NCL letter to Subcommittee on Crime and Terrorism on ransomware – National Consumers League

May 17, 2016

The Honorable Lindsey Graham
Chairman
Subcommittee on Crime and Terrorism
Committee on the Judiciary
United States Senate
224 Dirksen Senate Office Building
Washington, DC 20510

The Honorable Sheldon Whitehouse
Ranking Member
Subcommittee on Crime and Terrorism
Committee on the Judiciary
United States Senate
224 Dirksen Senate Office Building
Washington, DC 20510

RE: Senate Subcommittee on Crime and Terrorism Hearing on “Ransomware: Understanding the Threat and Exploring Solutions”

Dear Senators Graham and Whitehouse:

Ransomware has rapidly developed into a major threat to both consumers and businesses.  In the first three months of 2016, cyber criminals have extorted a reported $209 million from businesses, industry and consumers, up from $24 million in all of 2015.^[1]  If this pace continues, hackers will collect $1 billion from business and consumers this year.^[2] The rise of ransomware has had a detrimental effect on commerce and consumers as hackers have demanded ransoms and halted operations at schools,^[3] government agencies,^[4] small businesses,^[5] utilities^[6] and hospitals in growing numbers across the country. 

Ransomware can cost its victims more than just money. In March, MedStar Health, a $5 billion health care provider suffered a ransomware attack that prevented the hospital from accessing email and health records, resulting in many patients in need of treatment being turned away.^[7] Likewise, Hollywood Presbyterian Hospital recently faced a similar attack and was forced to pay $17,000 to hackers if they wanted to regain access to their clients’ medical records. ^[8]

While ransomware is a grave threat, it is but one symptom of the larger threat that a lack of data security poses to consumers and organizations. To significantly reduce the risk of ransomware and other online threats, we urge the subcommittee to consider the legislative steps that NCL outlined in our 2015 Congressional Data Security Agenda.^[9] In particular, we urge the subcommittee to support solutions that:

• grant the Federal Trade Commission the authority they need to protect consumer’s data by granting the Commission civil penalty authority and clarifying its role as the primary authority in data protection; 
• require data holders to abide by reasonable data security requirements that would stem not only ransomware attacks but which would also prevent data breaches that cause the loss of consumer data that cyber criminals use to steal identities; 
• increase federal civil and criminal penalties for hacking to deter potential cyber criminals; and
• Promote robust cyber insurance underwriting standards.

Many of these protections have already been proposed in several bills this Congress. In particular, we note Senator Leahy’s Consumer Privacy Protection Act of 2015 is supported by NCL ^[10] and numerous consumer and public interest organizations.^{[11][12][13][14]}

We urge you to support the proposals we have outlined in this letter as you explore solutions to the growing threat ransomware poses to consumers and commerce.

Sincerely,

Sally Greenberg
Executive Director
National Consumers League