It is acceptable for you, since you won't suffer the consequences, the burden of damage isn't on you.
It is similar to consuming drugs: when people buy meth they're helping the drug dealers. But they just can't help it, they're desperate.
Despair is above reason. Laws are useless to stop desperate actions.
Upwards. Second order effects of schemes like prohibition are much worse than the original problems.
It's also not quite analogous to the ransomware prohibition, because it's more akin to a prisoner's dilemma, and there's no inherent desire to pay ransomware criminals in the human psyche like there is to alter consciousness.
There are loads of countries that have illegalized alcohol and not devolved into levels of organized crime that the US did. Specifically, nearly every Muslim nation on earth. I feel this one example is way overplayed by advocates of legalization
The only way to actually have a "hostages will die" policy is to ensure you destroy whoever took them, despite the deaths of hostages.
For drugs, there’s some inherent desire for some people to consume them. Maybe they harm society a bit (in the sense that they might destroy the people that take them), but the main cost for the rest of us is that they fund criminal enterprises because they are illegal. People want drugs, if they could buy them at CVS I suspect they would.
Ransomware is already illegal, we don’t create a new criminal enterprise by making it illegal to do business with them, we just make it harder.
Also, lots go the biggest ransomware gets have been big institutional entities where everything is documented. People just buy drugs in small amounts and consume them, two parties, neither of whom wants to get caught, minimal paper trail. Basically impossible to ban.
For physical hostages—people are desperate to get their friends and family back, and so they’ll go to desperate measures to pay. For ransomware, it is usually an economic decision, nobody’s life is at risk (other than when, like, a hospital is hit). Increasing the cost increases the chance the decision will go the other way. And increases the incentives to keep IT defenses up to date. (I know you didn’t bring up the hostage analogy, I think it is worth noting that the desperation you point to here is really an artifact of the tangent we’re on from the analogy leading us astray).
Or even worse, like shareholder or regulator action, see SolarWinds
https://news.ycombinator.com/item?id=38076636
Note that in the EU under GDRP companies are still liable for privacy violations and related fines if ransomware attackers gain access to your personal details, random or no random (a hack is enough).
It's sounds nice in the abstract; in practice it's political suicide.
Depends on how you spin it. I suspect it would be quite easy to spin the narrative on this one. "So you knowingly funded a terrorist group that's likely going to use the money to commit further crimes against US citizens?" or something of the sort. Have some experts testify on that too, preferably ones in officers uniform.
Becoming as inhuman as your opponent is not the answer.
The gov will pat themselves on the back telling everyone how they've caused a drop in the number of incidents.
You're offering to increase the stick, what's the carrot for the people/corporation losing everything ?
Making the punishment bigger also means victims have stronger incentives to work closely with the terrorists so the whole thing never gets public or never gets labelled as a ransom.