In general paying off kidnappers is also a bad policy. However I see a huge difference between protecting human lives versus protecting corporate assets.

Ok, and now a hospital with critical medical information gets hit by the ransom. What then?

Well in the case of UCSF, they paid $1.14M[1].

But really, I expect such a law would provide for exceptions, with a maximum payout capability. And for such a law to come after an offsite airgap backup requirement for such entities.

But really, the answer is that the equivalent physical criminal action: walking into a hospital and absconding with all of their medical records, would result in criminal action against the thief. Their actions may be akin to manslaughter if deaths result.

[1]: https://www.ucsf.edu/news/2020/06/417911/update-it-security-...

What's the difference?

Cut deeply enough - take out entire companies - and people lose their jobs.

People can't eat. People lose their health insurance that allows them to afford their life-saving medication.

At some point, it's not just "big corporations"; it's the people that work for them, too.

"People lose their health insurance that allows them to afford their life-saving medication."

Only in one country on the planet.

Job loss is not the equivalent of death. Full stop.

Tell that to a family where both parents are unemployed, they got 2-3 kids, a mortgage, a couple of maxed credit cards, they used to live paycheck-to-paycheck, one of the kids needs special care that the state doesn't provide due to budget cuts.

Now take this scenario to every major financial crisis (e.g. USA today, Latin America for the past couple of decades, some EU countries hit 20-30% unemployment a decade ago, and are still recovering).

It won't kill them instantly but consider what it does to them, if it turns them to crime, alcoholism, depression, and the general impact on the quality of life.

That’s an incredibly naive way of viewing things. Not everyone can afford losing their job. Let’s say job loss increases your chance of dying by 5% — not an exaggeration in some communities — 20 jobs lost is exactly the same as one death.

There's a very specific value of human life: https://www.npr.org/transcripts/835571843

Reading "Never Split The Difference" - sounds like the police will work with families pay off kidnappers is some countries, but get it down from millions to a token amount. I think he aims for zero though most of the time.

I liked the part about delaying the negotiations until Friday in (I think) Haiti, because they realised a lot of kidnappers just wanted money to blow partying on the weekend. They got away with paying a lot less.

Police/authorities want to do that because (perhaps) there is a connection between crime and terrorism. Meaning that, if you pay $100m to the kidnapper, 50% of that amount will end up funding <insert terrorist org>. They want to drain this to the lowest possible amount.

It seems to be a necessary part of the strategy though as the negotiation also helps to delay and buy time for escape/rescue.

They sometimes paid the amount. In some countries that was probably seen as a better plan. It probably depends how loose the cannons are.

> "However I see a huge difference between protecting human lives versus protecting corporate assets."

The idea that there are fundamental differences between human lives and corporate assets is flawed. There's a very specific value of human life: https://www.npr.org/transcripts/835571843

The value of human life is orthogonal to economic value, and doesn't follow the same rules. It works like fine art. The price of art doesn't move towards a final value; paintings bought and sold for centuries still appreciate faster than inflation. They aren't getting any better, the only thing that's changing is the amount of money people have to spend on paintings.

Human life appreciates the same way. In some number of years the government will decide that the economy can sustain valuing human life at a trillion dollars. And they'll look back at us and see that we undervalued life in the same way that we can look back and see that the Romans undervalued human life. Lives are worth whatever we can afford.

> Wrong

They said they saw a difference.

They didn’t say other people didn’t see a difference.

>"They said they saw a difference."

Which would be the point, that there are no fundamental differences between corporate assets and human lives.

If I say I like cats, and you find an article saying someone else doesn’t like cats, that does not mean I’m mistaken on the fact that I like cats.

You seem to think they said that ‘everyone sees a difference’. They didn’t. They said ‘I see a difference’. They’re only ‘wrong’ about that if you think they’re lying to us about their own personal position.

I edited my original comment to now say "The idea that there are fundamental differences between human lives and corporate assets is flawed."

Thank you for your logic lesson but I fail to see how this changes the discussion.

The main idea here is that prohibiting payouts might make the crime less frequent. That’s somehow reasonable given the relative low stakes involved—from a moral perspective, data is usually of a lesser value than human lives. Therefore, yes, those cases are very different indeed. For once, kidnapping a human being is already punishable enough by itself so it makes no sense to punish a payout that could actually save a live.

The only reason the kidnappings happen is because the payouts happen. If effective measures stopped any real possibility of payouts, the kidnappings would stop, too, saving a lot more lives.

Possibly. The previous argument stand either way.

Not the OP but I think it is clearly different, as kidnappers are putting someone's life in danger.