DOJ and FBI Urged to Improve Ransomware Tracking, Says New Audit

A recent audit by the Department of Justice (DOJ) Inspector General has highlighted the need for the DOJ and FBI to improve how they measure success in combatting ransomware. The report, covering actions from April 2021 to September 2023, recommends redefining metrics to better track ransomware disruption efforts.

 

The audit identifies key areas for improvement, urging the DOJ to develop more meaningful measures that reflect the effectiveness of its actions against ransomware. Current metrics focus on increasing the percentage of ransomware cases where action is taken within 72 hours, which stood at 47% in 2023, up from 39% in 2022. However, the report argues these metrics fail to fully capture the impact of disruption efforts.

 

The report also notes the success of several operations targeting ransomware gangs like LockBit and Hive, which allowed the FBI to distribute decryption keys to victims. Still, the DOJ is urged to include ransomware takedowns and the provision of decryptor keys as success measures.

 

Furthermore, the audit highlights coordination issues between law enforcement agencies, with cases being hampered by lack of communication. It also calls for a clearer mission for the FBI-led National Cyber Investigative Joint Task Force (NCIJTF), which saw its role diminished after the creation of the Joint Ransomware Task Force (JRTF) in 2022.

 

Both the DOJ and FBI have acknowledged the findings, with promises to improve metrics and inter-agency collaboration.

 

This report underscores the growing need for stronger, more effective efforts to tackle ransomware as a persistent threat.