When a business faces a ransomware attack, decisions must be made quickly under immense pressure. Understanding the legal reporting obligations for ransomware payments particularly those made in virtual currency is crucial for maintaining compliance while navigating a crisis.

This guide explains the current reporting requirements for ransomware payments, focusing on virtual currency transactions.

Key Definitions in Ransomware Reporting Laws

To understand your reporting obligations, you must first understand how the law defines key terms related to ransomware incidents:

Ransom Payment

A ransom payment is defined as any transmission of money, property, or assets delivered as ransom in connection with a ransomware attack. This explicitly includes virtual currency payments, which have become the predominant method for ransomware transactions.

Virtual Currency

In the context of ransomware reporting, virtual currency refers to any digital representation of value that functions as a medium of exchange, unit of account, or store of value. This encompasses cryptocurrencies like Bitcoin, Ethereum, and Monero, which are commonly demanded in ransomware attacks.

Virtual Currency Address

A virtual currency address is a unique public cryptographic key identifying the location where ransom payments in virtual currency should be sent. These addresses are typically alphanumeric strings generated by the attackers specifically for receiving ransomware payments.

Ransomware Attack

The law defines a ransomware attack as an incident involving unauthorized or malicious code or other digital mechanisms that disrupt operations or compromise data integrity, confidentiality, or availability with the intent to extort a ransom payment. Importantly, this definition excludes situations where the payment demand is made in good faith at the request of the system owner or operator.

Timeline for Reporting Ransomware Payments

If your business makes a ransom payment following a ransomware attack, you face strict reporting deadlines:

24-Hour Reporting Window

Organizations must report ransom payments to the Cybersecurity and Infrastructure Security Agency (CISA) within 24 hours of making the payment. This tight timeline reflects the urgent nature of ransomware incidents and the government's interest in tracking and potentially recovering virtual currency payments.

Consolidated Reporting Option

In cases where the ransomware attack qualifies as a "covered cyber incident" under federal law, entities may submit a single report to satisfy both the 24-hour ransom payment reporting requirement and the 72-hour cyber incident reporting requirement. This consolidated approach streamlines the compliance process during a crisis.

Information Required in Ransomware Payment Reports

Reports submitted to CISA must include detailed information about both the attack and the payment:

Attack Details

Your report should include:

• A comprehensive description of the ransomware attack
• Vulnerabilities that were exploited
• Security defenses that were in place at the time
• Tactics, techniques, and procedures used by the attackers
• Any identifying or contact information of the responsible actors (if known)

Payment Specifics

For the ransom payment itself, you must report:

• The date when payment was made
• The original ransom demand amount and terms
• The payment instructions provided by the attackers
• The actual amount paid
• The type of virtual currency used for payment
• Identification and contact information of your organization or its authorized agent

Third-Party Reporting Options

Many organizations rely on third parties during ransomware incidents, and the law accommodates this reality:

Authorized Representatives

Covered entities may use third parties such as incident response companies, cyber insurance providers, or legal counsel to submit required reports. This option recognizes that organizations often engage specialized assistance during cybersecurity incidents.

Ultimate Responsibility

While third parties can submit reports on your behalf, it's important to note that using a third party does not relieve your organization of its reporting obligations. The covered entity remains ultimately responsible for ensuring proper reporting occurs within the required timeframes.

Legal Protections for Reporting Entities

The law provides certain protections for organizations that report ransomware payments:

Confidentiality Protections

Reports submitted to CISA are considered proprietary information and are exempt from disclosure under the Freedom of Information Act (FOIA) and similar state laws. This protection helps ensure that sensitive details about your payment and security vulnerabilities won't become public.

Preservation of Legal Privileges

Submitting a required report to CISA does not constitute a waiver of privilege or protection under the law. Attorney-client privilege, work product doctrine, and other legal protections remain intact despite the disclosure to federal authorities.

Enforcement and Compliance Considerations

Organizations should be aware of how these reporting requirements are enforced:

CISA's Authority

CISA is authorized to subpoena information from covered entities that fail to report as required. This gives the agency significant enforcement power to ensure compliance with reporting obligations.

Potential Penalties

Non-compliance with CISA subpoenas may result in contempt of court penalties. The Department of Justice may become involved in enforcement actions against organizations that fail to meet their reporting obligations.

Practical Steps for Compliance

To ensure your organization can meet its reporting obligations following a ransomware payment:

1. Develop a ransom payment reporting protocol: Create a specific process for documenting and reporting ransom payments that meets the 24-hour deadline.
2. Assign clear responsibilities: Designate specific team members responsible for gathering required information and submitting reports.
3. Coordinate with third parties: Ensure your incident response firms, insurance providers, and legal counsel understand their roles in the reporting process.
4. Document payment details meticulously: Keep detailed records of all aspects of ransom payments, particularly those involving virtual currency.
5. Consider consulting legal counsel: Given the legal complexities and potential consequences of non-compliance, seek legal advice regarding reporting obligations.

Conclusion

The reporting requirements for ransomware payments involving virtual currency reflect the government's increasing focus on combating ransomware threats. By understanding these obligations and preparing to meet them, your organization can maintain compliance even during the crisis of a ransomware attack.

Remember that these requirements exist alongside other potential reporting obligations, such as those related to data breaches or industry-specific regulations. A comprehensive incident response plan should address all applicable reporting requirements to ensure proper compliance during cybersecurity incidents.

For more information on protecting your business from cyber threats or understanding your legal obligations in case of an attack, contact a cybersecurity attorney to discuss your specific situation.