Paying the Hacker, Funding the Ecosystem: Criminalising Ransomware Payments without Punishing Victim Organisations

Abstract

Existing scholarship had explained how ransom payments sustained ransomware markets, but it had not adequately separated the systemic harm of payment from the criminal culpability of victim organisations acting under pressure. This article examined how ransomware payments could be controlled without making victim organisations the primary targets of criminal punishment. Normative legal research was conducted through statutory, conceptual, and comparative approaches using legislation, sanctions guidance, policy documents, and academic literature from Australia, the United States, and the United Kingdom. The analysis found that ransom payments maintained the profitability of Ransomware-as-a-Service and supported a wider criminal ecosystem, yet the transfer itself did not establish equal culpability in every case. Blanket criminalisation overlooked differences in knowledge, recovery capacity, threat severity, and cooperation with authorities. A victim-protective model was therefore proposed in which payments remained reportable and subject to reasonable pre-payment scrutiny, while criminal liability focused on knowing prohibited payments, concealment, false reporting, and deliberate circumvention. Limited protection for compelled reports and narrowly framed emergency exceptions preserved cooperation and proportionality. The analysis also found that state recovery support was necessary to make refusal to pay operationally realistic.