>Not to mention every law should first be measured on whether it is at all practical to meaningfully enforce. I guarantee there has been 100x more companies who've paid the ransom and didn't release a press release like this one did.

Let's say you're the in C-suite of a hospital that's held for $1M ransom, and you want to pay. How are you going to send the funds without someone in finance/accounting finding out? Maybe you try to convince them to keep quiet? Such a transaction will almost surely generate a suspicious activity report from the bank. Are you going to try structuring the transaction? How are you going to hide that $1M defect in your quarterly/annual reports? Are you just going to hope it doesn't get noticed by the IRS or the accountants auditing your report? The whole thing is going to unravel because of how many people you need to be "in" on the criminal conspiracy, and the amount of noise it generates. If you're caught, the amount of papertrail you left behind (from literally every step of paying the ransom) would make it very easy to prosecute.

You could try laundering your activities to a third party firm that does "ransomware recovery" (ie. they take your money and pay the ransom for you), but I'd imagine that if paying ransoms were illegal, the activities of those companies would be closely scrutinized.

The idea behind not paying is that it makes ransomware unprofitable and people stop doing it. A loophole for saving lives would cause ransomware distributers to target their attacks in ways that endanger lives.

It wouldn't need to work that way. If a law was past mandating that in 5 years paying ransoms would be illegal then companies would be forced to either invest or be held liable after that grace period.

Of course there could be an exception process that involves contacting LE first, paying the ransom, being fined and audited, and having to disclose a report online and in front of the entrances of the when, why, and how this occurred. Paying the ransom w/o going through this process could (maybe?) be treated as conspiring with the attacker (& since the identities of the attackers are almost always 100% unknown, some could legitimately have inside contacts anyway).

You're saving lives now but endangering future lives.

If no one paid the ransom, ransomware wouldn't exist. the more people who pay the ransom, the more incentive attackers have to create ransomware.

> If no one paid the ransom, ransomware wouldn't exist

Even if we made it illegal, it doesn't mean people wouldn't pay them. It would just punish victims further.

Put another way, which would you rather do, indirectly kill people or break the law? This is the decision a hospital administrator would be faced with. I suspect that most people would see fit to disobey the law in this situation. It could easily be argued to be a legitimate case of civil disobedience.

I work in this space. Its probably not a matter of kill people, doctors in ER's don't really need a EHR to function and sometimes do without due to technical issues. The issue is that the hospital won't be able to bill without documentation.

> If no one paid the ransom, ransomware wouldn't exist

I guess you didn't read the second half of my comment where I suggest that will likely be idealistic and unreleastic.

Enough companies will still pay quietly to keep it going. I'd be shocked if they didn't.

If an individual is attacked, sure.

If you're attacking a public institution like a hospital and demanding many thousands of dollars... it's pretty hard to hide a payment like that. So if you outlawed paying such ransoms, those types of ransoms would stop.

Individuals would still be attacked and asked to pay a few hundred dollars, but such instances rarely put lives at stake.

Look at th health insurance industry and tell me a hospital can't sneak out a $50000 payment.

Governor Rick Scott of Florida stole a Billion dollars from Medicaid before he got caught.

> If no one paid the ransom, ransomware wouldn't exist

Even if we made it illegal, it doesn't mean people wouldn't pay them.

What if the malware changes a medical record (maliciously or accidentally), and the discrepancy leads to a lost life? Seems strange to hang lives on the word of criminals, if lives are really at stake.

Set a threshold where payments above that amount are illegal. Even a threshold at say, 25k or above will reduce the incentive to attack individual systems, and payments of that size are difficult to hide if everyone knows they're illegal.