One possible solution to such problems is to prohibit paying ransom by law. Hackers can still be destructive, but at least they will have less incentive to participate in such activities.
Top managers will deny everything, but FBI will start investigations, the will be a whistleblower, and eventually FBI will offer a deal to some middle manager to testify in court that top managers knew that "consultants" were actually hackers.
This will be enough to greatly discourage stakeholders to participate in paying to these consultants even indirectly.
Maybe it won't work perfectly, but at least it will make paying more risky, more expensive, thus less often.
Sanctions work the same way. You can't deal with a company who is under sanctions, and if you try to use some intermediary to get around sanctions, you can still be fined at least.
Because they'll just call 911 and say "I just paid ransom under cover"?
You know this is why incompetent lawmakers terrify me. They believe they can just be "tough" and everyone just falls in line instead of trying the infinite loopholes you leave open, each of which is a better outcome for them than the draconian path drawn by the law in spirit.
If you make payment illegal, not only you're punishing the victim, you're adding a STRONG INCENTIVE for them to keep the whole thing a SECRET.
You're shooting your own foot.
Because some whistleblower will leak it (or just some person who is seeking their 15 minutes of fame).
Or because there's a transaction to China by a company which never worked with China. Like if you paid to a security consultant company based in China, and that consultant company was registered a week ago, and the website was down for a week, that is a reason to start investigation.
Oh, by the way, a law may mandate disclosure of a ransom request like within three days. So even if the FBI couldn't prove the consultants were fake, the company can be still be fined for not disclosing the request.
> STRONG INCENTIVE for them to keep the whole thing a SECRET
I suspect companies which pay ransom now don't exactly shout about it on every corner. Only those who refuse to pay do so.
> You're shooting your own foot.
How it could be worse than it is now?
[0] already being signaled: https://www.reuters.com/article/us-treasury-cyber-idUSKBN26M...
The regularity of ransomware has apparently made the expense “ordinary” therefore now tax deductible. Shrug.
Hacks in many ways incentivize companies to invest in their security.
Also, if you prohibit paying ransom nothing will probably change. Hackers will continue to steal data, they will just sell it like they always did.
Sure they will target now companies that have more valuable data, but the big picture won't change.
One possible solution to rape is that women walk around with a bomb and if someone tries to rape them they kill themselves and the attacker. Rapists can still be destructive, but at least they will have less incentive to participate in such activities.