I'd make it a crime punishable by prison in proportion to the amount paid, or perhaps require a multiple of the amount paid as a fine. If you need to pay 10X the ransom as a fine, then the ransom criminals can extract goes down by a factor of 10.

I’d be ok with it only if the ceo and the board are the ones going to prison and there’s a minimum mandatory sentence of (at least) one year with no possibility of parole or commutation or anything like that.

To what avail? CEOs regularly make much worse decisions that create much more grave externalities (example - oil spills). There's much bigger fish to fry than for-profit hospital systems....

No offense, but this proposal is essentially DOA.

Creating oil spills isn't illegal and can't be if you want to get oil. Different scenarios.

As for size of fish, we don't go "why is theft illegal when there are murderers still roaming around?" We can have both be illegal.

My point is that we very rarely give criminal sentences to corporate executives in the US. This seems like an odd one to start with.

That just sounds punitive. The goal here is to deter ransoms and ultimately reduce the incentive for ransomware, not to be punitive.

For conversation's sake, what if the victim is a small/mid-size business where the entire business would be destroyed in the event their systems are not unlocked immediately? Do they choose between possible prison time or definite loss of everything?

Enforcing a fine relative to the ransom paid (and maybe relative to the "if we wouldn't have paid it" severity) is probably a good immediate start. This would at least galvanize businesses to improve existing security.

Small businesses would have been destroyed by all sorts of rules that have already been passed. Companies whose entire service was dumping asbestos in to lakes or companies who only managed to turn a profit by hiring child labour. Their owners had to choose between possible jail time or losing everything.

Every single thing done by a government, or really just any large player in the market place, is going to have small businesses that get flattened by it. That your entire company could be wiped out by changes in the marketplace, including laws, is one of the risks a person assumes when they decide to start a small business instead of working as an employee. They're earning their slice of the money pie in part by assuming that risk.

But doesn't eliminate hackers who do this type of stuff for the "lulz" (and if anything, makes it worse and potential a weapon for people who want to promote larger government). I understand the general premise of the proposal, but it's not a fool-proof check on game theory.

It doesn't completely solve the problem, no.

But the stories of hospitals and other entities paying non-trivial sums in ransom I would expect are mostly professional criminals, not hackers doing it for lulz.

Can you prove you didn't pay?