Executives want to pay an extortion demand to prevent publication — what must the pre-decided ransom position answer?

## Two purchases wearing one word "Paying the ransom" hides two entirely different transactions, and a leadership team that has not separated them will make a poor decision under pressure. **Purchase one: a decryption capability.** You are buying a tool that reverses encryption you cannot otherwise reverse. This is at least testable — you can require a proof decryption of a chosen file before payment, and afterwards you find out whether the tool works, which for hypervisor-level encryption of large datastores is frequently slow and partial. If recovery from backups is viable, this purchase can be worth nothing, and the recovery track and the payment track should be run in parallel precisely so that this stays true. **Purchase two: a promise to delete data.** You are buying a statement of intent from a criminal counterparty. There is no verification, no enforcement, and no remedy. Victims who paid have subsequently been listed again by the same brand or seen the same data appear elsewhere. Nothing that can be produced — a video of a folder being deleted, a signed note — is evidence, because the marginal cost of retaining a copy is zero. And critically, the payment does not extinguish any obligation you owe to the people whose data was taken. The position should therefore state plainly what the organisation will not buy at any price, and this is the category. ## The constraints the position must have already resolved When the pressure arrives, these questions are asked in the wrong order and answered badly. Pre-resolve them. - **Legality and sanctions.** Payments to sanctioned entities can breach sanctions law even where intent is absent, so the actor and the payment channel must be screened by counsel or a specialist before any transfer. The playbook must name who performs the screening and how long it takes. - **Insurer consent.** Most policies condition extortion cover on the insurer's prior consent and the use of panel counsel and approved vendors. A payment made first and reported second may be uninsured. - **Who signs.** Not a committee. A named executive, with a named alternate for out of hours, and a documented record of the basis for the decision. - **Feasibility.** Sourcing and funding a payment channel takes days at short notice. If the organisation has not decided in advance whether it will ever be able to pay, the answer during the incident may be no by default — which is a legitimate position, but it should be a chosen one rather than a discovered one. - **What is disclosed and to whom.** Board, auditors and, where relevant, disclosure obligations. A payment is a material act, not a private operational choice. ## Engaging is not paying The most common false binary is pay-or-silence. Opening a channel through a specialist negotiator is a separable decision with its own value: it buys time, tests whether the actor will move the deadline, elicits proof of what is actually held, and yields observations about the counterparty. It is not consent to pay and must be authorised as its own step, with an explicit instruction on what may and may not be said. A playbook that treats first contact as the payment decision loses the option. ## Planning for refusal If the position is refusal — the common outcome — then the playbook has to carry the consequence, because refusal has a publication day. Decide in advance who is told and in what order when the data appears; how the affected parties are supported; that the organisation's public account will be a plain one; and that the deadline passing is not the end of the incident, because the intruder's access is a separate question from the extortion. In the scenario this playbook is written for, the disconnect held, the ransom was refused, the timer expired and the data was published anyway — and everything the organisation had to do next had been decided when nobody was watching a countdown. ## What a good answer sounds like A strong candidate does not perform a moral position. They say: we separate the decryptor from the deletion promise; we will not buy the deletion promise because it cannot be verified; whether we would ever buy a decryptor depends on whether recovery is viable and is a named executive's call under sanctions and insurer constraints; we open a negotiation channel early because it costs us little and buys information and time; and we plan for publication day regardless of the decision, because the leverage disappears only when the data is public or the actor loses interest, and neither is under our control.