Scholarlink

<p>Ransomware has matured into a&#xa0;transnational, profit-driven threat that exploits asymmetries in cyber resilience and legal frameworks. This article evaluates whether moving toward a&#xa0;legal prohibition on ransom payments is a&#xa0;viable and proportionate strategy. Using a&#xa0;comparative analysis of developments between 2023 and 2025 in the United States, United Kingdom, European Union and selected third countries (notably Australia), it maps emerging policy instruments—targeted payment bans, payment-preclearance/approval regimes, mandatory incident and payment reporting, and sanctions-based constraints—and assesses their interaction with existing international law, including the Budapest Convention and the draft UN Cybercrime Convention. The analysis highlights the deterrent rationale of “starving the business model” through reduced payment flows, while scrutinizing material risks: displacement effects across jurisdictions, potential under-reporting, operational harm to essential services, and disproportionate burdens on SMEs. It further addresses human-rights and due-process concerns (necessity, proportionality, narrowly tailored exemptions), conflicts of laws in multinational incidents, and the role of crypto-asset controls and coordinated law-enforcement disruption. The article proposes an incremental, internationally coordinated roadmap: (i)&#xa0;harmonized bans for governments and critical infrastructure; (ii)&#xa0;universal, time-bound reporting of incidents and payments; (iii)&#xa0;strengthened cross-border MLA/extradition and asset-freezing for ransomware proceeds; (iv)&#xa0;victim-support mechanisms (decryption sharing, recovery funding) to avoid perverse incentives; and (v)&#xa0;norms addressing safe havens. The central claim is that a&#xa0;payment ban can be effective only as part of a&#xa0;comprehensive framework that couples legal constraints with resilience, transparency, and multilateral enforcement; under those conditions, a&#xa0;converging international norm of refusing to pay cyber ransoms is both legally tenable and strategically advantageous.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

International legal responses to ransomware: toward a ban on payments?

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2026年1月19日

查看全文
  • Fabian Teichmann

摘要

Ransomware has matured into a transnational, profit-driven threat that exploits asymmetries in cyber resilience and legal frameworks. This article evaluates whether moving toward a legal prohibition on ransom payments is a viable and proportionate strategy. Using a comparative analysis of developments between 2023 and 2025 in the United States, United Kingdom, European Union and selected third countries (notably Australia), it maps emerging policy instruments—targeted payment bans, payment-preclearance/approval regimes, mandatory incident and payment reporting, and sanctions-based constraints—and assesses their interaction with existing international law, including the Budapest Convention and the draft UN Cybercrime Convention. The analysis highlights the deterrent rationale of “starving the business model” through reduced payment flows, while scrutinizing material risks: displacement effects across jurisdictions, potential under-reporting, operational harm to essential services, and disproportionate burdens on SMEs. It further addresses human-rights and due-process concerns (necessity, proportionality, narrowly tailored exemptions), conflicts of laws in multinational incidents, and the role of crypto-asset controls and coordinated law-enforcement disruption. The article proposes an incremental, internationally coordinated roadmap: (i) harmonized bans for governments and critical infrastructure; (ii) universal, time-bound reporting of incidents and payments; (iii) strengthened cross-border MLA/extradition and asset-freezing for ransomware proceeds; (iv) victim-support mechanisms (decryption sharing, recovery funding) to avoid perverse incentives; and (v) norms addressing safe havens. The central claim is that a payment ban can be effective only as part of a comprehensive framework that couples legal constraints with resilience, transparency, and multilateral enforcement; under those conditions, a converging international norm of refusing to pay cyber ransoms is both legally tenable and strategically advantageous.