The Insurance Council of Australia has cautioned the government against implementing an outright ban on paying ransoms and extortion demands in response to data breaches. In a submission to the 2023-2030 Australian Cyber Security Strategy consultation, the council called for a more nuanced approach to tackling ransomware and suggested that a ban could have unintended consequences. The council also urged the government to simplify and harmonize cybersecurity requirements on businesses, rather than drafting a specific Cyber Security Act. The Insurance Council emphasized that it has a stake in cybersecurity, as it insures businesses against losses from incidents. Insurers assess a firm’s security posture and protections when deciding whether or not to cover them. The council welcomed government initiatives that improve firms’ cyber risk posture, as they would likely improve the availability of cyber insurance.
The Insurance Council noted that the decision to pay a ransom is usually made by the client, not the insurer, and may be reimbursed in part or full, subject to the limits of the policy and compliance with sanction policies. While acknowledging that paying ransoms can contribute to a criminal business model, the council argued that the decision to pay is often a function of the cost of recovery and remediation being higher than the ransom demand. The council encouraged the government to consult with the insurance industry before taking a definite position on banning ransom payments.
The council also called on the government to build trust with industry to encourage cooperation in incident response. It suggested that non-legislative harmonization of regulations could achieve a lot before new legislation needs to be considered. The council cautioned against creating an additional layer of obligations, which could create further complexity and a lack of clarity in terms of interactions with existing legislation and regulation. The council stated that the insurance industry would be disappointed in the creation of a new act that duplicated ongoing APRA regulation.