deputy national security adviser for intelligence, security and resilience at the Cabinet Office until 2018, made the remark amid intensifying ransomware attacks on governments around the world.

Government agencies in Costa Rica face continued disruption from an ongoing attack by Russia group Conti, which has threatened to “overthrow the government” in the Central America country.

Last week, the Austrian state of Carinthia halted passport services after ransomware infected 3,000 workstations. And this week, a ransomware attack on Somerset County in New Jersey prevented the local authority from accessing records created after 1977.

In total, 48 government organisations from 21 countries have been targeted by ransomware groups this year, according to new research from security provider Cyble.

These attacks reflect a failure by law enforcement agencies to protect government bodies – as well as businesses and private individuals – against criminal gangs, McGuiness told Tech Monitor. “We’re not being looked after properly at the moment.”

Conti shut down
Ransomware group Conti’s attack on government agencies has used methods usually associated with state-backed attacks. (Photo: Arnoldo Robert/Getty Images)

Ransomware attacks on governments are intensifying

Ransomware gangs appear to be stepping up their onslaught against governments, according to Cyble’s research. They are targeting “smaller nations to subvert government apparatus” and “nations with a relatively large cybersecurity exposure due to inadequate resources and spending”.

Content from our partners
Rethinking cloud: challenging assumptions, learning lessons
DTX Manchester welcomes leading tech talent from across the region and beyond
The hidden complexities of deploying AI in your business

Until recently, attacks on critical national infrastructure have been the preserve of state-backed cyberattack groups, or APTs. But CNI is increasingly in the crosshairs from criminal groups too, Cyble noted.

Conti’s attack on Costa Rica bears a particular resemblance to APT attacks on nation states, the report observed. “Conti deployed various methods and tactics to target multiple government entities to force the nation into a state of national emergency,” it said.

Other countries whose governments have been hit by ransomware this year include Peru, where public sector bodies were targeted by multiple groups, and Malaysia, where four government entities have been attacked in five months.

This barrage of attacks has continued since last year. Four out of ten central government organisations globally, and a third of local government organisations, were hit by ransomware in 2021, according to research by security company Sophos. The average bill for rectifying a ransomware attack was $1.6m, it found.

Why are ransomware groups targeting governments?

This hit rate can be attributed in part to low security budgets and ageing IT systems at government organisations, says Alexi Drew, senior cyber analyst at think tank RAND Europe.

"The unfortunate truth is government organisations tend to find criminal access to their systems due to legacy equipment and the effect of poor investment over an extended period of time," Drew says. "We massively underestimate the amount of money that should be spent in keeping critical systems up to date.”

But organisations that fall victim to ransomware are often blamed for what McGuiness argues is a failure of law enforcement. "The government management of cyber[attacks] is prone to blame-storming,” he says.

“Rather than focusing on the attacker, they focus upon the victim and they seek to hold the victim to account through regulation or through a public kind of ignominy. None of that is particularly useful.”

Meanwhile, cybersecurity authorities have failed to address the criminal source of many ransomware attacks. "Too much of the discourse from governments, and from national technical authorities like the National Cyber Security Centre and others, is about nation state actors and criminals acting for nation states,” McGuiness says. “The reality is businesses and indeed local governments are attacked by criminals, not by states.”

"The rest of us are suffering from criminality against which government doesn't have many answers,” he adds.

Policymakers must address the threat of ransomware now, McGuiness argues, before post-pandemic budget cuts kick in and economic conditions worsen. "Over the next 12 months of real financial squeeze, supply shock, [and] inflation, the headroom to resolve issues with IT systems [will be] significantly reduced," he explains.

If a ransomware attack disrupts the food or energy supply, “we're going to feel it that much more because there is not going to be the same resilience”.

Drew argues that the ransomware crisis may need to get worse before policymakers can get a handle on it, however. "We don't have enough data to really work out what it is,” she says. “If we see more activities like this, targeted at a different level, with different thresholds of response, we can start seeing what the fallout is, what happens next."

Read more: Meet the ransomware gangs fuelling a global cybercrime spree

Topics in this article : ,
Websites in our network
Select and enter your corporate email address Tech Monitor's research, insight and analysis examines the frontiers of digital transformation to help tech leaders navigate the future. Our Changelog newsletter delivers our best work to your inbox every week.
  • CIO
  • CTO
  • CISO
  • CSO
  • CFO
  • CDO
  • CEO
  • Architect Founder
  • MD
  • Director
  • Manager
  • Other
Visit our privacy policy for more information about our services, how Progressive Media Investments may use, process and share your personal data, including information on your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.