Paying a Hacker’s Ransom Shouldn’t Be a Crime
bloomberg.com
bloomberg.com
Yes, it's a pain. Yes it leads to the loss of several hours of time, etc, etc, etc.
But why is it a problem that a good daily backup can't fix effortlessly? What's wrong with a quick disk-wipe and restore from backup? Then it's back to work and there's no need at all to put your hand in your pocket for thousands/millions in ransom, and being 'offline' until the hackers come good on their promises to fix your data?
Therein lies the rub. I've consulted/worked at a crapton of companies and organizations over the years. The vast majority had minimal backup solutions or none at all. Reliable backup solutions are expensive and not coincidentally, upper management at these companies just wouldn't pay for it. I can't tell you how many times I was told something along the lines of "Why are we spending money on IT when the IT dept. doesn't make the company money?" Management usually would just hang the IT dept. out to dry anytime something like this happens so there's seldom any real repercussions for the actual decision makers that cause the mess to begin with. Wash, rinse, repeat. And this is the sad and pathetic reason why something as strange and convoluted as ransomware schemes are so successful.
It's a bit like the idea of an economist (iirc and I forgot the name) that receiving or demanding a bribe should be a crime but that paying one should not, and that someone convicted for receiving a bribe should be also made to pay the money back.
This creates a strong incentive for the person paying a bribe to go public and report it to the police and increases the risk of demanding a bribe.