Arguments Against Criminalizing Ransomware Payments

Arguments Against Criminalizing Ransomware Payments

Arguments Against Criminalizing Ransomware Payments

We must act to effectively end ransomware as a significant cybersecurity risk for everyone. 

In exploring the strategy to criminalize ransomware payments, many have raised concerns, objections, and alternate solutions. In this video I address the most common arguments against criminalizing ransomware payments, in the hope we can come to a consensus for the best path to end ransomware. Where do you stand?

The goal is to effectively end ransomware as a significant cybersecurity risk for everyone. 

In exploring the different strategic options, one path has emerged superior, in which the flow of money to the ransomware attackers is essentially stopped. The only way to make that happen consistently is to compel the victims to not pay by making it a criminal act. However, not everyone agrees. 

In my discussions with many experts across a range of disciplines, the same arguments would emerge and be debated. This is an exhaustive list of those arguments and the discussions that continue to support the premise that criminalizing ransomware payments is the best option.


In this video, I discuss and address the most common arguments against criminalizing ransomware payments, in the hope we can come to a consensus for what may be the best path forward to end ransomware.

Argument Jump Points:


  • 11:03 #1 – Not possible to enact such a law
  • 12:48 #2 – Can’t enforce such a law
  • 19:12 #3 – Won’t seriously restrict the flow of money to the cybercriminals
  • 22:31 #4 – Not be effective in reducing the risks
  • 25:42 #5 – It should be the victim’s choice to pay, as it is their business and money
  • 28:58 #6 – Would force some victims out of business
  • 33:36 #7 – Unfair to SMB’s, who can’t afford security
  • 35:50 #8 – Removes a critical option for organizations, necessary to stay in business
  • 39:00 #9 – Would create too great a national/regional impact for critical systems down for extended periods
  • 43:18 #10 – Building better security mitigation capabilities
  • 47:16 #11 – Outlawing cryptocurrency
  • 52:04 #12 – A partial ban on payments or ‘special circumstances’ allowing payment as a compromise
  • 54:38 #13 – Improving law enforcement capabilities to catch the attackers
  • 58:32 #14 – Employing the military to protect everyone from attacks

We must act. Ransomware will not go away on its own and the cybersecurity products and services have been unable to curb the massive growth of this problem. 


We must select the best strategic solution, that meets the clear success criteria, and move to implement as quickly as possible to reverse the growing impacts of ransomware.

Ransomware Explained Series:

Share this article

Leave your comments

Post comment as a guest

terms and condition.
  • No comments found

Share this article

Matthew Rosenquist 

Cybersecurity Expert

Matthew Rosenquist is an industry-recognized pragmatic, passionate, and innovative strategic security expert with 28 years of experience. He thrives in challenging cybersecurity environments and in the face of ever shifting threats. A leader in identifying opportunities, driving industry change, and building mature security organizations, Matthew delivers capabilities for sustainable security postures. He has experience in protecting billions of dollars of corporate assets, consulting across industry verticals, understanding current and emerging risks, communicating opportunities, forging internal cooperation and executive buy-in, and developing practical strategies. Matthew is a trusted advisor, security expert, and evangelist for academia, businesses, and governments around the world. A public advocate for best-practices, and communicating the risks and opportunities emerging in cybersecurity. He delivers engaging keynotes, speeches, interviews, and consulting sessions at conferences and to audiences around the globe. He has attracted a large social following of security peers, is an active member on advisory boards, and quoted in news, magazines, and books. Matthew is a recognized industry expert, speaker, and leader who enjoys the pursuit of achieving optimal cybersecurity. Matthew Rosenquist is experienced in building world class teams and capabilities, managing security operations, evangelizing best-practices to the market, developing security products, and improving corporate security services. 

Cookies user prefences
We use cookies to ensure you to get the best experience on our website. If you decline the use of cookies, this website may not function as expected.
Accept all
Decline all
Read more
Tools used to analyze the data to measure the effectiveness of a website and to understand how it works.
Google Analytics