Amy Chang, a resident senior fellow for cybersecurity and emerging threats at the R Street Institute, questioned whether the government ought to be involved.

“At the end of the day, whether or not to pay a ransom is a business decision,” she wrote. “Is it a best practice? Absolutely not. Despite that, organizations do sometimes neglect best practices, and it is not a national government’s role to spend time and resources determining parameters for a ban and enforcing it.”