80% of orgs that paid the ransom were hit again

That's the "it takes will" part.

Organizations can and do take many decisions of which "the accounting folks" are not fans of, the accounting people can and do say such things about the costs, but they don't have a veto. Arguments about cost of mitigation are valid in general, but leaders and owners can choose the priorities, and the responsibility and blame for these choices is fully on them (for their will or lack of will), not on "the accounting folks" arguments.

Also, sometimes that accounting argument is entirely valid. For example, look at the recent case of First American Financial - https://krebsonsecurity.com/2021/06/first-american-financial... - if the consequence of leaking the sensitive financial documents of millions of customers is just 500k, then it definitely is cheaper to just accept the hacks and pay the compensation, because investing in proper security would be much more expensive than that.

Crypto can work peer-to-peer even with fiat echanges shut down.

Sure, it would be more difficult if crypto is illegal, but I think because of the difficulty of getting it, crypto prices would skyrocket.

Everyone will also move to using the privacy coins too. So, banning crypto might actually be beneficial for it as it would incentivise crypto projects to improve privacy and decentralization even more.

A ban won't stop people from using it or developing it in their homes.

Better yet, add a 200% tax on top of ransom payments. That will tranfer the profits to the government. The attackers will know that the ability to pay is cut to 1/3.

> Crypto can work peer-to-peer even with fiat echanges shut down.

Sure, nowhere in my post do I deny that an underground market won't exist. In fact, I directly hint to the fact that it will exist. What matters for this problem is how easy it is to buy $X million worth of bitcoins for a company. Currently this is easy. If you have $X million in your bank account, you can go to one of these exchanges and buy $X million worth of bitcoin.

With the exchanges shut down, how would a company buy $X million worth of bitcoin? Where do they go? How do they not get scammed while doing so? It's not like companies can easily move $X million to another country where it would be legal to buy crypto either. After all, if they could move money in a bank that easily, crypto would not be required at all for the purpose of ransomware. They could just move the $X million directly! People use crypto for ransomware because it is not so easy to move money of this magnitude.

> Sure, it would be more difficult if crypto is illegal, but I think because of the difficulty of getting it, crypto prices would skyrocket.

That seems unlikely. A bank run seems the most likely scenario with a massive drop in price being the result, even if only a few high-impact regions would make it illegal (e.g. the US and EU). Regular people and large investors would cash out almost immediately upon hearing the news. Why would regular people want to own an illegal currency that they cannot trade for anything besides maybe drugs on the black market?

The reason the majority of people own crypto now is not because of the utility - it is because there are legal crypto exchanges that they can use to trade them back to the actual currency that they use (generally dollars or euros). If people have to go through illegal networks in order to perform these exchanges (and remember, exchanges for fiat money would be illegal and hence risky) the entire value proposition is lost.

> Everyone will also move to using the privacy coins too. So, banning crypto might actually be beneficial for it as it would incentivise crypto projects to improve privacy and decentralization even more.

I wouldn't even propose banning cryptocurrencies entirely. Shutting down the exchanges and banning the trade of cryptocurrency for fiat seems more than sufficient for this purpose. Cryptocurrencies can continue to exist on their own and perhaps find a use/purpose of their own. The back-and-forth exchange for fiat is what is problematic.

This might even be good for cryptocurrencies as a platform, as the focus would shift back to the underlying technology and its use cases rather than the investor crowd that doesn't give a shit about the technology and only cares about making a quick buck.

This argument is reasonable-ish but wrong. Companies have long been subject to information security crises. Earlier, there were viruses; today, it is ransomware. Business practices will change in a way that makes these hacks less feasible, but not most businesses just aren't interested in it. The fantastic new security of the future won't be secure by design, it'll be known-ransomware-proof.

(Also, implicit in the claim is the argument that any activity is good activity. I don't think that holds: I think paying for security guards and spending disk space or CPU cycles on security measures are necessary, but not beneficial. Probably, the world would be better if there are no bad actors. But I can only assent to your claim if I believe that the world is better if we protect against bad actors than if we have no bad actors and no protection. This is probably the cause of you getting downvoted.)