Old Dominion University ODU Digital Commons Graduate Program in International Studies Theses & Dissertations Graduate Program in International Studies Spring 2021 Cybersecurity Legislation and Ransomware Attacks in the United States, 2015-2019 Joseph Skertic Old Dominion University, [email protected] Follow this and additional works at: https://digitalcommons.odu.edu/gpis_etds Part of the Information Security Commons, and the International Relations Commons Recommended Citation Skertic, Joseph. "Cybersecurity Legislation and Ransomware Attacks in the United States, 2015-2019" (2021). Doctor of Philosophy (PhD), Dissertation, International Studies, Old Dominion University, DOI: 10.25777/c0vq-t159 https://digitalcommons.odu.edu/gpis_etds/134 This Dissertation is brought to you for free and open access by the Graduate Program in International Studies at ODU Digital Commons. It has been accepted for inclusion in Graduate Program in International Studies Theses & Dissertations by an authorized administrator of ODU Digital Commons. For more information, please contact [email protected]. CYBERSECURITY LEGISLATION AND RANSOMWARE ATTACKS IN THE UNITED STATES, 2015-2019 by Joseph Skertic B.A. December 2009, Christopher Newport University M.A. May 2012, Regent University A Dissertation Submitted to the Faculty of Old Dominion University in Partial Fulfillment of the Requirements for the Degree of DOCTOR OF PHILOSOPHY INTERNATIONAL STUDIES OLD DOMINION UNIVERSITY May 2021 Approved By: Matthew DiLorenzo (Director) Joshua Zingher (Member) Hongyi Wu (Member) ABSTRACT CYBERSECURITY LEGISLATION AND RANSOMWARE ATTACKS IN THE UNITED STATES, 2015-2019 Joseph Skertic Old Dominion University, 2021 Director: Dr. Matthew DiLorenzo Ransomware has rapidly emerged as a cyber threat which costs the global economy billions of dollars a year. Since 2015, ransomware criminals have increasingly targeted state and local government institutions. These institutions provide critical infrastructure – e.g., emergency services, water, and tax collection – yet they often operate using outdated technology due to limited budgets. This vulnerability makes state and local institutions prime targets for ransomware attacks. Many states have begun to realize the growing threat from ransomware and other cyber threats and have responded through legislative action. When and how is this legislation effective in preventing ransomware attacks? This dissertation investigates the effects of state cybersecurity legislation on the number of ransomware attacks on state and local institutions from 2015-2019. I review various arguments linking cybersecurity legislation to cybersecurity vulnerability and develop a set of hypotheses about the features of legislation that should deter and prevent ransomware attacks. The cybersecurity literature suggests increased training is a key mechanism to prevent ransomware attacks. However, I find no relationship between direct state legislation on cybersecurity training and ransomware. Instead, the statistical evidence suggests that there are fewer ransomware attacks in states with legislation that indirectly encourages training by shifting the responsibility for a cyber failure back onto vulnerable institutions. This legislation typically focuses on data breaches and often requires the institution to disclose failures, which increases reputational costs. The threat of increased costs for a cybersecurity failure changes these institutions’ cost benefit analysis and encourages these institutions to proactively improve their cybersecurity, such as through increased training. I further examine data breach laws in California and find evidence that these types of laws can promote increased cybersecurity measures. Thus, future legislation should focus on holding institutions responsible for cybersecurity failures, which should in turn lead to increased cybersecurity. iv Copyright, 2021, by Joseph Skertic, All Rights Reserved. v This dissertation is dedicated to my family: To my Grandparents – Grandma Jean and Grandpa Al and Grandma and Grandpa Skertic – their love and support encouraged me to pursue my passion for learning. To my Mom who taught me to patience and compassion, as well as, made me apply to college. To my Dad who helped me write my first paper and taught me how to succeed through hard work and service to others. To my Wife, Elizabeth, who helped improve my writing by editing my papers and who put up with many last minute, late night papers over the years. And finally, to my two Sons, Liam and Luke, who bring me more joy than they will know and who I hope will one day be inspired by this accomplishment to pursue their passions. vi ACKNOWLEDGEMENTS Many people have helped and contributed to my successful completion of this dissertation. I would like to extend the greatest thanks to Dr. Matthew DiLorenzo, who served as my dissertation chair for this project. His sharp advice, fast turn around, and guidance helped me take my scattered ideas and form them into an achievable and meaningful project. I would also like to extend sincere thanks to Dr. Joshua Zingher and Dr. Hongyi Wu for serving on my committee and providing valuable feedback on this project. vii TABLE OF CONTENTS Page LIST OF TABLES ......................................................................................................................... ix LIST OF FIGURES .........................................................................................................................x Chapter I. INTRODUCTION ...............................................................................................................1 ARGUMENT AND APPROACH ...........................................................................4 STUDY CONTEXT .................................................................................................9 OUTLINE ..............................................................................................................15 II. LITERATURE REVIEW ..................................................................................................17 DEFINING CYBERCRIME ..................................................................................17 BRIEF HISTORY OF CYBERCRIME .................................................................20 BRIEF HISTORY OF CYBERSECURITY LEGISLATION IN THE US ...............................................27 EFFECTIVENESS OF CYBERSECURITY LEGISLATION .............................41 III. UNDERSTANDING RANSOMWARE AND AN EFFECTIVE COUNTERSTRATEGY .......................................................................49 DEFINITION OF RANSOMWARE .....................................................................49 HISTORY OF RANSOMWARE 1989-2010 ........................................................50 HISTORY OF RANSOMWARE 2011-2020 ........................................................54 RANSOMWARE STRATEGY .............................................................................61 COUNTERSTRATEGY ........................................................................................67 IV. STATE CYBERSECURITY LEGISLATION TRENDS .................................................72 BACKGROUND OF THE NCSL .........................................................................72 ELECTION LEGISLATION .................................................................................79 BREACHES LEGISLATION ...............................................................................81 INSURANCE LEGISLATION .............................................................................83 CRIME LEGISLATION ........................................................................................86 TRAINING LEGISLATION .................................................................................89 CONCLUSION ......................................................................................................92 V. DATA, METHODOLOGY, RESULTS, AND ANALYSIS .............................................94 DATA ....................................................................................................................94 METHODOLOGY AND RESULTS ..................................................................103 ANALYSIS ..........................................................................................................111 viii Chapter Page VI. CASE STUDY: BREACHES LEGISLATION ...............................................................115 THEORETICAL UNDERPINNINGS OF BREACHES LEGISLATION .............................................................................115 CALIFORNIA’S BREACHES LEGISLATION .................................................117 RESULTS OF BREACHES LEGISLATION .....................................................119 VII. CONCLUSION ................................................................................................................123 SUMMARY OF FINDINGS ...............................................................................123 POLICY RECOMMENDATIONS .....................................................................125 FINAL CONSIDERATIONS ..............................................................................129 WORKS CITED ..........................................................................................................................133 VITA ............................................................................................................................................145 ix LIST OF TABLES Table Page 3.1 Ransomware