The Biden administration is expanding its efforts to combat ransomware by offering rewards of up to $10 million for information identifying cybercriminals operating under the direction or control of foreign governments. The initiative reflects growing concerns about ransomware attacks targeting American businesses, critical infrastructure, and government systems, particularly following high-profile incidents involving Colonial Pipeline and JBS.
While financial incentives could encourage individuals to provide intelligence about cybercriminal networks, the program raises questions about eligibility, enforcement, and its potential effectiveness. Identifying the individuals responsible for ransomware attacks is already difficult, and establishing connections to state-sponsored activity introduces additional challenges. For financial institutions and other businesses vulnerable to cyberattacks, the proposal highlights the complexities of combating ransomware threats that frequently originate beyond U.S. jurisdiction.
Questions Surrounding the $10 Million Ransomware Reward
While a bounty might incent defenders to chase the identity of attackers, that is hard to do and this article indicates there are major loopholes in the proposal. First, is the offer of “up to”$10 million but little definition regarding how that level of payout is achieved. Second, an explicit caveat that the lead must identify a state-sanctioned actor, and how a business would know that tidbit of knowledge is not identified.
The Challenge of Identifying State-Sponsored Cybercriminals
The Biden Administration is trying hard to establish policies that will deter ransomware criminals which is absolutely a good thing, but expecting a business to have the resources that can identify the ransomware operated by state-actors strikes me as asking a bit much given existing assets.
Enforcement Challenges Beyond U.S. Jurisdiction
Then there is this:
“Roger Grimes, data driven defense evangelist at KnowBe4, had additional questions about how effective the offer of rewards will ultimately be in countering the threat: “Anything that gets us closer to putting down malware and malicious hackers is a good thing, and this is just another tool to do so. With that said, I’m not sure how large rewards have done against foreign adversaries in the past. We’ve offered pretty huge rewards in real, past, kinetic wars, that went unclaimed. But it can’t hurt. I applaud it. We might get lucky. The question is what to do with the information if we get it and will it matter? We have no legal jurisdiction to pursue any identified criminals in most of the foreign countries hosting many of the cybersecurity criminals. The criminals are often directly protected by the leaders of their countries or paying enough bribes to legal and political protectors that any amount of even really good information will not turn into people arrested and cybercriminal shops permanently closed.”
There is one catch: the information must be linked to ‘state-sanctioned’ actors. This makes it doubtful that the recent #ransomware attacks on JBS and Colonial Pipeline would qualify. #cybersecurity #respectdataClick to Tweet
The payment program for information on ransomware attacks is expected to roll out quickly, however, with the government taking the unprecedented step of setting up channels on the dark web for the reporting of this information and potentially even paying out the reward money in cryptocurrency (according to a statement by the State Department).”
The proposed ransomware reward program demonstrates the federal government’s willingness to explore additional methods of identifying and disrupting cybercriminal organizations. Financial incentives may encourage individuals with valuable information to come forward, potentially providing intelligence that traditional investigative methods have been unable to uncover. However, the program’s success will depend on whether authorities can obtain actionable information and use it effectively.
One of the most significant obstacles is distinguishing state-sponsored ransomware operations from independent criminal enterprises. Cybercriminal groups may operate within countries that tolerate their activities without necessarily directing or formally supporting them. Establishing the level of government involvement required for reward eligibility could prove difficult, particularly for private businesses that lack access to classified intelligence or sophisticated investigative resources.
Even when authorities successfully identify ransomware operators, pursuing criminal charges presents additional challenges. Many attackers operate from jurisdictions where U.S. law enforcement has limited authority, and international cooperation may be inconsistent. Without effective mechanisms for apprehending suspects, freezing assets, or disrupting criminal infrastructure, identifying perpetrators may not necessarily translate into preventing future attacks.
For financial institutions and payment service providers, the initiative reinforces the importance of maintaining strong cybersecurity defenses regardless of government enforcement efforts. Organizations must continue investing in employee awareness, access controls, network monitoring, incident response planning, and secure data backups. While the reward program could become a useful component of the broader fight against ransomware, preventing attacks and limiting their operational impact remain essential responsibilities for businesses throughout the financial ecosystem.
Overview provided by Tim Sloane, VP, Payments Innovation at Mercator Advisory Group
