He’s not blaming the victims for getting attacked by ransomware. He’s blaming people who then pay the attackers. That’s a separate issue. People can be both victims and perpetrators of separate offenses, subject to criticism. I.e. being a victim of one thing does not render you blamless for all your subsequent actions.

Those who pay the attackers might have no other choice. Sure they should have taken backups. But right now they don't have any. What else can they do? Maybe government can enact laws asking to maintain backups regularly in critical industries.

> What else can they do?

They can take the hit and live without their data, thereby making the world safer for the rest of us. Focusing only on their own personal problem is the definition of selfishness.

Would you let your company that earns millions for a ransomware that is asking tens of thousands of dollars?

If your company that owns millions doesn't have a backup of the mission-critical data somewhere, you have a bigger problem.

No. In that moment your biggest problem is that all your data is inaccessible. That you don’t have backups reduces options since it precludes that solution, but another one exists: pay the ransom.

> Maybe government can enact laws asking to maintain backups regularly in critical industries.

That's a step in the right direction, but we need more.

If you're critial industry and get ransomwared there should be hefty fines for everyone involved from the top down.

Also there should be hefty fines for any data leaks that are a result of ransomware attacks.

Companies will start moving when getting ransomwared due to low security standards is a major impact on your financials and not like some "put 50k aside for data hostage situations".

Continuity is part of regulation in some industries, yes

“That’s victim blaming”

And?

In this case the victims are enabling a whole cottage industry of crime.

Ransomware won't stop even if you don't pay up. Just destroying the target by data loss can be a sufficient reason for any attacker. No payment needed.

This is wildly incorrect. For criminal groups who intend on making money, that payment is needed on a certain subset of victims are they can’t stay in business.

I am a shady company who wants to take down a competitor. I can hire a hacker who'll do the dirty job for me and then get paid in cold hard cash. Or a nation state actor can decide to attack an enemy country's infrastructure.

So? If their goal is destruction what does that have to do with ransomware? They can do that whether paying the ransom is legal or not.

Deception? It can confuse the target about the motives of the attack.

So they were going to destroy data anyway, so this isn’t what outlawing ransom payments is meant prevent because it can’t. It will prevent ransomware for profit if no one pays.