Decoding Emerging Threats: Ransomware and the Prevention of Future Cyber Crises

In recent years, ransomware incidents have captured the attention of both developed and developing economies. While incidents vary in complexity, when successful, they can deliver nation-wide crippling effects. As many cases have shown, governments have become a particular target of many ransomware groups, leaving departments, critical infrastructures, essential services and entire local governments unable to function.

Within the context of the United Nations Open-Ended Working Group (OEWG) on security of and in the use of information and communications technologies – the UN’s main space for international dialogues on cybersecurity – several member states have highlighted the importance of recognising ransomware as an emerging threat in the context of international peace and security. While important, this also raises at least two challenges: one of determining when and what qualifies a ransomware incident beyond the criminal sphere, and another of understanding how cases of international cooperation on ransomware can further inform the development of better models for international cyber crisis assistance.

On 24 July 2023, RUSI and Estonia – with the co-sponsorship of the governments of Costa Rica and Vanuatu – organised a closed roundtable on ‘Decoding Emerging Threats: Ransomware and the Prevention of Cyber Crises’ on the sidelines of the UN OEWG. This report is the outcome of the discussions – providing both a summary of the roundtable and reflections for future dialogues. It outlines common indicators for ransomware incidents that are considered an international security issue as well as gathers examples of how countries and industry have collaborated to provide international assistance to support countries facing disruptive ransomware.

This report is part of RUSI Cyber Teams’ work on responsible cyber behaviour and, in particular, the Global Partnership for Responsible Cyber Behaviour.