iscover
ReporterShare this article on:
Powered by
MOMENTUM
MEDIA
The Law Society in the UK has volleyed a staunch response to the National Cyber Security Centre’s warning about “the role of solicitors paying off cyber black mailers”.
In a joint letter addressed to The Law Society and The Bar Council in the UK, the government's Information Commissioner's (ICO) and National Cyber Security Centre (NCSC) has warned against legal firms to steer clear of "paying off cyber blackmailers".
"We do not advise members to pay ransoms, nor suggest that is what they should advise their clients," a UK Law Society spokesperson said.
The NCSC and the ICO's concerted warning to "UK legal professional bodies about so-called ransomware" attacks is unprecedented correspondence, which asks The Law Society and The Bar Council to remind members that "payouts" are far from best practice.
Lindy Cameron, the NCSC's chief executive, has described ransomware attacks as "the biggest online threat to the UK" and has made it clear that the NCSC does "not encourage or condone paying ransom demands to criminal organisations".
The NCSC and the ICO's letter was prompted by data on the rise in ransomware payments, "suggesting that solicitors may have advised clients to pay", based on "belief it will keep data safe or lead to a lower penalty from the ICO".
Engaging with cyber criminals and paying ransoms only incentivise other criminals, according to John Edwards, UK Information Commissioner, who told the Law Society Gazette that there is no guarantee compromised files would be released.
"I want to work with the legal profession and NCSC to ensure that companies understand how we will consider cases and how they can take practical steps to safeguard themselves in a way that we will recognise in our response should the worst happen.
"It certainly does not reduce the scale or type of enforcement action from the ICO or the risk to individuals affected by an attack," Edwards said.
Ransomware attacks usually occur via hacking and encryption of an organisation's IT systems or data. Cyber actors will likely demand payment, typically in cryptocurrency. Increasingly, this type of cyber attack has been associated with foreign government agencies.
The Law Society has agreed to comply with the NCSC and ICO's advice and has confirmed to accommodate.
"We welcome the offer to meet to discuss future collaboration with both the ICO and NCSC and are keen to play our part in helping combat ransomware criminals," The Law Society stated.
The NCSC and ICO have advised organisations to report ransomware attacks to the Information Commissioner’s Office (for data breaches), or to the NCSC for major cyber incidents
[Related: Cyber security companies impersonated in call-back malware campaign]
Be the first to hear the latest developments in the cyber industry.
