> Of course in an ideal world no one wants to reward criminals, but just to give an extreme example, if someone kidnapped one of your children and held them hostage, you'd probably pay anything to get them back, and that's not far off from the situation some ransomware-affected companies end up in.
That's an appeal to emotion though while a company can do a cost-benefit analysis.
Also, if you pay for your children that means you signal that the kidnapping business model is viable and thus endanger more children. If the government keeps you at gunpoint from paying for your children then yes, in the worst case a bunch of children might die, but the business model would die with them.
No, in the worst case the government would shoot the parents of kidnapped children, and lose its legitimacy in the eyes of the people who it governs. There's no case in which a government would be able to continue to do that with impunity until enough children die to convince every potential kidnapper that kidnapping is a hopeless business.
Right, which is why this is always done as part of a cost-benefit analysis. Sometimes the cost of not paying is far greater.
And yes, paying the ransom signals that hostage-taking can be profitable, but not paying it signals that you value crime prevention over the lives of your children, which isn't necessarily a reputation or circumstance you want, especially when they'll very likely end up brutally murdered.
A company that decided principle-based crime deterrence was more important than granting customers access to any of their funds for 6 months would probably go out of business quickly. Also, try using that argument when talking to people who live in areas largely run by organized crime.
That's an appeal to emotion though while a company can do a cost-benefit analysis. Also, if you pay for your children that means you signal that the kidnapping business model is viable and thus endanger more children. If the government keeps you at gunpoint from paying for your children then yes, in the worst case a bunch of children might die, but the business model would die with them.