This is a very interesting legal comment on a cyber insurance dispute over a ransomware claim that played out in Swiss courts last year. In short, the insurer contested reimbursing part of a ransom payment that Garmin made to an Evil Corp-linked ransomware strain in 2020, because they argued the payment was being made to a sanctioned entity (Evil Corp). Alexander Martin had a great scoop on this back in 2020: https://lnkd.in/en-StG9U The Swiss supreme court sided with Garmin because: 1. The prospect of being sanctioned by OFAC is very low -- OFAC has never penalised an organisation for paying a ransom to a sanctioned entity 2. The insurer couldn't attribute the ransomware attack to Evil Corp with enough certainty (personally, I would argue that Evil Corp is one of the few sanctioned ransomware threat actors where you *can* prove a stronger link because of the use of custom tooling and malware. It's interesting because: 1. There is a say do gap for ransomware sanctions currently. The US and UK ransomware sanctions regime are currently not being enforced and are designed in a way to make them harder to enforce (e.g. naming individuals rather than ransomware strains). The insurance/incident response/negotiator ecosystem knows this, but I don't think it's seeped out into the wider community. 2. The bar on what minimum sanctions due diligence or ransomware attribution looks like right now is too low, and OFAC and OFSI (the UK authority) should be demanding on-chain analysis and assessments of tradecraft and tooling.
𝑪𝒚𝒃𝒆𝒓𝒊𝒏𝒔𝒖𝒓𝒂𝒏𝒄𝒆 𝑪𝒐𝒗𝒆𝒓𝒂𝒈𝒆 𝒇𝒐𝒓 𝑹𝒂𝒏𝒔𝒐𝒎𝒘𝒂𝒓𝒆 𝑷𝒂𝒚𝒎𝒆𝒏𝒕𝒔 𝒗𝒔 𝑼𝑺 𝑺𝒂𝒏𝒄𝒕𝒊𝒐𝒏𝒔 𝑹𝒆𝒈𝒖𝒍𝒂𝒕𝒊𝒐𝒏𝒔 New case comment on an interesting Swiss contract law decision (judgment of the Swiss Federal Supreme Court of 17 August 2023 – ref. 4A_206/2023) concerning the insurer’s refusal to reimburse ransomware payments made by the cyberattacked company due to the potential risk of violating US sanctions regulations authored by Jacques de Werra, Célian Hirsch and Thomas Hua (gbf Attorneys-at-law Ltd - https://lnkd.in/e36FYkNB). ⇒ Case comment: https://lnkd.in/exmV64zi ⇒ Judgment of the Swiss Federal Supreme Court (in German): https://lnkd.in/eZm9xj6i Faculté de droit - UNIGE - Université de Genève - Digital Law Center - University of Geneva #Insuranceagreement #USsanctions #cyberinsurance #sanctionsinterest #ransomware #swisscontractlaw #contractlaw #commercialcontracts #swisslaw
Research Fellow in Cyber Threats and Cyber Security at Royal United Services Institute
4moWould have helped if I'd posted the right link to the Garmin story from Alexander Martin: https://news.sky.com/story/garmin-paid-multi-million-dollar-ransom-to-criminals-using-arete-ir-say-sources-12041468