Taxpayers’ patience running thin over ransomware

They say it takes a village (or town, city or state) to educate a child, fix the potholes, maintain parks, protect fair elections and ensure public safety.  And I’m gladly paying my taxes for that. But is it too much to ask that governments not waste my tax dollars to buy some cybercriminal halfway around the world the latest Lamborghini?

Let me explain what I mean.

Ransomware is malicious software that enters the local computer or network from the internet, mostly through infected websites or phishing emails. Because regular browsers arbitrarily execute such code, ransomware then encrypts valuable data and demands a ransom to unlock it.

Ransomware has emerged over the past few years as the shakedown scheme of choice for cybercriminals, and cybersecurity leaders agree this scourge will keep plaguing us in 2020. While attacks on hospitals initially dominated the headlines, more recently, the focus and scope of ransomware campaigns has notably shifted. In 2018 and 2019, attackers have increasingly been taking aim at county and city government agencies and municipal organizations in the U.S. What is driving this trend?

It's simple. State and local public-sector facilities are soft targets. They aren’t on the bleeding edge of cybersecurity practices.  They are budget-constrained, dealing with legacy equipment and are often understaffed.    

According to Emsisoft’s The State of Ransomware in the US: Report and Statistics 2019 report, at least 948 public sector agencies (including universities, colleges and school districts, as well as health care providers) were affected by ransomware last year, at a potential cost in excess of $7.5 billion. 

Ransomware attacks have plagued city and county agencies in Colorado, Georgia, Florida, Louisiana,  Maine, Ohio, Maryland and Texas. And those in charge have a powerful incentive to pay up --  the public pressure that ensues when critical services (example: 911, as in Baltimore) suddenly go down.

Quite a few victims bite the bullet and send Bitcoin to Russia, where most ransomware schemes originate. If they are “lucky,” the ransom -- and the consulting fees to fix the system -- will be picked up by their cyber insurance. And guess who’s paying for all of this?

That’s right – we are. The ransom, the cyber insurance premiums, hefty mitigation costs and the post-data breach crisis PR retainer are all subsidized by taxpayers.

Take, for example, Riviera Beach, Fla., which decided to pay a $600,000 ransom. Most of the amount was covered by insurance, outside of a $25,000 deductible. Not mentioned in the news: the increased insurance premiums, investment required to re-certify, dollars spent restoring trust of the constituency and other knock-on effects that paying the claim will have going forward.

Victims that refuse to pay, like Baltimore, didn’t get off the ransomware hook cheap either. Escalating costs to clean up the impact of the attack have amounted to more than $18 million so far.

Taxpayers are left holding the bag 

If the ransom is paid, costs are covered by an insurance policy, and if the agency chooses to restore from backups or go through a more arduous process of rebuilding systems, taxpayers are footing the bill. 

This point is not lost on taxpayer advocacy groups, such as the Taxpayers Protection Alliance. A ransomware attack on a government entity, warned TPA President David Williams, typically results in a “triple whammy for taxpayers.” 

Reached by email, Williams explained: “First, you have the potential ransom to be paid. Secondly, there’s the cost of insurance to pay out future attacks. And finally, taxpayers are on the hook to upgrade IT systems, with costs that could be substantial in an emergency situation.”

Don’t throw good money after bad

Once a government or municipal agency is compromised by ransomware, much of the damage is already done. No matter how the situation is resolved in the end, it will be costly.

Here’s how National Taxpayers Union President Pete Sepp put it. In an email, he wrote: “Regardless of how cities and counties respond to these attacks, however, taxpayers will be on the hook -- for insurance, for paying the ransom, or for cleaning up the aftermath.” 

And he added: “Governments that have already charged taxpayers a lot for high-end IT systems with good security protocols need to think carefully about additional costs of preventative measures, while governments with older, more vulnerable systems need to think about the additional costs of recovering from an attack.”

I agree. Debating whether to pay the ransom or not doesn’t solve the underlying problem. We must  focus on the root cause of ransomware and on preventing the attack.  Period.

Remarkably, federal agencies were among the first to figure out how easy it would be to drain that ransomware swamp. All it takes for IT, they discovered, is to make a small -- and for most users unnoticeable -- change to the way employees access the web.

They use “web isolation.” The underlying premise is straightforward:  If we keep untrusted content and code from the web off our IT endpoints and infrastructure when we access websites or apps, and instead isolate and process it remotely in the cloud, ransomware (or any other malware, for that matter) is neutered.  Exploits can’t touch IT systems. 

That’s because web isolation works like a physical barrier and prevents untrusted code from reaching the user’s computer and contaminating the system.

Leading financial institutions, global law firms and tech giants already leverage web isolation to keep their businesses safe from ransomware and other malware when employees access websites, online services and apps. And so do 150 security-sensitive federal agencies and departments, including the Department of Defense and all branches of the U.S. military.

With a prevention mechanism readily available, it it’s no surprise that taxpayers start questioning the rationale behind the continued funneling of public funds into the ransomware racket. 

It’s time that local governments and public servants take notice and stop throwing good money after bad.