CRS Reports – Ransomware and Federal Law

This week the Congressional Research Service (CRS) published a new report on “Ransomware and Federal Law: Cybercrime and Cybersecurity”. According to the introduction (pg 4):

“This report explores legal issues implicated by two potential approaches to combatting ransomware. First, the report summarizes the potential for criminal prosecution under federal statutes such as the Computer Fraud and Abuse Act (CFAA) and the Economic Espionage Act (EEA). This section of the report also discusses legal issues facing ransomware victims—in particular, whether victims risk legal liability by making ransomware payments. Second, the report summarizes federal laws governing public and private sector cybersecurity, including preparedness and incident response. This report does not cover technological and policy considerations involving ransomware, as these topics may be found in other CRS products.”

A reminder, CRS reports provide background information for members of Congress and their staffs. They are used to inform legislative responses to the issued discussed.