Decision to pay hackers for hijacked systems more complex than meets the eye