December 10, 2021 10:14AM # The Military Is Not the Solution to the Challenge of Ransomware By [Brandon Valeriano](https://www.cato.org/people/brandon-valeriano) --- SHARE General Paul Nakasone, head of U.S. Cyber Command and the National Security Agency, finally confirmed what many had long speculated, the U.S. military [directly intervened](https://www.nytimes.com/2021/12/05/us/politics/us-military-ransomware-cyber-command.html) to shut down criminal cyber hackers after the attacks on the [Colonial gas pipeline](https://www.nytimes.com/2021/05/14/us/politics/pipeline-hack.html) and the [meat supplier JBS](https://www.nbcnews.com/tech/security/meat-supplier-jbs-paid-ransomware-hackers-11-million-n1270271) during the summer of 2021. The threat of ransomware is precarious and a challenge to the stability of the nation during the ongoing pandemic. Yet, threats to digital connectivity do not require the blurring of the boundary between domestic security and international security. Leveraging military assets to handle criminal problems that are not directly related to national security represents the continued reliance of offensive maneuvers and the U.S. military to maintain primacy in cyberspace. While ransomware is clearly a modern security challenge, it is but one of many security challenges the information technology industry has faced, from the [Y2K bug](https://www.britannica.com/technology/Y2K-bug), to [election](https://www.nytimes.com/2017/09/01/us/politics/russia-election-hacking.html) attacks, to the recent exploitation of our [email](https://www.zdnet.com/article/everything-you-need-to-know-about-microsoft-exchange-server-hack/) and [print servers](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527). There will be a new challenge next month and the United States [requires a proper whole-of-nation strategy](https://www.lawfareblog.com/layered-cyber-deterrence-strategy-securing-connectivity-21st-century) to counter these threats without depending on the blunt force that is the military. Cyber security is a spectrum of operations long in search of guideposts. It represents a field of digital interaction where there exists little clarity. What is more troubling is efforts to provide coherence through the crutch of military where there is already domestic law that provides guidance for such actions. The [Posse Comitatus Act](https://www.law.cornell.edu/uscode/text/18/1385) makes it very clear that the U.S. military is not to be leveraged for domestic challenges. As a [RAND study](https://www.rand.org/content/dam/rand/pubs/monograph_reports/MR1251/MR1251.AppD.pdf) notes, the exceptions involve the National Guard operating under state authority, to quell domestic violence, search and surveillance, for use in the war on drugs, and the Coast Guard. Now is not the time to make changes to practice due to the threat of ransomware, a lesson that should be known to all after the [military](https://www.nytimes.com/2020/06/11/us/politics/trump-milley-military-protests-lafayette-square.html) became embroiled in protests near the White House in the summer of 2020. Ransomware is certainly a scourge that is [increasing](https://www.securitymagazine.com/articles/94831-ransomware-soars-with-62-increase-since-2019) due to new digital dependencies created by the pandemic and the wide availability of cryptocurrency. Yet, there is no evidence that this threat is escalating or becoming more intense, nor is it clearly a national security challenge. We must not confuse low-level threats to information technology with critical national security challenges. The nation is in danger of degrading its own capabilities by losing focus on protecting the homeland. Using the U.S. military to handle criminal problems represents a classic example of mission creep, the dependence on the military for all problems and challenges that might be wholly inappropriate. For one, ransomware operations typically provoke a reaction long after they are launched and there is little intelligence on where the next attack will emanate. Two, reactions by the military must be in the last resort, a high bar in cyber security since the government and industry overall have done little to protect the homeland. As Erica Borghard [notes](https://www.cfr.org/blog/colonial-pipeline-incident-shows-need-broader-thinking-about-cyber-resilience), [we know how to stop ransomware](https://www.domaintools.com/resources/blog/we-know-how-to-prevent-ransomware?utm_source=Social&utm_medium=Twitter&utm_campaign=We-Know-How-to-Prevent-Ransomware) but that requires that the targets themselves prevent exploitation and a series of policy changes. Ransomware has been endemic in cyber security operations since at least 1989 with the [AIDS Trojan](https://www.fortinet.com/blog/industry-trends/analyzing-the-history-of-ransomware-across-industries) being the first operation. Ransomware is so common, major cyber operations from foreign states have mimicked them to try to avoid attribution with the [Sony Hack](https://www.vox.com/2015/1/20/18089084/sony-hack-north-korea) and [NotPetya](https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/) being examples of foreign state attacks being masked as ransomware. States are typically not in the business of creating ransomware since their goals are [coercive](https://oxford.universitypressscholarship.com/view/10.1093/oso/9780190618094.001.0001/oso-9780190618094) while ransomware is generally the purview of criminal organizations or [North Korea](https://www.cyberscoop.com/north-korea-ransomware-lazarus-group-kaspersky-vhd/) which typically operates like a criminal state. As [Pascucci and Sanger note](https://www.lawfareblog.com/revisiting-framework-military-takedowns-against-cybercriminals), “cybersecurity is national security”, yet it’s not clear that ransomware is national security. The goals are criminal in nature. There is no grand strategy at play to suppress or “[pin down](https://twitter.com/RidT/status/1412598137311612931)” America’s collective cyber defenses, instead criminal actors operating in adversary states are preying on the lack of [resiliency](https://www.cfr.org/blog/colonial-pipeline-incident-shows-need-broader-thinking-about-cyber-resilience) in the target and conflicting views on how to update the [Budapest Convention on Cybercrime](https://www.coe.int/en/web/cybercrime/the-budapest-convention). [Russia and China](https://www.crossborderdataforum.org/budapest-convention-what-is-it-and-how-is-it-being-updated/) are pushing for a new convention that defends their version of sovereignty and have little interest in enforcing current agreements. When leveraging military power, there are only two questions that need to be asked, is it legal and is it in the interest of national security? The reality is that many cyber security missions meet neither bar and therefore domestic actors like the Federal Bureau of Investigation and Department of Homeland Security, in collaboration with international judicial processes and conventions, are the real means counter to ransomware. ##### Related Tags [International](https://www.cato.org/international), [Defense and Foreign Policy](https://www.cato.org/defense-foreign-policy) [![Creative Commons License](/build/cato_2020/images/creative-commons.svg)](http://creativecommons.org/licenses/by-nc-sa/4.0/) This work is licensed under a [Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License](https://creativecommons.org/licenses/by-nc-sa/4.0/).