Ransomware and Federal Law: Cybercrime and Cybersecurity

"Ransomware attacks—the use of malicious software to deny users access to data and information systems to extort ransom payments from victims—are prevalent. A recent notable example is the May 2021 ransomware attack that temporarily shut down the Colonial Pipeline Company’s network, affecting gasoline availability and prices. This attack is but one of many; in 2020 alone, the Federal Bureau of Investigation (FBI) received nearly 2,500 ransomware complaints with losses exceeding $29 million.

Federal law provides several potential approaches to combat ransomware attacks. First, federal criminal laws, such as the Computer Fraud and Abuse Act (CFAA), can be used to prosecute those who perpetrate ransomware attacks. These laws and others, such as the statutes criminalizing conspiracy and aiding and abetting, might also be used to prosecute individuals who help to develop ransomware that is ultimately used by others. Victims who pay ransoms might also be subject to criminal or civil penalties in some cases—for example, where a ransom payment is made knowingly to an entity either designated as a foreign terrorist organization or subject to sanctions by the Department of the Treasury. Nevertheless, policy considerations, mitigating factors, and prosecutorial discretion may weigh against enforcement in such instances.

Second, federal cybersecurity laws play an important role in both preventing and responding to ransomware attacks. Cyber preparedness laws require federal agencies to secure their networks and authorize the Cybersecurity and Infrastructure Security Agency (CISA) and Office of Personnel Management (OPM) to establish federal network security requirements. Other cyber preparedness laws authorize federal agencies to assist private entities operating in critical infrastructure sectors in securing their systems. Moreover, many data protection laws include requirements for covered entities to safeguard customer or consumer data. If a ransomware attack or other cyber incident occurs, federal law requires CISA and other federal agencies to work together to mitigate harm to federal networks and authorizes them to assist private entities in incident response and damage mitigation.."
Ransomware 

Guide to Law Online

"The Guide to Law Online, prepared by the Law Library of Congress Public Services Division, is an annotated guide to sources of information on government and law available online. It includes selected links to useful and reliable sites for legal information..."
Online law resource

Authority of State and Local Police to Enforce Federal Immigration Law
"The power to prescribe rules as to which aliens may enter the United States and which aliens may
be removed resides solely with the federal government, and in particular with Congress.
Concomitant to its exclusive power to establish rules which determine which aliens may enter and
which may stay in the country, the federal government also has the power to sanction activities
that subvert this system. Congress has defined our nation’s immigration laws in the Immigration
and Nationality Act (INA), a comprehensive set of rules for legal immigration, naturalization,
work authorization, and the entry and removal of aliens. These requirements are bolstered by an
enforcement regime containing both civil and criminal provisions. Deportation and associated
administrative processes related to the removal of aliens are civil in nature, while certain
violations of federal immigration law, such as smuggling unauthorized aliens into the country,
carry criminal penalties.

Congressional authority to prescribe rules on immigration does not necessarily imply exclusive
authority to enforce those rules. In certain circumstances, Congress has expressly authorized
states and localities to assist in enforcing federal immigration law. Moreover, there is a notion that has been articulated in some federal courts and by the executive branch that states may possess “inherent” authority to assist in the enforcement of federal immigration law, even in the absence of clear authorization by federal statute. Nonetheless, states may be precluded from taking actions that are otherwise within their authority if federal law would thereby be thwarted..."