The FBI urges affected businesses not to pay, but the ransoms may be tax deductible.<\/b>
\nWASHINGTON \u2014 As ransomware attacks surge, the FBI is doubling down on its guidance to affected businesses: Don\u2019t pay the cybercriminals. But the U.S. government also offers a little-noticed incentive for those who do pay: The ransoms may be tax deductible. The IRS offers no formal guidance on ransomware payments, but multiple tax experts interviewed by The Associated Press said deductions are usually allowed under law and established guidance. It\u2019s a \u201csilver lining\u201d to ransomware victims, as some tax lawyers and accountants put it. But those looking to discourage payments are less sanguine. They fear the deduction is a potentially problematic incentive that could entice businesses to pay ransoms against the advice of law enforcement. At a minimum, they say, the deductibility sends a discordant message to businesses under duress. \u201cIt seems a little incongruous to me,\u201d said New York Rep. John Katko, the top Republican on the House Committee on Homeland Security. Deductibility is a piece of a bigger quandary stemming from the rise in ransomware attacks, in which cybercriminals scramble computer data and demand payment for unlocking the files. The government doesn\u2019t want payments that fund criminal gangs and could encourage more attacks. But failing to pay can have devastating consequences for businesses and potentially for the economy overall. A ransomware attack on Colonial Pipeline last month led to gas shortages in parts of the United States. The company, which transports about 45% of fuel consumed on the East Coast, paid a ransom of 75 bitcoin \u2013 then valued at roughly $4.4 million. An attack on JBS SA, the world\u2019s largest meat processing company, threatened to disrupt food supplies. The company said it had paid the equivalent of $11 million to hackers who broke into its computer system. Ransomware has become a multibillion-dollar business, and the average payment was more than $310,000 last year, up 171 percent from 2019, according to Palo Alto Networks. The companies that pay ransomware demands directly are well within their rights to claim a deduction, tax experts said. To be tax deductible, businesses expenses should be considered ordinary and necessary. Companies have long been able to deduct losses from more traditional crimes, such as robbery or embezzlement, and experts say ransomware payments are usually valid, too. \u201cI would counsel a client to take a deduction for it,\u201d says Scott Harty, a corporate tax attorney with Alston & Bird. \u201cIt fits the definition of an ordinary and necessary expense.\u201d Don Williamson, a tax professor at the Kogod School of Business at American University, wrote a paper about the tax consequences of ransomware payments in 2017. Since then, he said, the rise of ransomware attacks has only strengthened the case for the IRS to allow ransomware payments as tax deductions. \u201cIt\u2019s becoming more common, so therefore it becomes more ordinary,\u201d he said. That\u2019s all the more reason, critics say, to disallow ransomware payments as tax deductions. \u201cThe cheaper we make it to pay that ransom, then the more incentives we\u2019re creating for companies to pay, and the more incentives we\u2019re creating for companies to pay, the more incentive we\u2019re creating for criminals to continue,\u201d said Josephine Wolff, a cybersecurity policy professor at the Fletcher School of Tufts University. For years, ransomware was more of an economic nuisance than a major national threat. But attacks launched by foreign cybergangs out of reach of U.S. law enforcement have proliferated in scale over the past year and thrust the problem of ransomware onto the front pages. In response, top U.S. law enforcement officials have urged companies not to meet ransomware demands. \u201cIt is our policy, it is our guidance, from the FBI, that companies should not pay the ransom for a number of reasons,\u201d FBI Director Christopher Wray testified this month before Congress. That message was echoed at another hearing this week by Eric Goldstein, a top official at the Department of Homeland Security\u2019s Cybersecurity & Infrastructure Security Agency. Officials warn that payments lead to more ransomware attacks. \u201cWe\u2019re in this boat we\u2019re in now because over the last several years people have paid the ransom,\u201d Stephen Nix, assistant to the special agent in charge at the U.S. Secret Service, said at a recent summit on cybersecurity. It\u2019s unclear how many companies that pay ransomware payments avail themselves of the tax deductions. When asked at a congressional hearing whether the company would pursue a tax deduction for the payment, Colonial CEO Joseph Blount said he was unaware that was a possibility. \u201cGreat question. I had no idea about that. Not aware of that at all,\u201d he said. There are limits to the deduction. If the loss to the company is covered by cyber insurance \u2013 something that also is becoming more common \u2013 the company can\u2019t take a deduction for the payment that\u2019s made by the insurer. The number of active cyber insurance policies jumped from 2.2 million to 3.6 million from 2016 to 2019, a 60 percent increase, according to a new report from the Government Accountability Office, Congress\u2019 auditing arm. Linked to that was a 50 percent increase in insurance premiums paid, from $2.1 billion to $3.1 billion. The Biden administration has pledged to make curbing ransomware a priority in the wake of a series of high-profile intrusions and said it is reviewing the U.S. government\u2019s policies related to ransomware. It has not provided any detail about what changes, if any, it may make related to the tax deductibility of ransomware. \u201cThe IRS is aware of this and looking into it,\u201d said IRS spokesperson Robyn Walker. Success. Please wait for the page to reload. If the page does not reload within 5 seconds, please refresh the page. Enter your email and password to access comments. Forgot Password? Don’t have a Talk profile? Create one. Invalid username\/password. Please check your email to confirm and complete your registration. Create a commenting profile by providing an email address, password and display name. You will receive an email to complete the registration. Please note the display name will appear on screen when you participate. Already registered? Log in to join the discussion. Only subscribers are eligible to post comments. Please subscribe or login to participate in the conversation. Here\u2019s why. Use the form below to reset your password. When you’ve submitted your account email, we will send an email with a reset code. Send questions\/comments to the editors.<\/p>\n