Key Takeaways from OFAC’s Updated Ransomware Advisory | Alston & Bird

On September 21, 2021, the U.S. Section of the Treasury’s Business of Overseas Assets Regulate (OFAC) issued an “Updated Advisory on Possible Sanctions Risks for Facilitating Ransomware Payments.” Even though this advisory explicitly supersedes OFAC’s preceding ransomware advisory from October 2020, it does not basically change OFAC’s method towards ransom payments.  Like the prior advice, OFAC’s new advisory reiterates the U.S. policy of “strongly discouraging” ransom payments, warns that such payments carry sanctions chance, and lists a variety of “significant mitigating factors” that OFAC will look at when deciding irrespective of whether to provide an enforcement reaction. Nonetheless, there are numerous substantial takeaways from the current guidance:

1. OFAC Is Targeting Cryptocurrency Exchanges, Not Ransomware Victims.  In conjunction with the revised OFAC advisory, OFAC announced sanctions from SUEX, a Moscow-based mostly cryptocurrency trade that OFAC suggests caters to criminals.  This is the 1st these kinds of sanction from a cryptocurrency trade.
2. CISA’s “Best Practices” Are Turning into Far more Than Mere Recommendations.  One new significant mitigating factor that appears in the updated advice is irrespective of whether the target organization had taken meaningful ways to reduce the risk of extortion and ransomware by implementing  “cybersecurity tactics, these as these highlighted in the Cybersecurity and Infrastructure Stability Agency’s (CISA) September 2020 Ransomware Manual.”  These practices “could contain sustaining offline backups of details, building incident reaction ideas, instituting cybersecurity education, regularly updating antivirus and anti-malware software program, and utilizing authentication protocols, between other individuals.”  Appropriately, lowering the risk of an OFAC enforcement reaction is but one more cause that firms must acquire steps to satisfy at minimum nominal cybersecurity requirements and manage “artifacts of compliance” to confirm it to regulators in the event of a breach.
3. Notification of Ransomware Attack to Supplemental Governing administration Agencies.  Centered on OFAC’s 2020 advisory, a company’s “self-initiated, well timed and full report of a ransomware attack to law enforcement” would be regarded a substantial mitigating variable. OFAC’s current direction expanded the listing of federal government organizations that businesses really should contemplate when voluntarily reporting ransomware assaults to regulation enforcement and/or CISA. OFAC prompt that reporting these incident to the suitable government organizations will be “[a]nother issue that OFAC will consider less than the Enforcement Guidelines” and reiterated the worth of finish and ongoing cooperation with law enforcement and other appropriate federal government companies throughout and following this sort of ransomware assault, which include “providing all suitable information and facts, this kind of as complex particulars, the ransom payment demand and ransom payment instructions.”
4. Notification of Ransomware Payments That May Have a Sanctions Nexus to Supplemental Govt Organizations. This week’s guidance not only expanded the scope of government businesses that corporations should or might notify in the situation of ransomware attacks, but also, in the situation of ransomware payments that might have a sanctions nexus, the steerage suggest that organizations really should report these types of potential ransomware attack and payment to OFAC and the U.S. Section of the Treasury’s Business office of Cybersecurity and Vital Infrastructure Protection (OCCIP) and, in carrying out so, the organization can acquire a major mitigation from OFAC. The revised advice indicates an enlarged role for OCCIP in thwarting ransomware assaults and payments to suspects with a likely sanctions nexus OFAC’s prior guidance advised notifying OCCIP only if an attack included a “U.S. money institutions or could induce sizeable disruption to a firm’s ability to carry out significant economic services,” whilst this week’s assistance suggests that all businesses need to report ransomware attacks and payments to OCCIP in which there is a sanctions nexus.

[View source.]