It wouldn't need to work that way. If a law was past mandating that in 5 years paying ransoms would be illegal then companies would be forced to either invest o

It wouldn't need to work that way. If a law was past mandating that in 5 years paying ransoms would be illegal then companies would be forced to either invest or be held liable after that grace period. Of course there could be an exception process that involves contacting LE first, paying the ransom, being fined and audited, and having to disclose a report online and in front of the entrances of the when, why, and how this occurred. Paying the ransom w/o going through this process could (maybe?) be treated as conspiring with the attacker (& since the identities of the attackers are almost always 100% unknown, some could legitimately have inside contacts anyway).