Legal Aspects of Domain Ransomware and Extortion: Prevention and Response

Legal Aspects of Domain Ransomware and Extortion: Prevention and Response

In an increasingly digitalised world, domain names form a critical part of a company's digital identity and brand. Unfortunately, this also makes them attractive targets for malicious actors. Domain ransomware and extortion represent a growing threat where attackers seize control of, or threaten to seize control of, a domain name to demand ransom. This article explores the legal aspects of such attacks, focusing on prevention and response for Norwegian business owners and investors.

What are Domain Ransomware and Extortion?

Domain ransomware refers to situations where criminals illegally gain access to or control over a domain name. This can occur through various methods, such as phishing attacks targeting domain administrators, exploitation of security vulnerabilities in registrar systems, or by manipulating registration data.

Extortion, in this context, involves the attacker threatening to:

• Transfer the domain name to a third party.
• Delete or deactivate the domain name.
• Alter DNS settings so the website points to malicious content (e.g., phishing sites or malware distribution).
• Block the renewal of the domain name.

The objective is to force the owner to pay a ransom to regain control or prevent further damage.

Legal Consequences and Regulatory Framework

In Norway, domain names are primarily regulated by the Domain Names Act (lov om domenenavn) and its associated regulations. These laws, along with general criminal provisions, form the basis for how such offences are handled.

Unlawful Intrusion and Computer Crime: Unauthorized access to a domain name's control panel or domain administration systems can be prosecuted under Section 202 of the Penal Code (straffeloven § 202) for computer crime. This covers illegal access to computer systems.

Extortion: The act of extortion itself is punishable under Section 330 of the Penal Code (straffeloven § 330). This applies when someone, with unlawful gain, forces another person to give, do, tolerate, or refrain from doing something by threatening a criminal act, damage to person or property, or by disclosing a secret.

Trademark Infringement and Unfair Appropriation: If the attacker attempts to sell the domain back to the original owner at an inflated price, or if the domain closely resembles an existing trademark, it may also constitute a violation of the Trademark Act (varemerkeloven).

Registrar Liability: Domain registrars (the companies that sell and manage domain names) also have a responsibility to implement adequate security measures to prevent unauthorised changes. A lack of security could potentially lead to liability for damages on the part of the registrars.

Preventive Measures for Business Owners and Investors

The best strategy against domain ransomware is proactive prevention. Key measures include:

• Strong Passwords and Two-Factor Authentication (2FA): Use unique, complex passwords for all accounts related to domain administration and registrars. Always enable 2FA where available. This is the most crucial defence.
• Secure Email and Phishing Awareness: Train employees to recognise and report phishing emails. Many attacks start with compromised email accounts.
• Regular Security Audits: Periodically review access rights and security settings for domain accounts.
• Updated and Secured Contact Information: Ensure contact information with the registrar is up-to-date, but also that the registered email address is extremely well-secured. Consider a separate, dedicated, and secure email for domain administration.
• Utilise Locking Features: Many registrars offer "transfer lock" or "registry lock" to prevent unauthorised domain transfers. Employ these features.
• Backup DNS Settings: Keep a copy of your current DNS settings stored securely.
• Consider Multiple Registrars: For highly critical domains, it may be worthwhile to consider using different registrars for different services or parts of your domain portfolio.

Response to an Attack

If the worst happens, prompt and correct response is crucial:

1. Do Not Pay Ransom: It is generally advised not to pay ransoms. It does not guarantee the return of control and funds criminal activity.
2. Contact the Registrar Immediately: Inform your domain registrar about the incident. They have procedures for handling security breaches and can assist in restoring control or verifying ownership.
3. Gather Evidence: Document all communication, unauthorised changes, and any losses incurred. This is important for any police report and insurance claims.
4. Report to the Police: Report the incident to your nearest police station or via politiet.no. Cybercrime is a priority area for the police.
5. Contact Norid (for .no domains): For .no domains, Norid (the Norwegian Domain Name Registry) is a key player. They can provide guidance and, in some cases, assist with reversing unauthorised changes, especially if registrars do not handle the matter satisfactorily.
6. Consider Legal Action: Depending on the severity and losses, it may be appropriate to consider civil lawsuits against the perpetrators if identified, or in rare cases, against the registrar if they have been grossly negligent.
7. Check Insurance: Verify if the company's insurance policies cover cyber attacks and losses related to IT security.

Case Example: Ransomware on a Premium Domain

A company that had invested in a premium domain name, {example-name}.com, discovered they no longer had access to their registrar account. An email was received demanding 5 Bitcoin (approximately NOK 1.5 million at the time) to restore access. The attackers claimed to have "stolen" the domain and threatened to sell it at auction if payment was not made within 48 hours.

Response: The company did not comply with the payment demand. They immediately contacted the registrar, who confirmed unauthorised changes to the account information. Evidence of the phishing email, likely used by the attackers to obtain login details, was collected. Norid was contacted for advice. The police were notified, and after a thorough verification process of ownership, the registrar, with assistance from Norid, managed to restore control of the domain to the company after three days. The attackers were never identified, but a police report was filed.

Conclusion

Domain ransomware and extortion are serious threats that require attention from anyone who owns or invests in domain names. By implementing robust security measures and understanding legal rights and obligations, business owners and investors can significantly minimise risk. A swift and correct response in the event of an attack is crucial for limiting damage and regaining control. The Domain Broker School encourages everyone to take digital security seriously.