Preparing For and Responding to the Petya Ransomware Attack

By Allen O'Rourke

While still reeling from last month’s WannaCry attack, organizations worldwide were hit with another global ransomware attack yesterday, June 27, 2017. The infection began inside the Ukraine but has quickly spread across four continents and over 65 countries, affecting many thousands of computers. The growing list of corporate victims includes a large Danish shipping company, the biggest advertising agency worldwide, a French construction material company, Russia’s largest oil producer, a major U.S. pharmaceutical company, and a multinational law firm. Numerous public and private institutions in the Ukraine are also affected, including everything from bank ATM’s to the Chernobyl Nuclear Power Plant.

Variously called “Petya,” “GoldenEye,” “Petrwrap,” and “NotPetya” by different cybersecurity researchers, the current cyberattack’s malware is an offshoot of earlier Petya ransomware that began circulating last year. The new Petya variant encrypts a computer’s hard drive – making it inoperable – and demands $300 in Bitcoin to regain access. Victims are instructed to make payment into a specified Bitcoin wallet and then email confirmation to wowsmith123456@posteo.net – although that email account has now been deactivated by German email provider Posteo. About 36 ransom payments were made on June 27, 2017 – according to Blockchain analysis – but by the following morning no one had reported regaining access to infected computers.

Petya ransomware appears similar to WannaCry but more resilient and destructive. It uses wormlike propagation to spread quickly across a computer network and has multiple attack vectors in addition to the “EternalBlue” exploit to Windows that WannaCry used, such as Word documents laced with malicious macros and compromised updates for accounting software called “MeDoc.” Unfortunately, Petya contains no known “kill switch” similar to what curtailed WannaCry’s spread. As Wired’s Lily Hay Newman put it, “while WannaCry’s many design flaws caused it to flame out after a few days, this latest ransomware threat doesn’t make the same mistakes.”

Petya’s ongoing threat reflects a new reality for businesses today. With periodic leaks of alleged NSA hacking tools such as EternalBlue, cheap “Ransomware as a Service” being offered on dark web forums, and well-funded cybercriminal groups linked to organized crime and foreign governments, we are just going to see more and more ransomware and other cyberattacks targeting business operations and infrastructure. In other words, today’s cybercrime targets not only sensitive data stored on computers but also the integrity of computer systems that we rely upon every day.

Accordingly, business leaders and corporate officials such as in-house counsel need to be informed and prepared. Even after weathering a ransomware attack, an organization may still face expensive regulatory enforcement actions and civil litigation, not to mention reputational damage and lost business. With that in mind, the following are some basic action items to consider in preparing for and responding to ransomware attacks:


Preparing for Ransomware

• Maintain a backup copy of your organization’s computer system that can be used in the event that your system becomes encrypted by ransomware.
• Identify operating systems and software in your network that may be vulnerable and install appropriate security patches. Also implement measures to ensure that new security patches are promptly installed going forward.
• Deploy updated antivirus software and consider using automated software tools to detect and mitigate cyberattacks.
• Develop or update your organization’s incident response plan to address ransomware. This includes not only planning for rapid investigation, containment, and remediation of an attack, but also planning for business continuity, public relations, cybersecurity insurance, and legal compliance implications.
• Establish contacts with law enforcement, outside counsel, a cybersecurity remediator, your insurance company, and anyone else with whom you will need to coordinate when responding to a ransomware attack.
• Implement ongoing training of computer users on basic cybersecurity hygiene, including not clicking on suspicious links or opening suspicious email attachments.

Responding to Ransomware

• Wherever possible, incident response measures should be taken at the direction of counsel in order to preserve attorney-client privilege and minimize legal risk.
• Work with a cybersecurity remediation company to rapidly contain and remediate the ransomware attack. Among other things, this might include disabling the infected computer, restoring backup files, or counteracting the ransomware.
• Fully investigate the ransomware attack, engage with law enforcement as appropriate, and implement cybersecurity measures to defend against additional follow-up attacks.
• Ensure that key stakeholders stay informed, including corporate executives and boards of directors.
• Determine the extent of harm to data subjects and consumers, comply with applicable breach notification obligations, and take other steps to minimize legal risk.

Canadian Government Suspends Implementation of Private Right of Action Under CASL

By Doug Bonner & Taylor Ey


Our previous alert regarding changes to Canada’s Anti-Spam Legislation (“CASL”) previewed two important changes that were to come into effect as of July 1, 2017:

• The end of the transition period under CASL, during which companies could rely on implied consent for sending “commercial electronic messages” in certain instances; and
• A private right of action for violations of CASL

On June 2, 2017, the Government of Canada suspended the implementation of the private right of action provision.  The private right of action will not come into effect unless and until the government takes further action to implement it.  According to its press release on June 7, 2017, the Canadian Government will ask a parliamentary committee to review the private right of action provision, and hopes to strike a balance between consumer protection and legitimate business marketing activity, that is, protecting Canadians from spam while allowing entities such as businesses, charities and non-profits to communicate with Canadians electronically. 

The government’s action does not impact the termination of the transition period, which will become effective on July 1, 2017. 

FCC Slams Serial Robocaller With $120 Million Proposed Fine for "Spoofing" Numbers

By Rebecca Jacobs, Marty Stern & Doug Bonner

We all get them.  Repeated marketing calls to our mobile and home phones with the incoming phone number altered to make it appear that it’s a local call, when in fact, the call is from a robo-scammer using IP technology to “spoof” the phone number.  As it turns out, there’s a federal law that makes such spoofing illegal, the Truth in Caller ID Act of 2009 (“TICIDA”), and in its first enforcement action under TICIDA, the FCC hit an alleged serial robocaller, Adrian Abramovich and his companies (together, Abramovich) with a whopping $120 million Notice of Apparent Liability for allegedly originating nearly 100 million such calls.

The Commission also issued a Citation and Order  to Abramovich for alleged violations of the Telephone Consumer Protection Act (“TCPA”) for making unauthorized prerecorded telemarketing calls to emergency phone lines, wireless phones and residential phones without obtaining the required prior express written consent from the called party.  While TICIDA allows the Commission to directly fine first-time violators through its NAL authority, which it did here, in TCPA FCC enforcement actions involving entities and individuals that do not hold Commission authorizations, the Commission must first issue a citation, and then can only proceed with a fine if the recipient repeats the violation.  That still leaves Abramovich open to potentially monumental TCPA class action exposure.   The Citation and Order also notified Abromovich that he had violated the federal wire fraud statute by transmitting or causing to be transmitted, by means of wire, misleading or false statements with the intent to perpetrate a fraud.

According to the Commission, Abramovich ran a scheme where his spoofed calls appeared to originate from local numbers and offered, via a pre-recorded message, holiday vacations and cruises claiming to be associated with well-known American travel and hospitality companies.  The pre-recorded messages would prompt customers to “press 1” to secure their reservation.  Once a customer pressed “1”, the customer was transferred to a call center where live operators pushed vacation packages typically involving timeshare presentations, that were not affiliated with the well-known brands used in the recorded messages.  The Commission characterized Abramovich’s schemes as “one of the largest – and most dangerous – illegal robocalling campaigns the Commission has ever investigated.”  According to the Commission, in addition to defrauding consumers, the robocalling campaign also caused disruptions to an emergency medical paging service, which provides paging services for emergency room doctors, nurses, emergency medical technicians, and other first responders.

While significant in absolute terms, the $120 million proposed fine, according to the Commission, was significantly below the penalty that could have been proposed in the NAL.   Rather than fine the statutory maximum of $11,052 for each spoofing violation, or three times that amount for each day of a continuing violation, the Commission calculated the base forfeiture amount at $1,000 per unlawful spoofed call, since this was the first time the Commission used its TICIDA forfeiture authority.

Mr. Abromovitz now has an opportunity to respond to both the NAL and Citation.  Stopping illegal robocalling has been a key priority for Chairman Pai, and no doubt the Commission is expecting that the threat of huge monetary forfeiture penalties against the industry will provide a powerful incentive for roboscammers to look for other ways to make a buck.  Given the Commission’s struggle with fashioning tools to go after serial robocallers that do not have the effect of increasing TCPA exposure for established companies engaging in legitimate customer communications, we do not expect the Commission to back down from its proposed penalty, and expect this to be the start of a new enforcement initiative using TICIDA and its direct penalty provisions.