SA’s ransomware problem is hiding a much bigger issue

South Africa faces a significant cyber security issue that goes beyond mere criminal activity. Recent incidents, such as a ransomware attack on Cartrack and other organizations, suggest that the country's cyber problem may not be solely due to crime. Nathan-Ross Adams, founder of ITLawCo and Sateci, points out that the hard question is whether South Africa can differentiate between ordinary cybercrime and strategic operations when the evidence starts to overlap.

The incidents involve various organizations, including Cartrack, EasyEquities, Satrix, RelyComply, and Air Traffic and Navigation Services. While many believe these incidents were committed by the double-extortion ransomware crew, Dire Wolf, the public record appears to fit more with ordinary extortion than statecraft. However, it remains uncertain whether these incidents are part of a campaign or simply a run of cybercrime.

South Africa's cyber security challenge is further complicated by the fact that many of the victims' data may be stored on servers located in foreign-controlled hubs. This raises questions about the country's exposure to strategic operations conducted through these hubs. Attribution is crucial in determining whether a state is responsible for any present incident, but it is not an easy task. The evidence may overlap between ordinary cybercrime and strategic operations, making it difficult to distinguish between the two.

Ultimately, the issue lies not in attributing the incidents to a specific state but in determining whether South Africa can recognize and respond to a strategic operation when it occurs. The country must develop the capacity to differentiate between cybercrime and strategic operations, even if the evidence is not always clear-cut.