Police always advise ransomware victims not to pay the criminal gangs that have encrypted their systems – and there are many good reasons for this.
At the most basic level, even after companies hand over the money, it is not always certain that hackers will restore access to their data. After all, they are negotiating with scammers.
But even if they get their data back, paying is still a bad idea. It gives the crooks a big reward, which encourages further attacks – perhaps even on the same organization again. And those big payouts mean the gangs can invest in hiring more software developers and hackers to pursue even bigger targets.
Paying the ransom may give you access to your data, but it will create a bigger problem for everyone else in the long run.
Currently, businesses in the UK are unlikely to be prosecuted for paying ransoms to ransomware gangs – unless there is a reasonable possibility that the payment will be used to fund terrorism. But at least a large number of people in the industry believe that it should be much harder, or even illegal, to pay ransoms.
Speaking earlier this month at security think tank RUSI, former head of the National Cyber Security Centre (NCSC), Ciaran Martin explained how big a problem ransomware is.
Martin said that if he had the chance to play “a political card next year,” he would call for “a serious consideration of whether the law to make it illegal for organizations in the UK to pay ransoms if they fall victim to ransomware.”
Martin said it was strange that the UK's extortion laws were based largely on the experience of kidnapping by terrorist groups. That is, if you are being extorted by a terrorist group, it is illegal to pay, but if the attackers are ordinary criminals or even state-sponsored attackers, then it is okay. "Surely that is strange and needs to change," he said.
It is believed that up to half of organizations will pay the ransom when hit by ransomware, which has made data-encrypting malware a significant source of revenue for sophisticated criminal gangs. Some versions of ransomware have earned tens of millions in ransoms, usually in the form of hard-to-trace cryptocurrencies like bitcoin.
Many victims believe they have no choice but to pay if their alternative is to effectively rebuild all of their computer systems and databases from scratch.
However, another issue is that business expenses are increasing since it is almost a given that they must invest in expensive security that will prevent such attacks.
If paying ransoms were a criminal offense, companies would have to make sure systems were robust enough to stop attackers. But it would also put a lot more pressure on police to track down the gangs.
