US to give ransomware hacks priority akin to ‘terrorism’: Report

The move by the US Department of Justice, which was reported on Thursday by Reuters news agency, would come on the heels of the Colonial Pipeline hack, which disrupted gas deliveries along the East Coast of the United States.

The United States Department of Justice (DOJ) is elevating investigations of ransomware attacks to a similar priority as “terrorism” in the wake of the Colonial Pipeline hack and mounting damage caused by cybercriminals, a senior department official told the Reuters news agency.

Internal guidance sent on Thursday to US Attorney’s offices across the country said information about ransomware investigations in the field should be centrally coordinated with a recently created task force in Washington.

“It’s a specialised process to ensure we track all ransomware cases regardless of where it may be referred in this country, so you can make the connections between actors and work your way up to disrupt the whole chain,” said John Carlin, principal associate deputy attorney general at the DOJ.

Last month, a cybercriminal group that the US authorities said operates from Russia penetrated the pipeline operator on the US East Coast, locking its systems and demanding a ransom. The hack caused a shutdown lasting several days, led to a spike in petrol prices, panic buying and localised fuel shortages in the southeast.

Colonial Pipeline decided to pay the hackers who invaded their systems nearly $5m to regain access, the company said.

The DOJ guidance specifically refers to Colonial as an example of the “growing threat that ransomware and digital extortion pose to the nation”.

“To ensure we can make necessary connections across national and global cases and investigations, and to allow us to develop a comprehensive picture of the national and economic security threats we face, we must enhance and centralize our internal tracking,” said the guidance seen by Reuters and previously unreported.

The DOJ’s decision to push ransomware into this special process illustrates how the issue is being prioritised, US officials said.

“We’ve used this model around terrorism before but never with ransomware,” said Carlin. The process has typically been reserved for a short list of topics, including national security cases, legal experts said.

In practice, it means that investigators in US Attorney’s offices handling ransomware attacks will be expected to share both updated case details and active technical information with leaders in Washington.

The guidance also asks the offices to look at and include other investigations focused on the larger cybercrime ecosystem.

According to the guidance, the list of investigations that now require central notification include cases involving counter anti-virus services, illicit online forums or marketplaces, cryptocurrency exchanges, bulletproof hosting services, botnets and online money-laundering services.

Bulletproof hosting services refer to opaque internet infrastructure registration services that help cybercriminals anonymously conduct intrusions.

A botnet is a group of compromised internet-connected devices that can be manipulated to cause digital havoc. Hackers build, buy and rent out botnets in order to conduct cybercrimes ranging from advertising fraud to large cyberattacks.

“We really want to make sure prosecutors and criminal investigators report and are tracking … cryptocurrency exchanges, illicit online forums or marketplaces where people are selling hacking tools, network access credentials – going after the botnets that serve multiple purposes,” said Carlin.

Mark Califano, a former US attorney and cybercrime expert, said the “heightened reporting could allow DOJ to more effectively deploy resources” and to “identify common exploits” used by cybercriminals.