Should ransomware payments be illegal?