Arguments Against Criminalizing Ransomware Payments

We must act to effectively end ransomware as a significant cybersecurity risk for everyone. 

In exploring the strategy to criminalize ransomware payments, many have raised concerns, objections, and alternate solutions. In this video I address the most common arguments against criminalizing ransomware payments, in the hope we can come to a consensus for the best path to end ransomware. Where do you stand?

The goal is to effectively end ransomware as a significant cybersecurity risk for everyone. 

In exploring the different strategic options, one path has emerged superior, in which the flow of money to the ransomware attackers is essentially stopped. The only way to make that happen consistently is to compel the victims to not pay by making it a criminal act. However, not everyone agrees. 

In my discussions with many experts across a range of disciplines, the same arguments would emerge and be debated. This is an exhaustive list of those arguments and the discussions that continue to support the premise that criminalizing ransomware payments is the best option.

In this video, I discuss and address the most common arguments against criminalizing ransomware payments, in the hope we can come to a consensus for what may be the best path forward to end ransomware.

Argument Jump Points:

• 11:03 #1 – Not possible to enact such a law
• 12:48 #2 – Can’t enforce such a law
• 19:12 #3 – Won’t seriously restrict the flow of money to the cybercriminals
• 22:31 #4 – Not be effective in reducing the risks
• 25:42 #5 – It should be the victim’s choice to pay, as it is their business and money
• 28:58 #6 – Would force some victims out of business
• 33:36 #7 – Unfair to SMB’s, who can’t afford security
• 35:50 #8 – Removes a critical option for organizations, necessary to stay in business
• 39:00 #9 – Would create too great a national/regional impact for critical systems down for extended periods
• 43:18 #10 – Building better security mitigation capabilities
• 47:16 #11 – Outlawing cryptocurrency
• 52:04 #12 – A partial ban on payments or ‘special circumstances’ allowing payment as a compromise
• 54:38 #13 – Improving law enforcement capabilities to catch the attackers
• 58:32 #14 – Employing the military to protect everyone from attacks

We must act. Ransomware will not go away on its own and the cybersecurity products and services have been unable to curb the massive growth of this problem. 

We must select the best strategic solution, that meets the clear success criteria, and move to implement as quickly as possible to reverse the growing impacts of ransomware.

Ransomware Explained Series:

• End Ransomware by Criminalizing Ransomware Payments: https://www.youtube.com/watch?v=7AlMdkaL6II
• Understanding the Attackers: https://www.youtube.com/watch?v=n2gGq26fgxA
• Success Criteria for Ending Ransomware: https://www.youtube.com/watch?v=aeqAeTUnyeo
• Demotivating Ransomware Attackers by Ending Ransom Payments: https://www.youtube.com/watch?v=E8bpG6zl7Xg