www.rsis.edu.sg
Open in
urlscan Pro
2606:4700:10::ac43:2a33
Public Scan
URL:
https://www.rsis.edu.sg/rsis-publication/cens/us-global-ransomware-summit-more-needs-to-be-done/?doing_wp_cron=163702861...
Submission: On November 22 via api from US — Scanned from DE
Submission: On November 22 via api from US — Scanned from DE
Form analysis
3 forms found in the DOMGET /search/
<form action="/search/" class="site-search-form" method="get">
<input type="text" placeholder="Search this site" class="input-txt input-search" name="q">
</form>
POST /rsis-publication/cens/us-global-ransomware-summit-more-needs-to-be-done/?doing_wp_cron=1637028614.0545699596405029296875
<form action="/rsis-publication/cens/us-global-ransomware-summit-more-needs-to-be-done/?doing_wp_cron=1637028614.0545699596405029296875" method="post" class="wpcf7-form form" novalidate="novalidate">
<div style="display: none;">
<input type="hidden" name="_wpcf7" value="106109">
<input type="hidden" name="_wpcf7_version" value="5.0.1">
<input type="hidden" name="_wpcf7_locale" value="en_US">
<input type="hidden" name="_wpcf7_unit_tag" value="wpcf7-f106109-o1">
<input type="hidden" name="_wpcf7_container_post" value="0">
</div>
<div class="ctrl">
<span class="wpcf7-form-control-wrap your-name"><input type="text" name="your-name" value="" size="40" class="wpcf7-form-control wpcf7-text wpcf7-validates-as-required contact-txt" aria-required="true" aria-invalid="false"
placeholder="Your Name"></span>
</div>
<div class="ctrl">
<span class="wpcf7-form-control-wrap your-email"><input type="email" name="your-email" value="" size="40" class="wpcf7-form-control wpcf7-text wpcf7-email wpcf7-validates-as-required wpcf7-validates-as-email contact-txt" aria-required="true"
aria-invalid="false" placeholder="Your Email Address"></span>
</div>
<div class="ctrl">
<span class="wpcf7-form-control-wrap your-subject"><select name="your-subject" class="wpcf7-form-control wpcf7-select wpcf7-validates-as-required your-subject" id="your-subject" aria-required="true" aria-invalid="false">
<option value="">Subject</option>
<option value="Career Opportunities">Career Opportunities</option>
<option value="Master's / PhD Programmes">Master's / PhD Programmes</option>
<option value="Events">Events</option>
<option value="Publications">Publications</option>
<option value="Media Matters">Media Matters</option>
<option value="Others">Others</option>
</select></span>
</div>
<div class="ctrl">
<span class="wpcf7-form-control-wrap your-message"><textarea name="your-message" cols="40" rows="3" class="wpcf7-form-control wpcf7-textarea contact-txt" aria-invalid="false" placeholder="Type your message here"></textarea></span>
</div>
<div class="wpcf7-form-control-wrap">
<div data-sitekey="6Lf12EEUAAAAAMYcSI7c_x6L1V4kBUcP5pd9PIWH" data-size="compact" class="wpcf7-form-control g-recaptcha wpcf7-recaptcha">
<div style="width: 164px; height: 144px;">
<div><iframe title="reCAPTCHA"
src="https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lf12EEUAAAAAMYcSI7c_x6L1V4kBUcP5pd9PIWH&co=aHR0cHM6Ly93d3cucnNpcy5lZHUuc2c6NDQz&hl=de&v=_7Co1fh8iT2hcjvquYJ_3zSP&size=compact&cb=1otj5euhy5ap" width="164"
height="144" role="presentation" name="a-5bn501kzeqr8" frameborder="0" scrolling="no" sandbox="allow-forms allow-popups allow-same-origin allow-scripts allow-top-navigation allow-modals allow-popups-to-escape-sandbox"></iframe></div>
<textarea id="g-recaptcha-response" name="g-recaptcha-response" class="g-recaptcha-response" style="width: 250px; height: 40px; border: 1px solid rgb(193, 193, 193); margin: 10px 25px; padding: 0px; resize: none; display: none;"></textarea>
</div><iframe style="display: none;"></iframe>
</div>
<noscript>
<div style="width: 302px; height: 422px;">
<div style="width: 302px; height: 422px; position: relative;">
<div style="width: 302px; height: 422px; position: absolute;">
<iframe src="https://www.google.com/recaptcha/api/fallback?k=6Lf12EEUAAAAAMYcSI7c_x6L1V4kBUcP5pd9PIWH" frameborder="0" scrolling="no" style="width: 302px; height:422px; border-style: none;">
</iframe>
</div>
<div style="width: 300px; height: 60px; border-style: none; bottom: 12px; left: 25px; margin: 0px; padding: 0px; right: 25px; background: #f9f9f9; border: 1px solid #c1c1c1; border-radius: 3px;">
<textarea id="g-recaptcha-response" name="g-recaptcha-response" class="g-recaptcha-response" style="width: 250px; height: 40px; border: 1px solid #c1c1c1; margin: 10px 25px; padding: 0px; resize: none;"> </textarea>
</div>
</div>
</div>
</noscript>
</div>
<span id="hp619b8dddb9b46" class="wpcf7-form-control-wrap url-wrap" style="display:none !important; visibility:hidden !important;"><label class="hp-message">Please leave this field empty.</label><input class="wpcf7-form-control wpcf7-text"
type="text" name="url" value="" size="40" tabindex="-1" autocomplete="nope"></span>
<input type="submit" value="SUBMIT" class="wpcf7-form-control wpcf7-submit btn contact-submit">
<div class="wpcf7-response-output wpcf7-display-none"></div>
</form>
GET /search/
<form action="/search/" class="mobile-site-search-form" method="get">
<input type="text" placeholder="Search" class="input-txt" name="q">
<button class="btn">
<span class="icon icon-search"></span>
<span class="visuallyhidden">Submit</span>
</button>
</form>
Text Content
* Home * About RSIS * Introduction * Building the Foundations * Welcome Message * Board of Governors * Staff Profiles * Executive Deputy Chairman's Office * Dean's Office * Management * Distinguished Fellows * Faculty and Research * Associate Research Fellows, Senior Analysts and Research Analysts * Visiting Fellows * Adjunct Fellows * Administrative Staff * Honours and Awards for RSIS Staff and Students * RSIS Endowment Fund * Endowed Professorships * Career Opportunities * Getting to RSIS * Research * Research Centres * Centre for Multilateralism Studies (CMS) * Centre for Non-Traditional Security Studies (NTS Centre) * Centre of Excellence for National Security (CENS) * Institute of Defence and Strategic Studies (IDSS) * International Centre for Political Violence and Terrorism Research (ICPVTR) * Research Programmes * National Security Studies Programme (NSSP) * Studies in Inter-Religious Relations in Plural Societies (SRP) Programme * Research @ RSIS * Other Programmes * Science and Technology Studies Programme (STSP) * Graduate Education * Graduate Programmes Office * Overview * MSc (Asian Studies) * MSc (International Political Economy) * MSc (International Relations) * MSc (Strategic Studies) * NTU-Warwick Double Masters Programme * PhD Programme * Exchange Partners and Programmes * How to Apply * Financial Assistance * Information Sessions * RSIS Alumni * Alumni & Networks * Alumni * Asia-Pacific Programme for Senior Military Officers (APPSMO) * Asia-Pacific Programme for Senior National Security Officers (APPSNO) * SRP Executive Programme * Terrorism Analyst Training Course (TATC) * Publications * RSIS Publications * Annual Reviews * Books * Bulletins and Newsletters * Commentaries * Counter Terrorist Trends and Analyses * Commemorative / Event Reports * IDSS Paper * Interreligious Relations * Monographs * NTS Insight * Policy Reports * Working Papers * RSIS Publications for the Year * Glossary of Abbreviations * External Publications * Authored Books * Journal Articles * Edited Books / Special Issues * Chapters in Edited Books * Working Papers * Op-Eds * External Publications for the Year * Policy-relevant Articles Given RSIS Award * Media * COVID-19 Resources * Cohesive Societies * Great Powers * Sustainable Security * Other Resource Pages * Media Highlights * News Releases * Speeches * Vidcast Channel * Audio/Video Forums * Events * Giving * Contact Us Facebook Twitter YouTube rsis.sg Linkedin rsis.sg RSS * Home * About RSIS * Introduction * Building the Foundations * Welcome Message * Board of Governors * Staff Profiles * Executive Deputy Chairman's Office * Dean's Office * Management * Distinguished Fellows * Faculty and Research * Associate Research Fellows, Senior Analysts and Research Analysts * Visiting Fellows * Adjunct Fellows * Administrative Staff * Honours and Awards for RSIS Staff and Students * RSIS Endowment Fund * Endowed Professorships * Career Opportunities * Getting to RSIS * Research * Research Centres * Centre for Multilateralism Studies (CMS) * Centre for Non-Traditional Security Studies (NTS Centre) * Centre of Excellence for National Security (CENS) * Institute of Defence and Strategic Studies (IDSS) * International Centre for Political Violence and Terrorism Research (ICPVTR) * Research Programmes * National Security Studies Programme (NSSP) * Studies in Inter-Religious Relations in Plural Societies (SRP) Programme * Research @ RSIS * Other Programmes * Science and Technology Studies Programme (STSP) * Graduate Education * Graduate Programmes Office * Overview * MSc (Asian Studies) * MSc (International Political Economy) * MSc (International Relations) * MSc (Strategic Studies) * NTU-Warwick Double Masters Programme * PhD Programme * Exchange Partners and Programmes * How to Apply * Financial Assistance * Information Sessions * RSIS Alumni * Alumni & Networks * Alumni * Asia-Pacific Programme for Senior Military Officers (APPSMO) * Asia-Pacific Programme for Senior National Security Officers (APPSNO) * SRP Executive Programme * Terrorism Analyst Training Course (TATC) * Publications * RSIS Publications * Annual Reviews * Books * Bulletins and Newsletters * Commentaries * Counter Terrorist Trends and Analyses * Commemorative / Event Reports * IDSS Paper * Interreligious Relations * Monographs * NTS Insight * Policy Reports * Working Papers * RSIS Publications for the Year * Glossary of Abbreviations * External Publications * Authored Books * Journal Articles * Edited Books / Special Issues * Chapters in Edited Books * Working Papers * Op-Eds * External Publications for the Year * Policy-relevant Articles Given RSIS Award * Media * COVID-19 Resources * Cohesive Societies * Great Powers * Sustainable Security * Other Resource Pages * Media Highlights * News Releases * Speeches * Vidcast Channel * Audio/Video Forums * Events * Giving * Contact Us * rsis.sg Connect Getting to RSIS Map ADDRESS Nanyang Technological University Block S4, Level B3, 50 Nanyang Avenue, Singapore 639798 View location on Google maps Click here for directions to RSIS Get in Touch SubjectCareer OpportunitiesMaster's / PhD ProgrammesEventsPublicationsMedia MattersOthers Please leave this field empty. Connect with Us rsis.ntu rsis_ntu rsisntu rsisvideocast school/rsis-ntu rsis.sg RSS Subscribe to RSIS Publications Subscribe to RSIS Events RSIS Intranet S. Rajaratnam School of International Studies Nanyang Technological University Skip to content Toggle mobile navigation Submit * RSIS * Publication * RSIS Publications * US Global Ransomware Summit: More Needs to be Done * Annual Reviews * Books * Bulletins and Newsletters * Commentaries * Counter Terrorist Trends and Analyses * Commemorative / Event Reports * IDSS Paper * Interreligious Relations * Monographs * NTS Insight * Policy Reports * Working Papers * RSIS Publications for the Year CO21166 | US Global Ransomware Summit: More Needs to be Done Gil Baram 15 November 2021 AddThis Sharing Buttons Share to FacebookFacebookShare to TwitterTwitterShare to LinkedInLinkedInShare to TelegramTelegramShare to WhatsAppWhatsAppShare to EmailEmail RSIS Commentary is a platform to provide timely and, where appropriate, policy-relevant commentary and analysis of topical and contemporary issues. The authors’ views are their own and do not represent the official position of the S. Rajaratnam School of International Studies, NTU. These commentaries may be reproduced with prior permission from RSIS and due recognition to the author(s) and RSIS. Please email to Mr Yang Razali Kassim, Editor RSIS Commentary at RSISPublications@ntu.edu.sg. SYNOPSIS The US Justice Department’s arrest of several affiliates of the Russian-speaking REvil ransomware group comes a month after Washington hosted a virtual international summit on ransomware attacks. The decision to leave Russia out of the summit will inevitably limit the effectiveness of the operation. Source: Pixabay COMMENTARY ON 8 NOVEMBER 2021, the US Justice Department announced the arrest of several members of the Russian-speaking REvil ransomware group, in a large-scale operation involving US allies in Europe and around the globe. The REvil group, who have since been charged, have been deploying ransomware attacks against American targets including the software provider Kaseya in July 2021. Furthermore, the State Department added REvil to a bounty programme that offers up to US$10 million for information on the REvil leaders. These efforts followed the two-day virtual international summit on ransomware hosted by the Biden administration on 13-14 October. This summit included 30 countries and was a decisive step towards building a coalition against ransomware attacks. It was acknowledged by all countries that ransomware posed a global and national security threat. Russia ─ as well as China, Iran, and North Korea ─ was not invited. FROM PETTY CRIME TO GLOBAL CRIMINAL ENTERPRISES The summit prompted some governments to state their positions on state-sponsored ransomware. Australia, the Netherlands and United Kingdom began signalling a more aggressive, military, and intelligence agency-backed response to the ransomware threat. Lindy Cameron, head of the British National Cyber Security Centre (NCSC) said: “In addition to the direct cyber security threats that the Russian state poses, we […] assess that cyber criminals based in Russia and neighbouring countries are responsible for most of the devastating ransomware attacks against UK targets.” On average there is a new ransomware attack every 11 seconds, and the losses to organisations from ransomware attacks are projected to reach $20 billion over the course of 2021. According to the White House, ransomware payments rose to more than $400 million globally last year. COVID-19 increased these numbers, as many organisations started operating remotely, making themselves even more vulnerable. In fact, ransomware has existed for several decades and is therefore not new. The problem has been regarded for a long time as “e-crime”, which primarily affects the private sector, and was not viewed as a security issue. The ransomware threat has, however, evolved from a “petty crime to a major economic windfall for global criminal enterprises”. The rise of cryptocurrencies makes it difficult for funds to be traced as these can be transferred electronically without the assistance of other institutions regulated by governments. This has contributed to the rise of ransomware attacks. GLOBAL COOPERATION ON CYBER ISSUES: LIMITED SUCCESS The growing international attention on ransomware and its treatment as a national security threat have changed how countries respond to this new challenge. However, global cooperation on cyber issues has so far achieved limited success because of two reasons: Firstly, it has been done without the cooperation of Russia and China. Secondly, deterrence in cyberspace generally does not achieve its goal in the face of actors with different values and operating methods. Past international efforts to promote global initiatives on agreed behaviour in cyberspace ─ like the UN GGE (Group of Governmental Experts) ─ suffered from disagreements among the nation-states. The main ones are largely between the US and Russia as well as China regarding the meaning of sovereignty in cyberspace and its implications for improving global cyber stability. This year, the UN GGE had reached agreements while the UN Open-Ended Working Group (OEWG) achieved some non-binding understandings on ways to advance peace and security in cyberspace. The OEWG includes representatives from multiple countries and stakeholders. An international summit that did not include Russia and China (among others) is unlikely to lead to actionable results that reduce the severity and intensity of global ransomware attacks. In May 2021 President Biden warned Moscow about the need to “take decisive action” against them. The Justice Department, he said, would step up prosecutions of ransomware hackers and the government will “pursue a measure to disrupt their ability to operate”. RUSSIA’S LACK OF ACTION Despite this warning, there has been little or no change in the Russian stance that would indicate Moscow’s acceptance of the presence of ransomware attacks by Russia-affiliated criminal groups. And despite repeated requests from the Biden administration, there is no evidence that Russia has taken action to deal with ransomware criminals operating within its borders and it is practically serving as a safe haven for cyber criminals. The US has already sanctioned Russian individuals for committing cyberattacks but that did not seem to affect Russia’s support for them. Experts suggest that the US should act against cyber criminals the same way it acted against ISIS. Here the situation might pose some complications as these cyber criminals are operating within the borders of sovereign states. But there might be some room for optimism from the latest round of strategic dialogue between the US and Russia that took place at the end of September. According to Russian news reports, Moscow and Washington have resumed some cooperation in cyber areas that have been frozen for many years. PROGRESS AND WAY FORWARD There has been substantial progress reached in three key areas: • At the end of September, The Kremlin and the White House resumed regular cybersecurity expert meetings. • Both countries restored cooperation within the framework of the 1999 Mutual Legal Assistance in Criminal Cases Treaty. As a result, the US provided key information to enable the prosecution of several international cybercrime groups such as Evil Corp, REvil, and TrickBot. Specifically, Russia informed the US that it already started prosecuting hackers using malware from one of those three groups, and Moscow expressed willingness to continue collaborating on this track. • The US and Russian cyber incident response centres also reestablished regular contacts and resumed information exchange on cyberattacks. Going forward, the US ransomware summit was an important first step; it seems that many countries today perceive ransomware as a security threat and one that calls for a joint global action ─ as the recent operation and arrests show. However, as long as Russia keeps providing safe haven for cyber criminals this activity will not be resolved. The US should reach out to Russia as well as other nations and lead international effort in a more inclusive way if it wants to reach a global and long-lasting solution. ABOUT THE AUTHOR Gil Baram is a Fulbright Cybersecurity post-doctoral fellow, Center for International Security and Cooperation (CISAC) Stanford University, and an Adjunct Research Fellow at the Centre of Excellence for National Security, (CENS), S. Rajaratnam School of International Studies (RSIS), Nanyang Technological University (NTU), Singapore. Categories: Commentaries / Country and Region Studies / Cybersecurity, Biosecurity and Nuclear Safety / International Political Economy / International Politics and Security / Non-Traditional Security / Technology and Future Issues Last updated on 15/11/2021 RSIS Commentary is a platform to provide timely and, where appropriate, policy-relevant commentary and analysis of topical and contemporary issues. The authors’ views are their own and do not represent the official position of the S. Rajaratnam School of International Studies, NTU. These commentaries may be reproduced with prior permission from RSIS and due recognition to the author(s) and RSIS. Please email to Mr Yang Razali Kassim, Editor RSIS Commentary at RSISPublications@ntu.edu.sg. SYNOPSIS The US Justice Department’s arrest of several affiliates of the Russian-speaking REvil ransomware group comes a month after Washington hosted a virtual international summit on ransomware attacks. The decision to leave Russia out of the summit will inevitably limit the effectiveness of the operation. Source: Pixabay COMMENTARY ON 8 NOVEMBER 2021, the US Justice Department announced the arrest of several members of the Russian-speaking REvil ransomware group, in a large-scale operation involving US allies in Europe and around the globe. The REvil group, who have since been charged, have been deploying ransomware attacks against American targets including the software provider Kaseya in July 2021. Furthermore, the State Department added REvil to a bounty programme that offers up to US$10 million for information on the REvil leaders. These efforts followed the two-day virtual international summit on ransomware hosted by the Biden administration on 13-14 October. This summit included 30 countries and was a decisive step towards building a coalition against ransomware attacks. It was acknowledged by all countries that ransomware posed a global and national security threat. Russia ─ as well as China, Iran, and North Korea ─ was not invited. FROM PETTY CRIME TO GLOBAL CRIMINAL ENTERPRISES The summit prompted some governments to state their positions on state-sponsored ransomware. Australia, the Netherlands and United Kingdom began signalling a more aggressive, military, and intelligence agency-backed response to the ransomware threat. Lindy Cameron, head of the British National Cyber Security Centre (NCSC) said: “In addition to the direct cyber security threats that the Russian state poses, we […] assess that cyber criminals based in Russia and neighbouring countries are responsible for most of the devastating ransomware attacks against UK targets.” On average there is a new ransomware attack every 11 seconds, and the losses to organisations from ransomware attacks are projected to reach $20 billion over the course of 2021. According to the White House, ransomware payments rose to more than $400 million globally last year. COVID-19 increased these numbers, as many organisations started operating remotely, making themselves even more vulnerable. In fact, ransomware has existed for several decades and is therefore not new. The problem has been regarded for a long time as “e-crime”, which primarily affects the private sector, and was not viewed as a security issue. The ransomware threat has, however, evolved from a “petty crime to a major economic windfall for global criminal enterprises”. The rise of cryptocurrencies makes it difficult for funds to be traced as these can be transferred electronically without the assistance of other institutions regulated by governments. This has contributed to the rise of ransomware attacks. GLOBAL COOPERATION ON CYBER ISSUES: LIMITED SUCCESS The growing international attention on ransomware and its treatment as a national security threat have changed how countries respond to this new challenge. However, global cooperation on cyber issues has so far achieved limited success because of two reasons: Firstly, it has been done without the cooperation of Russia and China. Secondly, deterrence in cyberspace generally does not achieve its goal in the face of actors with different values and operating methods. Past international efforts to promote global initiatives on agreed behaviour in cyberspace ─ like the UN GGE (Group of Governmental Experts) ─ suffered from disagreements among the nation-states. The main ones are largely between the US and Russia as well as China regarding the meaning of sovereignty in cyberspace and its implications for improving global cyber stability. This year, the UN GGE had reached agreements while the UN Open-Ended Working Group (OEWG) achieved some non-binding understandings on ways to advance peace and security in cyberspace. The OEWG includes representatives from multiple countries and stakeholders. An international summit that did not include Russia and China (among others) is unlikely to lead to actionable results that reduce the severity and intensity of global ransomware attacks. In May 2021 President Biden warned Moscow about the need to “take decisive action” against them. The Justice Department, he said, would step up prosecutions of ransomware hackers and the government will “pursue a measure to disrupt their ability to operate”. RUSSIA’S LACK OF ACTION Despite this warning, there has been little or no change in the Russian stance that would indicate Moscow’s acceptance of the presence of ransomware attacks by Russia-affiliated criminal groups. And despite repeated requests from the Biden administration, there is no evidence that Russia has taken action to deal with ransomware criminals operating within its borders and it is practically serving as a safe haven for cyber criminals. The US has already sanctioned Russian individuals for committing cyberattacks but that did not seem to affect Russia’s support for them. Experts suggest that the US should act against cyber criminals the same way it acted against ISIS. Here the situation might pose some complications as these cyber criminals are operating within the borders of sovereign states. But there might be some room for optimism from the latest round of strategic dialogue between the US and Russia that took place at the end of September. According to Russian news reports, Moscow and Washington have resumed some cooperation in cyber areas that have been frozen for many years. PROGRESS AND WAY FORWARD There has been substantial progress reached in three key areas: • At the end of September, The Kremlin and the White House resumed regular cybersecurity expert meetings. • Both countries restored cooperation within the framework of the 1999 Mutual Legal Assistance in Criminal Cases Treaty. As a result, the US provided key information to enable the prosecution of several international cybercrime groups such as Evil Corp, REvil, and TrickBot. Specifically, Russia informed the US that it already started prosecuting hackers using malware from one of those three groups, and Moscow expressed willingness to continue collaborating on this track. • The US and Russian cyber incident response centres also reestablished regular contacts and resumed information exchange on cyberattacks. Going forward, the US ransomware summit was an important first step; it seems that many countries today perceive ransomware as a security threat and one that calls for a joint global action ─ as the recent operation and arrests show. However, as long as Russia keeps providing safe haven for cyber criminals this activity will not be resolved. The US should reach out to Russia as well as other nations and lead international effort in a more inclusive way if it wants to reach a global and long-lasting solution. ABOUT THE AUTHOR Gil Baram is a Fulbright Cybersecurity post-doctoral fellow, Center for International Security and Cooperation (CISAC) Stanford University, and an Adjunct Research Fellow at the Centre of Excellence for National Security, (CENS), S. Rajaratnam School of International Studies (RSIS), Nanyang Technological University (NTU), Singapore. Categories: Commentaries / Country and Region Studies / Cybersecurity, Biosecurity and Nuclear Safety / International Political Economy / International Politics and Security / Non-Traditional Security / Technology and Future Issues Last updated on 15/11/2021 Back to top Terms of Use | Privacy Statement Copyright © S. Rajaratnam School of International Studies. All rights reserved. This site uses cookies to offer you a better browsing experience. By continuing, you are agreeing to the use of cookies on your device as described in our privacy policy. Learn more OK Why is India a major HADR actor in South Asia? India is gradually signaling its intent to become a leading actor during emergency responses in the South Asian region. AddThis Sharing FacebookTwitterTelegramWhatsAppEmail