1. Make ransom illegal to pay. 2. Fine the hell out of any company that has not kept up with best practice in security. Require the board and exec staff to resign without payouts. 3. Make minimum jail time for ransomware hackers 100 years. 4. Make any hack that can be attributed to a loss of life (like shutting down a hospital) a death penalty offense. 5. State actors get economic death penalty - no US company or company that does business with a US company is allowed to do business (banking, etc.) with the state actor for 1 year for each offense. 6. Authorize NSA to retaliate in kind vs state actors.

At the height of the Roman Empire a citizen could walk the length of it without fear, because if they where attacked and killed the legion would burn the city / village to the ground that was responsible.

We had the Cold War and not a Hot War because of mutually assured destruction. I fail to see a reason not to bring that balance to hacking by state actors.

Bla, bla, I am a bad person. No, I am suggesting a reasonable measurable set of steps that force the companies to do better while imposing great risk to the criminals and state actors.