Enable activity instead of futilely trying to ban activity. Instead of focusing on punishing the victims and unrelated third parties, focus on punishing and disrupting the perpetrators.
Or if not letters of marque, they could at least just issue a notice that certain activity will have a blind eye turned towards it, to mirror the policy of some of the governments that bear most of the responsibility for ransomware activity.