Are we permitted to pay hackers to release our data