The U.S. Ransomware Task Force (RTF), also known as the Joint Ransomware Task Force, is an interagency body that leads the American government's efforts to address the threats of ransomware attacks. It is jointly headed by the Department of Homeland Security’s cyber arm, the Cybersecurity and Infrastructure Security Agency (CISA), and the Federal Bureau of Investigation.
Before the establishment of the Ransomware Task Force, the U.S. had launched several initiatives that coordinated a series of defensive and offensive measures targeting ransomware. This came about after a string of high-profile attacks that highlighted America's vulnerability in the cybersecurity space.[1] An example was the U.S. State Department's Ransomware and Digital Extortion Task Force, which was established in April 2020. It was created to counter ransomware attacks and actors and recover ill-gotten gains.[2] A year later, the Justice Department created its own ransomware taskforce in response to the onset of cybersecurity breaches that made 2021 the worst year for ransomware attacks.[3]
In May 2020, Russian operators hacked the Colonial Pipeline and shut down the American East Coast's gasoline supply. The White House responded in July, and established the RTF.[4]
The creation of the RTF as an interagency body was ratified by the U.S. Congress in 2022. Under Section 106 of the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA), the task force is mandated to serve as the central body that coordinates ongoing nationwide campaigns against ransomware attacks. It is also tasked to initiate international cooperation on a global scale. The task force is run as a cooperative team using the resources and authority of the Department of Justice, Department of Homeland Security, Department of State, and Department of Treasury.[5]
In 2021, the RTF released a report, Combating Ransomware: A Comprehensive Framework for Action, that was drafted by a team of industry, law enforcement, and government experts.[6] It recommended that the White House should lead a whole-of-government, intelligence-driven anti-ransom campaign; and create a Ransomware Incident Response Network as well as a Ransomware Response and Recovery Fund to minimize ransomware threats. The report noted a lack of international coordination not just in mounting countermeasures but also in terms of enforcement due to the absence of regulatory frameworks and relevant regional laws.[7]
The RTF conducts defensive and offensive operations, which include reverse-hacking. In 2023 the taskforce successfully dismantled the Hive, an international ransomware network responsible for extorting hundreds of millions of dollars from victims both in the United States and abroad.[8] The RTF also conducts different initiatives to shore up cybersecurity capabilities in the private sector. It holds, for example, weekly summits for businesses to strengthen their digital defenses and prevent the use of anonymized cryptocurrency platforms as a means to pay ransom demands.[9] In the first half of 2022, the RTF reported a significant decline in ransomware attacks in the U.S.[10]
The American private sector has launched initiatives to address cybersecurity. These include a ransomware task force launched by large information technology companies as well as non-profit organizations seeking to mitigate the incidence of ransomware risks not just in the U.S. but also around the world.[11] In pursuit of the 2023 U.S. National Cybersecurity Strategy, the RTF seeks stronger collaboration with the private sector through programs such as Quad Cyber Challenge. There is also an emphasis on reinforced intelligence dissemination efforts (e.g. CISA's ransomware-related cybersecurity advisories), increased law enforcement campaigns, and cybercrime sanctions, among others.[12]