I really admire what Bruce Schneier has said about the pay-or-not-pay debacle that ransomware puts companies and individuals in. Because it aptly summarizes the counterpoint to outlawing the payment of ransomware: I'm paraphrasing from memory here, but it was something to the effect of, "it's your data, or your daughter." In other words, the imperative to pay is directly related to your skin in the game.