Paying ransoms (especially for organisations outside of the respective jurisdiction) isn't?