Your town may soon budget for ransom like it budgets for road salt

Under a budget template circulating among small-town finance officers, a municipality could in future carry a permanent line for ransomware incidents, sitting in the accounts between winter road maintenance and street lighting. The question before the council would not be whether such a line should exist. By the time it reached the chamber, the argument would be about the unit price.

The defence of the line would be word for word the defence of road salt. In any given year the town may not need it. Across a decade it certainly will, and provisioning in advance is cheaper than improvising at two in the morning with somebody who knows exactly how the conversation ends. It is the same argument councils already make about the gritting lorry, in a building that acquired a salt store long before it acquired a server.

“We would not be budgeting for a crime,” the mayor would be expected to say at the second reading. “We would be budgeting for a Tuesday. The registry stops working, the water company cannot read its meters, and two hundred people cannot file a birth certificate. I am obliged to have a number for that. I would rather the number sat in the budget than in a phone call.”

The line would not survive under that name. Several jurisdictions are moving to forbid public bodies from paying at all, and the template deals with this in a footnote: the item would continue as a recovery reserve, covering system restoration, legal advice, negotiation support and the letters that have to go to every resident whose file was copied. Most of the money goes there in any case. Only the label would be contested.

Insurance would complicate the arithmetic rather than simplify it. Cover would be available, conditional on a questionnaire the town clerk would have to answer honestly, including the question about whether remote access to the waterworks requires a second factor. In many towns the honest answer is not a tick but a sentence, and the quotation would arrive accordingly.

The comparison with salt would break down at the least comforting point. The salt has a store, a lorry and a man who has driven it for nineteen years. The other risk has an IT contract shared with two neighbouring villages, an access list nobody has audited since the last election, and a helpdesk number answered in office hours by somebody excellent and alone.

Nothing has been adopted: a template, a footnote and a working group of finance officers. But the significant part is not the attack. It is the line. A risk that acquires a permanent budget line stops being an emergency and becomes a municipal service — priced, argued over, and quietly assumed to recur.