Let’s be realistic about this. A company can’t pay a ransom if they don’t have customers. Life sentences for all customers of businesses is the only effective path.

And the death penalty for the engineer who didn’t patch a vulnerability or the software developer who wrote the buggy code. That will teach them! Judge Hindsight is ready to punish the victims.

Hacks happen. Where starts or ends someone’s responsibility? Where stops the buck? Can we really expect that every layer in an organization is always fully aware of security and security risks, even unknown vulnerabilities? Security practices change over time. Not so long ago 12 character passwords were considered safe, 2FA didn’t exist, …

I don’t think that harsher punishments and victim blaming is the way to go.