Ride the Lightning

Will Maryland Be the Third State to Criminalize Ransomware Possession and Distribution?

January 28, 2020

Bitdefender's Hot for Security blog carried a post on January 22 covering a new bill that would make it illegal to own and distribute ransomware and it stiffens punishment for ransomware operators.

If the bill passes, Maryland would be the third state, after Michigan and Wyoming, to criminalize the possession and distribution of ransomware. The bill makes exceptions for penetration testing, security researchers, and other legitimate reasons to own ransomware.

The bill is designed to give prosecutors the right tools. Democrat State Senator Susan Lee, the sponsor of the bill, enrolled the help of Markus Rauschecker, the Cybersecurity Program director of the University of Maryland Center for Health & Homeland Security.

"It's important to send that signal. This bill highlights the threat and how big it is," said Rauschecker to lawmakers, according to Capital News Service. If the bill becomes law, using ransomware would be classified as a misdemeanor and carry a penalty of up to ten years in jail and/or a fine up to $10,000.

As readers of RTL will remember, hackers hit Baltimore with a RobbinHood ransomware attack on May 7, 2019. All administrative transactions, payments and communications were frozen after city officials refused to pay the attackers. It took them more than eight weeks to restore all systems.

Following the attack, Baltimore City's board allocated $10 million to an emergency ransomware response to prevent similar attacks. When the dust settled, the city estimated recovery costs at $18 million.

The current law in Maryland specifies that a cyberattack that incurs damages of less than $10,000 is a misdemeanor and carries a punishment of up to five years in prison and a fine up to $10,000. If the damages pass the $10,000 mark, it turns into a felony, and the punishment goes up to 10 years in prison.

The new bill would dispense with limits for damages and raises the punishment to up to 10 years, even if it's a misdemeanor. This is a step in the right direction, but corralling these ransomware gangs is one hell of a challenge.

Sharon D. Nelson, Esq., President, Sensei Enterprises, Inc.
3975 University Drive, Suite 225|Fairfax, VA 22030
Email: Phone: 703-359-0700
Digital Forensics/Cybersecurity/Information Technology
https://senseient.com
https://twitter.com/sharonnelsonesq
https://www.linkedin.com/in/sharondnelson
https://amazon.com/author/sharonnelson