Ransomware and Federal Law: Cybercrime and Cybersecurity

Exploring legal issues implicated by two potential approaches to combatting ransomware, this report first summarizes the potential for criminal prosecution under federal statutes such as the Computer Fraud and Abuse Act (CFAA) and the Economic Espionage Act (EEA). Additionally, legal issues facing ransomware victims—in particular, whether victims risk legal liability by making ransomware payments, are also identified.

The second part of the report summarizes federal laws governing public and private sector cybersecurity, including preparedness and incident response.