In this commentary, Matthew Rosenquist critiques the White House’s National Cybersecurity Strategy Implementation Plan (released July 17, 2023) for its inadequate approach to ransomware. He outlines ransomware’s growing threat to critical infrastructure, economies, and global stability, emphasizing its role in funding illicit activities and state‑sponsored aggression. Rosenquist points out that the implementation plan offers no concrete, measurable goals or success criteria; instead it relies on vague language such as “develop an engagement plan” and “strengthen international cooperation.” He argues that many of the listed actions—legal assistance, training, and disruption operations—are already being performed with limited effect, and that the plan’s focus on cryptocurrency as a primary lever is misplaced, since ransomware predates crypto and can shift to other payment methods. Concluding that the plan would at best yield incremental improvements, he calls for an aggressive, realistic, and quantifiable strategy with clear deliverables to truly undermine the adaptive ransomware ecosystem, urging the White House to revisit the plan with expert input.
Chapters
On July 17th, the White House released the National Cybersecurity Strategy Implementation Plan, which details the what, who, and when the different initiatives in the National Cybersecurity Strategy, which was released earlier this year, when it will be completed. I've previously reviewed the National Cybersecurity Strategy, and you can find it in the links below, but suffice it to say, I'm not overly impressed with this implementation plan, especially regarding how they're addressing ransomware. So let's take a moment and discuss that particular aspect, ransomware, and we'll leave all the other initiatives for another time. For those of you who live under a rock and still use dial-up internet connected via twisted pair telephone wires, Well, ransomware has been a significantly growing problem that now is undermining critical infrastructure services that nations need to be functional. While at the same time, it also funnels billions of dollars to countries and attackers that are committing war atrocities, developing rogue nuclear weapons programs, and are directly opposed to the prosperity of Western nations. So ransomware is a serious problem. In fact, it's one of the fastest growing types of cybercrime. It threatens everything from our electrical grids, clean drinking water, global transportation networks of people and goods, healthcare services, and just about every aspect of normal life. It also impacts our businesses, our jobs, our economies. This is a big deal. And addressing ransomware has largely failed over the past decade, two decades, actually more. But there is an opportunity for the full power of the United States government and her allies to drive a stake into the heart of this beast. The 2023 National Cybersecurity Strategy called it out specifically with several initiatives. And this was done to the cheers of critical infrastructure businesses and cybersecurity professionals around the globe. Undermining ransomware through proper coordination of government agencies, policies, legislature, it is possible. So we are at a moment where the strategy has identified it as a problem that needs to get fixed. And now the implementation strategy is before us. So when that National Cybersecurity Strategy implementation plan was dropped, I quickly paged to the relevant sections and my heart sank. There was no real implementation plan to undermine ransomware. There were no quantitative success criteria for reducing the attacks or definitive metrics for achieving the goal of gutting ransomware impacts. Instead, you will find wording like, "Develop an engagement plan to discourage nations" and "strengthen international cooperation." A plan? Your implementation plan is to create a plan? That's beyond weak. Discourage, great idea, but you don't even have a plan to discourage criminals from the hundreds of billions of dollars that they can steal. How are you going to do that? The amount we're talking about will eventually surpass the global illicit drug trade in value. You think you're going to discourage the criminals? How about this one? Carry out disruption operations against the ransomware ecosystem. Well, aren't we already doing that now with not really much effect? So your implementation plan is to simply articulate what we're already basically doing, maybe a little bit more that you want to do. That isn't very convincing. How about this one? Leverage legal assistance channels. Yes, call in the lawyers. They will surely fix ransomware. I don't think so. And how about this one in Section 2.5.4? Offer resources such as training, cybersecurity services, tech assessments, Pre-attack planning and incident response. Well, that sounds great, but that's also already being done. It's being done within the cybersecurity industry through tools and training and processes and methodologies and things of that sort. But in reality, as we now know, there is not a magical training or tool or pre-attack plan for businesses that will stop the multi-billion-dollar ransomware industry. It's like swatting a tank with a newspaper. And we've already seen through these past decades, those approaches don't work. In fact, I see a lot of references to virtual currency in these implementation plans, which concerns me a little bit. It almost appears like the authors are under the impression that there is a causational relationship there. And unfortunately, as we all know, correlation does not equal causation. Yes, ransomware often uses digital currency, cryptocurrency, but again, cryptocurrency did not create ransomware. And it's not a dependency on it. Ransomware actually predates the creation of cryptocurrency and was active long before crypto even gained in popularity. It is now popular with cybercriminals for the very same reason it's popular with legitimate users. It's fast, reliable, easily transferable, and doesn't require expensive middlemen to process transactions. But crypto is only one way that digital extortion demands are made. Criminals can use many other methods, including cash, wire transfers, credit, debit, gift cards, purchases of products or services, real or fake, uh, wire transfers, and very soon even the digital currencies issued by governments themselves. The CDBC. So this strategy appears predicated on the notion that if you get rid of cryptocurrency, ransomware will not be a serious problem, when in reality the attackers will simply use another form of money or assets, as they have in the past and will continue to attack systems for their tremendous gain. This does nothing to undermine the motivation of intelligent and well-funded attackers. I find the implementation document to be insufficient in possessing clear goals, specific deliverables, and meaningful tactics to undermine the adaptive nature of ransomware attackers. Even if all the initiatives are successful, it will likely be no better than an incremental improvement that will be outpaced by the attackers anyway. The world needs an aggressive, tangible, and realistic strategy to undermine ransomware that is capable enough to have quantifiable goals and metrics for success. This implementation plan is not that. White House, go back to the drawing board, find better experts who understand the core problem and can pathfind a course to address the root causes of ransomware and not just respond to the resulting effects. Thanks for watching. Let me know what you think in the comments below, and I look forward to a constructive debate. And be sure to subscribe to the channel for more cybersecurity insights.
