Internal memo: DOJ has formed a taskforce to combat the proliferation of ransomware attacks, targeting the entire ecosystem with prosecutions and more
After ‘worst year ever’ for the cyberattacks, department seeks to disrupt digital ecosystem that supports them Tweets: @ericgeller , @kevincollier , and @dnvolz Tweets: Eric Geller / @ericgeller : DOJ is forming a ransomware task force, led by former NSD chief and now principal associate DAG John Carlin, to find new ways to disrupt an ecosystem that has quickly become of the most pressing cybersecurity challenges. But can it find any new solutions? https://www.wsj.com/... https://twitter.com/... Kevin Collier / @kevincollier : Very curious where this will go. The US government's current response to ransomware is largely the FBI and USSS investigating Russian criminals they can't touch. Just keep building and building cases, hoping the bad guys will forget and vacation in Spain. https://www.wsj.com/... Dustin Volz / @dnvolz : New: The Biden Justice Department has formed a new task force overseen by John Carlin aimed at breaking the back of the digital ecosystem of ransomware attacks. Among other things it will work to identify links between criminal gangs and nation-states. https://www.wsj.com/...
Context & Ripple Effects
The DOJ's new ransomware task force, led by former NSD chief John Carlin, arrives after what the department calls the worst year ever for the attacks — a year that saw ransomware complete its shift from many small consumer payments to a few massive corporate targets, as Wired documented at the close of 2020. The memo's framing is the tell: instead of prosecuting individual hackers one case at a time, the task force aims at the entire supporting ecosystem — the affiliates, cash-out networks, and infrastructure that let gangs scale.
The move landed amid a crowded response field: weeks later a separate task force of 60+ experts from industry, government, nonprofits, and academia called on the US and allies to act against the surge (that expert panel's recommendations), and by early June the DOJ had formally elevated ransomware investigations to a terrorism-level priority following the Colonial Pipeline hack (the department's own escalation). The through-line is that Washington stopped treating ransomware as a cybercrime backlog and started treating it as an organized economy.
First-order effects
- Under Carlin, NSD inherits a mandate to map the ransomware supply chain — gang-to-nation-state links included — meaning prosecutions will increasingly name enablers like payment processors and hosting providers rather than only affiliate hackers.
Second-order effects
- With gangs running multi-million-dollar operations at global scale, the obsolescence of 'just patch' advice pushes the practical burden onto coordinated disruption — forcing closer DOJ-FBI-private sector information sharing and pressuring allied governments where gangs are hosted to cooperate.
Third-order effects
- If ecosystem targeting becomes doctrine, ransomware enforcement converges with counterterrorism methods — financial-network takedowns, sanctions on facilitators, and sustained pressure on safe-haven jurisdictions — restructuring how cybercrime is policed from episodic arrests to continuous disruption campaigns.
The trend: US ransomware policy is shifting from case-by-case prosecution of individual attackers to whole-of-ecosystem disruption of the criminal economy that supports them.