Arguments Against Criminalizing Ransomware Payments

The goal is to effectively end ransomware as a significant cybersecurity risk for everyone. In exploring the different strategic options, one path has emerged superior, in which the flow of money to the ransomware attackers is essentially stopped. The only way to make that happen consistently is to compel the victims to not pay by making it a criminal act. However, not everyone agrees.
In my discussions with many experts across a range of disciplines, the same arguments would emerge and be debated. This is an exhaustive list of those arguments and the discussions that continue to support the premise that criminalizing ransomware payments is the best option.

In this video I discuss and address the most common arguments against criminalizing ransomware payments, in the hope we can come to a consensus for what may be the best path forward to end ransomware.

Arguments:
11:03 #1 – Not possible to enact such a law
12:48 #2 – Can’t enforce such a law
19:12 #3 – Won’t seriously restrict the flow of money to the cybercriminals
22:31 #4 – Not be effective in reducing the risks
25:42 #5 – It should be the victim’s choice to pay, as it is their business and money
28:58 #6 – Would force some victims out of business
33:36 #7 – Unfair to SMB’s, who can’t afford security
35:50 #8 – Removes a critical option for organizations, necessary to stay in business
39:00 #9 – Would create too great a national/regional impact for critical systems down for extended periods
43:18 #10 – Building better security mitigation capabilities
47:16 #11 – Outlawing cryptocurrency
52:04 #12 – A partial ban on payments or ‘special circumstances’ allowing payment as a compromise
54:38 #13 – Improving law enforcement capabilities to catch the attackers
58:32 #14 – Employing the military to protect everyone from attacks

We must act. Ransomware will not go away on its own and the cybersecurity products and services have been unable to curb the massive growth of this problem.

We must select the best strategic solution, that meets the clear success criteria, and move to implement as quickly as possible to reverse the growing impacts of ransomware.
Ransomware Explained Series:

• End Ransomware by Criminalizing Ransomware Payments: https://www.youtube.com/watch?v=7AlMdkaL6II
• Understanding the Attackers: https://www.youtube.com/watch?v=n2gGq26fgxA
• Success Criteria for Ending Ransomware: https://www.youtube.com/watch?v=aeqAeTUnyeo
• Demotivating Ransomware Attackers by Ending Ransom Payments: https://www.youtube.com/watch?v=E8bpG6zl7Xg