I would sooner have security negligence be criminalized as there are a number of products that are critical to the economy and peoples health. Having a companies systems get wiped out can have a monumental amount of collateral damage.

Paying Ransoms should be criminalized as there is far more damage from allowing this to continue then having a few systems wiped and restored from backups.

Not taking steps to have cybersecurity in companies should be criminalized as well... I am a CEO and thinks CEO's should be held directly criminally responsible for this.

Finally, any nation that allows hackers to operate from within their borders should be subject to 100x over damages caused sanctions. Countries without strong governments to enforce this should have direct airstrikes conducted against the individual hackers.

If you think the 100X damages is overkill please reconsider within this framework:

Any nation that harbors international terrorists by not at least attempting to hold them accountable is implicitly operating an outsourced covert activities team. The actions of any such team should be considered representative of that country and thus this would be an act of guerilla warfare.

Nukem from orbit, it's the only way to be sure.

I’ll go to prison for some time for being their new CFO. If some cash goes to myself or a close family member after I pay the ransomware as CCO.

Obviously this would be too transparent if done in the span of a week.

To be fair, that was Iranian money in the first place that had been frozen.

It was still a ransom. “I’ll give you money, you release our hostages.”

"I'll give you [back your] money, you release our hostages" -- but that doesn't fit the agenda as well, does it?