1. It's possible for the advantages of restoring data to outweigh the societal cost of facilitating a criminal enterprise. For example, a patient has died in a hospital due to a ransomware attack. Would you prioritise saving human lives over sending some Bitcoin to some malware writer?

2. While there's no guarantee, it is exceedingly demonstrated that if you pay the ransom, you will get your data back. Ransomware writers have a collective reputation to uphold (strange, huh), and a typical negotiation involves requesting decryption of a few files to prove this capability exists.

3. Parties can legally comply with law enforcement AND pay a ransom (see #1 and #2). When paid with bitcoin, it leaves a strong and permanent evidence trail, especially with Bitcoin de-mixing techniques discovered all the time.

4. The solution to your problem is mandatory and visible disclosure of security breaches, you do not need to criminalise paying ransoms to get here; nor does it achieve as much as a broad "obligation to disclose".

5. By criminalising ransomware payments, the Justice Department has already made hundreds of corporations criminals. We know this Justice Department is known for selective prosecution: it is entirely plausible, if not likely, for companies against the current political party (e.g. donations to other candidates) to receive enhanced scrutiny and criminal charges.

Point 5 is not "conspiracy theory": we know the Qwest CEO was arrested on selectively enforced "insider trading" charges because he refused to spy on his customers for the NSA.