Opinion | How to stop ransomware at schools in LA and elsewhere
Ransomware hackers break into computers, lock them, steal confidential data and demand money to unlock organizations’ critical systems. These criminals often target schools because they are profitable targets. If all ransomware victims refused to pay, the attacks would stop. Indeed, paying could be illegal: the Treasury released guidance last year noting that giving money to global criminal organizations can violate sanctions laws.
The problem is, saying no isn’t always easy. Los Angeles did not capitulate, and the criminals leaked a wealth of data – a consequence that may prove more or less serious depending on the sensitivity of the information stolen. Even the first phase of a ransomware attack, when hackers block access to critical systems, can paralyze any company. Schools face the risk of prolonged disruption in children’s education. Many schools do the math and find that paying a ransom costs less than squatting.
A broad ban on payments is one solution. However, some fear such a measure would be too harsh on the struggling counties. There are many things that you must try first. Educational institutions can bolster their defenses: Last year’s bipartisan infrastructure bill authorized $1 billion to help local governments improve their cybersecurity capabilities — and public schools should be the best candidates for reinforcement. Setting security standards like mandatory multi-factor authentication is a smart start, but few K-12 institutions are full of technical geniuses. They need a lot of training and support. Offline backups of critical information are also critical, so immediate data removal by criminals in the event of a sensitive system breach is not as important as it otherwise would be.
Building capacity to push ransomware attackers out of the systems they’ve locked down is another important line of defense. The same bipartisan law created the Cyber Response and Recovery Fund to provide federal assistance to victims of security breaches. It boasts over $20 million a year for five years which, if spent to support schools after being hacked, could help liberate computer systems in institutions that have neglected to have proper backups and maintain good cybersecurity hygiene.
“Because we can,” said a representative of the ransomware gang that took down the Los Angeles Unified School District, explaining the collective’s motivations to a reporter from Bloomberg News. The school’s job is to turn “can” into “can’t” – or at least make sure that success pays much less.