UK Proposes Ransomware Payment Ban for Public Sector

A Step in the Right Direction

The UK government has proposed banning public sector entities — including national healthcare, education institutions, libraries, and other government bodies — from making ransomware payments. This move addresses a core motivator for cybercriminals: financial profit.

This restriction will choke the very motivation of cybercriminals, to deter them from spending the effort in targeting these institutions. If criminals know they will not be paid by certain entities, they will move on to other victims who will.

This is a start, but does not go far enough.

Back in 2021, I proposed a comprehensive strategy to end ransomware, grounded in the key insight that this threat would continue to escalate as long as attackers continue getting paid. (Watch the 2021 proposal here.)

The solution is simple, outlaw digital extortion payments — period. This undermines the incentives of conducting these attacks.

When I first proposed this approach, there was considerable backlash. Many feared the loss of the option to pay a ransom in the worst-case scenario. I took those concerns seriously and addressed them one by one across a series of videos and open discussions.