“Under the proposals, businesses not covered by the ban would be required to notify the government of any intent to pay a ransom"