Re: $5 million for criminals
Easy. Make the law state that any ransomware payment must be deducted directly from the CEO's salary. And he may not be reimbursed or receive any salary increase for the next 5 years.
We would never see another payment made, I guarantee that!