EDIT: slightly different but I wasn't the only one with an idea in this direction: https://www.reuters.com/article/us-treasury-cyber-idUSKBN26M...
Snark aside, there's just no simple, hand-waving solution to this. Even if you held the company owners criminally liable for paying a ransom, pretty much any small company will shut down for not being able to afford top-notch security.
It also opens the door to blackmail:
> We've encrypted your files. Pay us $AMOUNT BTC by tomorrow, or your files are gone. And with a recurring payment of $AMOUNT BTC per month, I promise not to report you to the FBI for paying!
It potentially makes the victims criminals. That's just not what the law should be doing. It is decidedly unjust. It also drives the whole thing further from the public eye as no one will admit they're being held up for ransom because paying is now illegal.
If making something illegal was a perfect solution, ransomware wouldn't be a thing in the first place.
The gov is the one entity that should not be allowed to pay at any cost, as it has infinite paying power.
That won't really change anything, other than add 'break a law' to 'lose tons of $$' and 'lose data/time' to the list of bad things a company will deal with to recover from a ransomware attack.
Ransom only encourages more crime. It's a form of aiding and abetting.