International Counter Ransomware Initiative Members Come Together to Strongly Discourage Ransomware Payments

Singapore and the United Kingdom, as co-chairs of the Policy Pillar under the Counter Ransomware Initiative (CRI), led an international effort to bring CRI members together to publicly denounce ransomware and strongly discourage paying ransomware demands. This sends a strong signal to ransomware criminals and the world that countries will not tolerate ransomware attacks and are banding together to take decisive action to counter ransomware. 

The joint statement is appended below. Learn more about the CRI here.

CRI Joint Statement on Ransomware Payments

Members of the Counter Ransomware Initiative¹ are joining together to publicly denounce ransomware and those who perpetrate these devastating attacks. 

We commit to collectively address our approach to ransomware payments to undermine the ransomware business model and disrupt criminal activity. We will not tolerate the extortive actions of these cyber criminals who too often act with seeming impunity.

Therefore, we strongly discourage anyone from paying a ransomware demand. Each of us intends to lead by example. We have reached consensus that relevant institutions under the authority of our national government should not pay ransomware extortion demands.² 

Paying a ransom to ransomware actors:

• Does not guarantee the end of an incident, or the removal of malicious software from your systems

• Provides incentives for criminals to continue and expand their activities

• Provides funds that criminal actors can use for illicit activity

• Does not guarantee you will get your data back

We will continue to comprehensively address the threat posed to our countries by ransomware, incorporating law enforcement, including INTERPOL – increasing our resilience and limiting the funds available to these criminals. 

¹Albania, Australia, Austria, Belgium, Brazil, Bulgaria, Canada, Colombia, Costa Rica, Croatia, Czech Republic, Dominican Republic, Egypt, Estonia, France, Germany, Greece, India, Interpol, Ireland, Israel, Italy, Japan, Jordan, Kenya, Lithuania, Mexico, the Netherlands, New Zealand, Nigeria, Norway, Poland, Portugal, Republic of Korea, Romania, Rwanda, Sierra Leone, Singapore, Slovakia, South Africa, Spain, Sweden, Switzerland, Ukraine, United Arab Emirates, United Kingdom, United States

² In accordance with domestic laws and regulations