Who's doing the kidnapping?
Most of the Islamic terrorist groups. The Islamic State of Iraq and Syria (ISIS) recently brought attention to terrorist kidnappings with its gruesome beheading of American journalist James Foley. The terrorist group claimed the execution was in retaliation for U.S. airstrikes, but it also had demanded the huge sum of $132 million for Foley's release. In recent months ISIS has secured millions of dollars for the release of other hostages — a tactic it adopted from al Qaida, from which it split in February. Al Qaida's three main affiliates — al Qaida in the Islamic Maghreb, al Qaida in the Arabian Peninsula, and al-Shabab — have helped extract an estimated $165 million for hostages since 2008. "Kidnapping for ransom has become today's most significant source of terrorist financing," said David S. Cohen, the U.S. Treasury Department's undersecretary for terrorism and financial intelligence.

When did al Qaida turn to kidnapping?
The terrorist group used to rely on donations from wealthy sympathizers, but as the West clamped down on that revenue stream — freezing bank accounts and killing al Qaida financiers with drone attacks — the leadership pivoted toward kidnapping. From 2008 to 2009, the number of hostages taken in Afghanistan surged from 584 to 2,088; in Pakistan, it rose from 1,264 to 3,366. The real pioneers, though, were al Qaida in the Islamic Maghreb (AQIM). In 2003, the group snatched up 32 European tourists in a series of raids in the Algerian desert. Expecting the operation to last just two weeks, the kidnappers were almost comically incompetent: They quickly ran out of food and fuel, and left their ransom note under a rock in the middle of the desert. Still, European governments eventually coughed up $6.5 million. AQIM invested this in better equipment and set about perfecting the art of kidnapping Westerners.

What is the group's modus operandi?
Rather than chasing high-value targets like government officials or corporate executives, AQIM takes anyone and everyone — journalists, aid workers, tourists — and demands ransoms from the hostages' governments. AQIM outsources the kidnapping itself to local criminals. Once they have the hostages, they drive them deep into the desert, where they have hidden food, fuel, and spare tires that can be relocated using GPS. One AQIM hostage, Italian tourist Mariasandra Mariani, saw her captors dig an entire vehicle out of a dune. "It was then," she said, "that I realized these aren't just normal criminals." The kidnappers use satellite phones to start negotiating with families, employers, and governments — a process that takes months or even years, and often ends with the delivery of a suitcase of cash. AQIM's methods have been so successful that they've been distilled into an online manual for other terrorist groups. And the rewards are getting bigger: In 2003, hostage taking generated about $200,000; today, it's up to $10 million.

Why the inflated price?
As governments keep paying ransoms, it encourages the terrorists to take more hostages and ask for more money. Last year, the G-8 nations signed a declaration agreeing not to pay, but most European countries have been breaking that promise, channeling money through aid agencies or the victims' employers to afford the government plausible deniability. France, one of the biggest culprits, has paid for the release of at least 10 hostages, reportedly forking over more than double any other nation. This hasn't escaped al Qaida's notice: Of the 53 people abducted by the group and its affiliates in the past five years, a third were French. "Hostages are an investment," said Jean-Paul Rouiller, director of the Geneva Center for Training and Analysis of Terrorism. "You are not going to invest unless you are pretty sure of a payout."

Which countries don't pay?
The U.S., Britain, and Poland. While the U.S. and the U.K. occasionally negotiate with terrorist groups — the prisoner swap involving Sgt. Bowe Bergdahl, for example — neither pays ransoms. As a result, terrorists kidnap far fewer American and British citizens. But the cost of that policy is that those who are captured are often executed. In 2009, AQIM kidnapped four tourists — a German woman, a Swiss couple, and a British man named Edwin Dyer — on their way back from a music festival in Mali. When the British government point-blank refused to pay, Dyer was executed; the others were released for a reported $10.4 million. "It seems Britain gives little importance to its citizens," the kidnappers sneered.

Do British and American hostages ever survive?
Occasionally. Instead of paying out, the U.S. and the U.K. often try to recover captives by force. The U.S. tried to rescue James Foley, but when special forces troops landed in Syria and conducted a fierce firefight with ISIS militants, they found he'd been moved to another location. Some raids, however, have been successful. Sometimes, an intermediary helps secure a hostage's freedom: Qatar, which often acts as a go-between for kidnappers and governments, negotiated the release of American journalist Peter Theo Curtis last week, without a ransom. But as long as other governments continue paying, the problem will only worsen. "Ransom payments lead to future kidnappings," said Cohen, the U.S. Treasury official. "Refusing to pay ransoms is, clearly, the surest way to break the cycle."

The rise of kidnapping insurance
Governments aren't the only ones paying ransoms. Kidnap and ransom insurance (K&R) has become a huge industry. About 75 percent of Fortune 500 companies hold K&R policies. Premiums run as high as $10,000 a day and can cover a multitude of costs: a crisis response team, psychiatric treatment, even a reward for informants. Yet most people with K&R probably don't even know they have it. Terrorists might target people they know are insured or extract a higher ransom from insurers, so many policies explicitly forbid employers from telling employees they're covered. For that reason, the vast majority of cases involving K&R are never reported to governments or reach the media. Taryn Evans, an analyst for security consultants AKE Group, says dozens of people covered by her company are abducted every month. "About one tenth of those cases are reported," she says. "We handle the rest."