From the Introduction: "This report explores legal issues implicated by two potential approaches to combatting ransomware. First, the report summarizes the potential for criminal prosecution under federal statutes such as the Computer Fraud and Abuse Act (CFAA) and the Economic Espionage Act (EEA). This section of the report also discusses legal issues facing ransomware victims--in particular, whether victims risk legal liability by making ransomware payments. Second, the report summarizes federal laws governing public and private sector cybersecurity, including preparedness and incident response. This report does not cover technological and policy considerations involving ransomware, as these topics may be found in other CRS [Congressional Research Service] products."
CRS Report for Congress, R46932
Congressional Research Service: https://crsreports.congress.gov/