I've grudgingly come around to the notion that there is only one way out of the ransomware problem: Make paying a ransom illegal. This is not very different from laws that make it illegal for US companies to pay bribes to foreign officials.

I really don't see any other way out of this mess. Yes, some victims will unfortunately ignore any laws that say they can't pay, but enforcement probably will not be hard.

What will be difficult are the situations where peoples' lives are at stake in ransomware incidents This sounds callous, but we can't afford to take the short view here anymore, and our other alternatives aren't great either.

I'm quite certain this is an unpopular view, but we have already seen the cost of doing nothing. At least in the interests of congruity for our financial sanctions vs Russia, we should probably make this change sooner rather than later.

There are 100 ways the current ransomware problem can and probably will get worse and nastier. Every single cybercriminal or aspiring crook is now focused on ransomware or data ransom payments as THE path to financial success. It's no longer just the Russians. It's the Chinese, the North Koreans, and Iran.

Either way, these countries don't just want to hurt the United States: They would rather the US died in a fire. For companies to make payments to these regimes -- and their cybercriminal apparatus is always part of the regime -- is bonkers, IMHO.

@briankrebs

Many countries already have laws against moving money for the purpose of money laundering or supporting terrorism and organized crime, I'm reasonably sure these could already be used for exactly this purpose.

@Daveography @briankrebs We should ban cryptocurrency under that rationale because it’s used for those purposes whenever it’s used for ransomware payments…and it’s used more directly for that all the time. Look how it’s been used to funnel money to Hamas recently for example.