No More Ransom

In July 2016, Europol's European Cybercrime Center, the Dutch national police and security vendors launched a public portal, No More Ransom. Its principle is simple: when a ransomware strain has a cryptographic weakness, or when law enforcement seizes a criminal group's keys, a decryption tool is built and put online for free. The victim can upload an encrypted file and the ransom note, and the portal identifies the ransomware family and says whether a tool exists. Over the years the initiative has gathered dozens of public and private partners and put more than a hundred tools online. Recent police operations against large groups have often led to decryption keys being published through this channel. For insurance, the portal is the first check in incident response: before any negotiation, the provider must establish whether there is a way to decrypt without paying. This check protects the insurer against an unnecessary payment, and the insured against a payment that might turn out to be prohibited. It also illustrates a market reality: free tools mostly cover old or dismantled families, rarely the ransomware that has just struck.