Change Waits for No One: An Examination of the Legal Response to Ransomware Attacks

Due to the increasing threat of ransomware, policy makers have been working to develop strategies to curb attacks. These strategies include using mechanisms already in place, such as the Computer Fraud and Abuse Act, and adopting new legislation, such as the Cyber Incident Reporting for Critical Infrastructure Act of 2022. States have had ransomware statutes as early as 2014. This study conducted a contemporary review of these state statutes, including identifying and discussing relevant themes and trends. A contemporary review of legal cases citing state criminal ransomware statutes was also conducted. The results suggest there is not heavy reliance on state statutes criminalizing ransomware. The results also demonstrate the complexities involved when trying to develop ransomware legislation. It is recommended that organizations take measures to understand the limitations of state and federal ransomware legislation and develop comprehensive policies to protect against potential threats.