In the modern digital landscape, few threats are as pervasive, disruptive, and costly as ransomware. What began as a niche technical nuisance has evolved into an industrialized criminal enterprise, currently costing the global economy an estimated $75 billion per year. Astonishingly, only about $900 million of that staggering figure actually ends up in the hands of the hackers; the rest is lost to catastrophic business interruptions, regulatory fines, third-party liability litigation, and the immense costs of rebuilding compromised networks.
Navigating this treacherous environment requires far more than basic IT knowledge. It requires a profound understanding of cybersecurity policy, international relations, and the legal frameworks that govern data protection and national defense. As cyber warfare and digital extortion reshape global security, organizations are in desperate need of professionals who possess this elite, specialized knowledge.
Leading the Conversation: GW Law and the Lawfare Podcast
The George Washington University (GW) Law School is actively leading the national conversation on these critical vulnerabilities. This leadership was recently showcased on the Lawfare Podcast, where GW Law's own Professor Jonathan G. Cedarbaum sat down with Anja Shortland, a professor of political economy at King's College London, to discuss her new book, Dark Screens: Hackers and Heroes in the Shadowy World of Ransomware.
Their deeply insightful conversation not only illuminated the dark corners of digital extortion but also perfectly highlighted why modern professionals must acquire advanced cybersecurity policy knowledge to protect their organizations and their nation.
Meet Professor Jonathan G. Cedarbaum: A Practitioner-Scholar
Professor Jonathan G. Cedarbaum’s ability to dissect complex cybersecurity issues on the Lawfare podcast stems directly from his unparalleled career in the highest echelons of the U.S. government. Before joining the GW Law faculty in 2023 as a Professor of Practice for National Security, Cybersecurity, and Foreign Relations Law, he served as Deputy Counsel to the President and National Security Council Legal Advisor.
Professor Cedarbaum’s resume is a testament to GW Law's "practitioner-scholar" model. He spent years at the U.S. Department of Justice, where he served as the Acting Assistant Attorney General in charge of the Office of Legal Counsel (OLC)—the powerful office that provides authoritative legal advice to the President and all Executive Branch Departments. Furthermore, from 2015 to 2020, he served as one of the first statutorily designated amici for the Foreign Intelligence Surveillance Court (FISC) and its corresponding Court of Review, giving him a rare, insider’s perspective on the legalities of intelligence gathering and cybersecurity. When Cedarbaum questions the geopolitical and legal realities of ransomware, he does so with the authority of someone who has crafted national security policy from within the White House.
Decoding the "Shadowy World of Ransomware"
During the podcast episode, Professor Cedarbaum skillfully guides listeners through the prehistory and rapid evolution of ransomware. He notes that while hackers had developed methods to infiltrate and encrypt computer systems back in the 1980s and 1990s, it took several decades for these methods to mature into a truly effective, industrialized method of global extortion.
The Three Technical Pillars of the Ransomware Boom
Cedarbaum specifically asks Shortland to identify the crucial technical successes that allowed hackers to turn early ransomware into a major global threat. She identifies three essential breakthroughs that came together around 2013:
- Asymmetric Encryption: Hackers needed a virus that mutated to create a unique decryption key for every single victim, preventing victims from sharing a universal key.
- Secure Communication: Criminals needed to communicate with victims and negotiate ransoms without being tracked. Ironically, they utilized the Tor protocol—originally created by the U.S. Secret Service—to disguise their identities and host pseudonymous conversations on the dark web.
- Cryptocurrency: The final piece of the puzzle was finding a way to take massive payments safely. Cryptocurrencies allowed hackers to scale their operations and cash out without ever revealing their real-world identities.
The Industrialization of Extortion: Ransomware as a Service
A major focus of Cedarbaum’s inquiry is the emergence of "Ransomware as a Service" (RaaS), a business model that drastically accelerated the threat landscape. Clever coders who develop weapons-grade malware often do not have the time or skills to individually scam their way into corporate networks. Through RaaS, these developers lease their malware to less technically sophisticated "affiliates" who handle the actual breaking and entering.
Because the affiliates take on the most operational risk and are the most traceable, they take the lion's share of the profit—sometimes up to 90% of the ransom—while the automated malware takes care of the extortion process. This franchise-like model allowed cybercrime to explode on an industrial scale.
Case Studies in Chaos: REvil, Conti, and Global Vulnerability
Cedarbaum and Shortland’s conversation delves deeply into the operations of specific, highly sophisticated ransomware organizations. They discuss the group REvil, which targeted the "soft underbelly" of computer security by hacking Kaseya, a managed service provider. By compromising Kaseya's servers, REvil gained access to its clients, affecting roughly 1,500 companies in a single, spectacular supply-chain attack.
Cedarbaum also probes the operations of Conti, a pan-European crime group that was organized much like a traditional corporation, complete with a human resources department, coders, and reverse engineers. When internal fractures threatened to tear the group apart following the Russian invasion of Ukraine, Conti launched a devastating attack on the government of Costa Rica—specifically its Ministry of Finance—to create a massive global distraction while they quietly reconfigured their operations.
The Complexities of "Ransomware Settlement as a Service"
One of the most fascinating policy dilemmas Cedarbaum highlights in the interview is the rise of "ransomware settlement as a service". As businesses struggled to navigate the complex process of sourcing Bitcoin and negotiating with hackers, legitimate third-party companies stepped in to handle the recovery.
However, Cedarbaum points out the unfortunate consequences of this development. While outsourcing recovery helps individual victims, some of these entities operate as shady "payment mills". These mills promise to help victims avoid dealing directly with criminals, but in reality, they simply engage in what Shortland calls "jiggery pokery"—funneling the money back to the hackers anyway, while taking a cut for themselves. This dynamic ultimately makes it easier for criminals to speed up transactions and fund future attacks.
Why Policy and Preparation Are More Important Than "Silver Bullet" Solutions
Towards the end of the episode, the conversation shifts to how governments and the private sector can fight back. Cedarbaum brings up the Ransomware Task Force, a broad coalition that produced 48 comprehensive recommendations to defend against these threats.
Crucially, the task force realized that there is no single "silver bullet" to solve the crisis. For example, simply banning the payment of ransoms to eliminate the profit motive does not work in practice. As Shortland notes, when a hospital's intensive care unit goes offline or a company is facing total ruin, a legal commitment to never pay a ransom is simply not credible. Instead, the solution relies on strict cyber hygiene, multi-factor authentication, and robust resilience strategies, such as maintaining secure, offline backups, so organizations can refuse to pay.
The Urgent Need for Cybersecurity Policy Expertise
Professor Cedarbaum’s masterful interview underscores a vital reality: ransomware is not just a technical glitch; it is a complex geopolitical, legal, and economic crisis. The criminals launching these attacks operate across borders, exploit regulatory gray areas, and deliberately target critical national infrastructure.
To combat this, government agencies, defense contractors, and multinational corporations desperately need leaders who can bridge the gap between operational technology and legal strategy. They need professionals who understand how to navigate crisis management, coordinate with law enforcement, and interpret the intricate legalities of international cyber defense.
Bridging the Gap: The GW Law MSL in National Security and Cybersecurity Law
If you want to understand these high-stakes dynamics and become a leader in this critical field, you do not need to spend three years earning a Juris Doctor (JD) in order to become a full-on practicing attorney. Instead, the George Washington University Law School offers the perfect solution: the Master of Studies in Law (MSL) in National Security and Cybersecurity Law.
This one-year graduate degree is specifically designed for non-lawyer professionals with three or more years of experience who want to master the laws governing national security, cyber breaches, intelligence operations, and the protection of critical infrastructure. By enrolling in this program, you gain the opportunity to learn directly from "insider" experts like Professor Cedarbaum, who bring decades of high-level government and military experience into the virtual classroom.
The program requires just 24 credits and can be completed in one to two years. To accommodate the demanding schedules of working professionals, it is offered in 100% online, on-campus, and hybrid formats.
Take the Plunge and Advance Your Career
The era of ignoring the legal and policy implications of cybersecurity is over. Graduates of the GW Law MSL program step into high-impact, lucrative roles such as Cybersecurity Policy Advisors, Regulatory Analysts, and National Security Risk Officers, fully equipped to make fact-based, logical decisions that protect their organizations from catastrophic threats.
With tuition for the 2026-2027 academic year set at an approximate total of $65,760 (plus fees), the program offers an incredible return on investment compared to a traditional law degree.
Don't just listen to the conversations shaping the future of global security—become the expert who leads them. We invite you to take the plunge, secure your professional advantage, and apply today.