In its latest white paper, Aon Cyber Solutions explores “how doing business with the U.S. government can cost millions under the False Claims Act,” and offers proactive steps that professional services firms can take to manage these risks when working with the federal government, its contractors and clients that receive funding from federal government programs.

In its battle against ransomware, the U.S. government is aggressively deploying tools that target threat actors’ entire food chain. The administration is sanctioning, and where possible, taking direct action against, the individuals responsible for the ransomware epidemic. Examples include:

• The successful interception of part of the ransom paid by Colonial Pipeline
• Formal OFAC sanctions against two cryptocurrency exchanges, SUEX and Chatex
• Coordinated action against the REvil ransomware gang by Romanian Police, Europol and the US Department of Justice

The Administration and regulatory authorities are also putting pressure on the victims, using a combination of “carrot and stick” incentives to encourage better cybersecurity practices and more disclosure to authorities when threat actors strike.

In the first instance (the carrot) OFAC issued an updated advisory on September 21, 2021 emphasizing that if a ransomware victim has followed cybersecurity best practices (such as those promulgated by CISA) and has engaged law enforcement or other authorities in the response to the attack, OFAC will consider these as mitigating factors when considering any enforcement action for paying a ransom to a sanctioned entity.

In the second instance (the stick) the Department of Justice has announced that it will use the False Claims Act to pursue organizations that misrepresent their cybersecurity or fail to appropriately report cybersecurity incidents.

Lincoln’s Ghost & Cyber Security by Aon Cyber Solutions expert Eric Gyasi examines the scope and potential impact of this new initiative and the punitive stance being taken by the Department of Justice. It also offers an outline framework of actions to take to protect the firm from False Claims Act Cybersecurity risk.

Contact

Aon’s Professional Services Practice values your feedback. To discuss any of the topics raised in this article, please contact Tom Ricketts.

Tom Ricketts
Senior Vice President and Cyber Risk Leader
New York