What is Old is New Again: Lessons in Anti-Ransom Policy

This report analyzes policy responses to ransomware by drawing lessons from kidnapping-for-ransom histories in Italy and Colombia and evaluating three options—payment bans, insurance, and mandatory reporting. It finds payment bans yield mixed outcomes and reduce transparency, insurance can aid risk management but may introduce perverse incentives in a nascent market, and mandated reporting improves visibility; coupled with proactive law-enforcement disruptions (e.g., takedowns like LockBit), the most effective path is to increase adversary costs and reduce ransomware’s profitability.