The people who do have the power to decide that, the FBI in the case of live children and the Department of the Treasury in the case of ransomware, have in fact decided that these payments are illegal for precisely these reasons. Kidnap for ransom is effectively no more in the states, due to the FBI's high rate of solving these cases. If crimes using computers were taken seriously, we might have a chance at actually reducing their rate as well.
>If crimes using computers were taken seriously, we might have a chance at actually reducing their rate as well.
They often are taken seriously. The problem is most of the ransomware gangs operate out of Russia, and Russian law enforcement permits the activity if Russian citizens aren't targeted. (There may be a short blacklist for citizens of some other countries allied with Russia, as well, but targeting and profiting from citizens and companies in America and Western Europe is explicitly allowed.)
If you're the FBI, there's absolutely nothing you can do about that if the ransomware operators never leave the country. You can try to lure them out of the country - and this does happen sometimes - but if they're smart enough to never leave, they're basically immune to all repercussions.
The Justice Department can publicly indict them, and they sometimes do, but they're just going to laugh at it; it simply increases their street cred and respect among their peers. "I'm on the FBI's Most Wanted lol." You can go after the infrastructure, but as long as the people involved are allowed to operate freely and continue to have lucrative incentivizes, it's only a minor annoyance at most.
We could issue letters of marque and reprisal. Basically, if Russia won't prosecute their cybercriminals the US will permit cyber crime against Russian targets.
