Home secretary tells conference that complying with demands will only encourage criminals

Credit: Keith Hall/CC BY 2.0     Image has been edited

Home secretary Priti Patel has outlined the government’s steadfast opposition to paying ransom to cybercriminals.

In a speech given to last week’s CyberUK conference, hosted by the National Cyber Security Centre, Patel told attendees that the intelligence agency’s recent annual report “sets out that ransomware incidents handled by the centre have been increasing”.

“Cybercriminals have increasingly focused on companies and organisations, taking the time to research their target so they can maximise their chances of releasing higher sums of money through extortion,” she said. “In the face of such complex and often inter-linked threats, it is crucial that we join ourselves up, and have a clear and effective response so that our citizens and businesses are safe and can operate safely and securely online.”

Such a response should begin from the position of not ceding to criminals’ demands, according to the home secretary, who said that doing so is only likely to amplify the problem of ransomware in the long run.

Related content

• Government calls out Russian intelligence for ‘reckless and indiscriminate’ cyberattacks
• DHSC signs £2m six-month deal to improve ability to ‘respond to recover from a cyberattack’
• Inoculating the NHS against cyberattacks

“Government has a strong position against paying ransoms to criminals, including when targeted by ransomware,” she said. “Paying a ransom in response to ransomware does not guarantee a successful outcome. It will not protect networks from future attacks, nor will it prevent the possibility of future data leaks. In fact, paying a ransom is likely to encourage criminals to continue to use this approach.”

Patel’s comments came just a couple of days before the Irish Health Service Executive was hit with a major ransomware attack that necessitated the shutdown of all its IT systems – including the platform used to book coronavirus tests. 

Many non-urgent appointments were delayed or cancelled and, five days on from the initial incursion, the HSE’s website still advises patients that “many x-ray appointments” are still unable to take place.

The incident is redolent of the 2017 WannaCry attack, which – although not directly targeted at the NHS – wrought a huge impact on health services across the UK.

Despite its seeming severity, WannaCry was only classed as a category-two cyberattack, denoting a “highly significant incident”.  The UK has yet to suffer a category-one attack, which the NCSC characterises as a “national cyber emergency”. 

Its classification system defines it as: “A cyberattack which causes sustained disruption of UK essential services or affects UK national security, leading to severe economic or social consequences or to loss of life.”

The cyber agency has repeatedly warned in the past that the UK suffering such an attack is an inevitability.

In her speech, Patel said that the growing cyberthreat “impacts how we guard our own national security and brings new challenges while highlighting new threats, often exposing many new gaps that we have to close”.

She indicated that, in addition to bolstering its defences, the UK may also seek to actively interfere with the cyber activities of its foes.

“Cyber is now a core component of our homeland security mission, with effective cyber defences critical to making the UK a responsible cyber power, as set out in our recently published Integrated Review,” she said. “We are taking a new, comprehensive approach to strengthen our position as a democratic cyber power – protecting and promoting our interests in cyberspace, while also detecting, disrupting and deterring our adversaries.”