Ransom-Ware and the Legal Risks of Ransom Payment

Ransomware is an ever-present threat that businesses and institutes have to be mindful of. There have been several high-profile ransomware attacks recently. A victim of ransomware, apart from business considerations of complying with the ransom demand also needs to consider the legal implications of paying the ransom. Canadian law as of present appears to lack provisions for defensive payments, unlike United Kingdom and till such protections are provided by law, the fate of those paying ransoms can be in legally grey area, though there does not appear to be any prosecution for payment of ransoms but absence of specific statutory provisions protecting such payments does lead to a threat. Another aspect to consider is the sanctions regime as the provisions of the Canadian statutes appear to be general and broad with no exceptions. In the present era where some hackers and ransomware attackers may be allied with or working at the behest of sanctioned states, victims of ransomware by payment of ransom can expose themselves to legal liability, therefore provisions for defensive payments as provided by United Kingdom is the need of the hour in Canada, as there appears to be a statutory void on the payment of ransom by victims.<br><br>Bill C – 27 make reporting of ransomware attacks mandatory and also provides for taking steps in accordance with directions issued by certain government entities in some areas. The potential Critical Cyber Systems Protection Act, which seeks to legislated under Bill C – 27 intends to provide a framework for the protection of the critical cyber systems of services and systems that are vital to national security or public safety and that are delivered or operated as part of a work, undertaking or business that is within the legislative authority of Parliament. The import of this can be that a victim of ransomware may not claim protection of defensive payments if there is any failure to comply with these obligations and the payment is in violation of Anti Money Laundering and / or Anti-Terrorism and /or laws relating to sanctions in Canada.