Published on: January 16, 2025
The UK government is considering a total ban on ransomware payments across the public sector as part of a new consultation to tackle the growing trend of hackers motivated by financial gain.
The consultation will explore expanding the current ransom payment ban from central government departments to include all public services, such as hospitals, schools, local authorities, and state-run transport networks.
The main goal is to discourage financially motivated criminals from targeting these sectors. The plan also includes mandatory incident reporting to assist law enforcement and intelligence agencies.
“Driving down cybercrime is central to this government’s missions to reduce crime, deliver growth, and keep the British people safe,” said security minister Dan Jarvis in a statement. “With an estimated $1 billion flowing to ransomware criminals globally in 2023, it is vital we act to protect national security as a key foundation upon which this Government’s Plan for Change is built.
“These proposals help us meet the scale of the ransomware threat, hitting these criminal networks in their wallets and cutting off the key financial pipeline they rely upon to operate. Today marks the beginning of a vital step forward to protect the UK economy and keep businesses and jobs safe.”
The 12-week consultation will run from Jan. 14 to April 8 and examine 3 proposals. The first is a complete ban on ransom payments by public sector organizations and critical national infrastructure (CNI) entities.
The second proposal builds on the first by extending requirements to organizations not covered by the ban. Private entities legally allowed to pay ransoms would be required to report their intention to do so before proceeding. This measure aims to improve ransomware intelligence gathering while also applying subtle pressure on these organizations to reconsider making payments.
The third, less aggressive proposal suggests introducing a mandatory reporting law for ransomware incidents without imposing a payment ban. This would provide UK cybercrime teams with valuable data to enhance investigations and disrupt operations.