I have to wonder if, in macro economic terms, we'd be better off spending whatever is necessary to successfully investigate and prosecute scammers/telemarketers/ransomers.
https://www.fbi.gov/news/stories/ransomware-abettor-sentence...
Even if you criminalize paying you'll still have a tiny portion that do.
I'd argue that isn't true. Ransomware is a form of terror in the form of "losing everything". And that threat of impending loss combined with 'backups are hard wahhhh' and the fact that no Corp I know backs up user machines...
As a numbers game, it pays. Well. And even if it didn't, some still hack for the "lulz".
Most of the orgs I've worked at (for at least the last decade) map the local profile to a network share, which is definitely backed up. The only things not backed up would be saved outside that folder structure, but the organizations have always been clear about that.