Ransomware provides a useful service and should be legal. Businesses with poor security practices deserve to be punished for their negligence.
It's like trying to justify armed robbery as a method of convincing people to take self defense lessons, or burglary as a method to get people to upgrade their windows to lexan.
The middle ground, which is always a bit in flux, does already exist. It's known as Bug/Security bounties, similar to what HackerOne tries to make above-board.
Defense has to work every time. Attackers just have to get through once. That's a game that favors the attackers.
Also, the thing is, our immune system isn't exempt from false-positives. I'm not sure we want a society with as many false-positives.
Game 2: Every time offence scores, they get $100 of my money. Defense loses nothing.
Neither is fair to defence, but game 2 is unfair to me, and that's what's important.
I just hope no one ever holds you up to the standards you demand of everyone else.
Also:
Ransomware gangs also target companies that do not have "enormous amounts of user's personal and financial data".
Since too many companies didn't pay ransomware gangs now have taken to stealing data in addition - are you fine with a ransomware gang selling your personal data then, because they are "helping"?
>let's sanction crime against them
If it were legal it wouldn't be a crime.
>Are you sure kindergardens are punished reliably enough for lapses of security?
Given that I rarely hear about children being kidnapped out of kindergartens, I would assume so. I'm not well educated on this, though, since I don't have a personal stake in the matter.
No it's not, but because random data stealing is a lot less lucrative than ransoming.