Maryland bill would outlaw ransomware, keep researchers from reporting bugs

Remember last May, when Baltimore City was brought to a standstill by ransomware? Hot on the heels of that mess—in fact, the same day that the ransomware attack was reported—Maryland legislators started working on a bill to fight the threat of ransomware.

The results could use a little more work. A proposed law introduced in Maryland's state senate last week would criminalize the possession of ransomware and other criminal activities with a computer. But while it makes an attempt to protect actual researchers from prosecution, the language of the bill doesn't exactly do much to protect the general public from ransomware or make it easier for researchers to prevent attacks.

The bill, Senate Bill 3, covers a lot of ground already covered by US Federal law. But it classifies the mere possession of ransomware as a misdemeanor punishable by up to 10 years of imprisonment and a fine of up to $10,000. The bill also states (in all capital letters in the draft) that "THIS PARAGRAPH DOES NOT APPLY TO THE USE OF RANSOMWARE FOR RESEARCH PURPOSES."

Additionally, the bill would outlaw unauthorized intentional access or attempts to access "all or part of a computer network, computer control language, computer, computer software, computer system, computer service, or computer database; or copy, attempt to copy, possess, or attempt to possess the contents of all or part of a computer database accessed." It also would criminalize under Maryland law any act intended to "cause the malfunction or interrupt the operation of all or any part" of a network, the computers on it, or their software and data, or "possess, identify, or attempt to identify a valid access code; or publicize or distribute a valid access code to an unauthorized person."

There are no research exclusions in the bill for these provisions. And that's a potential problem, according to Katie Moussouris, the founder and CEO of Luta Security and a well-known expert on the issues of vulnerability disclosure—she created the bug-bounty program at Microsoft while at that company.

Moussouris told Ars that the way the bill is currently worded "would prohibit vulnerability disclosure unless the specific systems or data accessed by the helpful security researcher were explicitly authorized ahead of time and would prohibit public disclosure if the reports were ignored."

The bill gives some leeway on sentencing for violations, but it carries substantial teeth as well. While access or attempted access would be a misdemeanor (punishable by a fine of $1,000, three years of imprisonment, or both), breaching databases would be a felony if damages were determined to be greater than $10,000—punishable by a sentence of up to 10 years, a fine of $10,000, or both. The punishments go up if systems belonging to the state government, electric and gas utilities, or public utilities are involved, with up to 10 years of imprisonment and a $25,000 fine if more than $50,000 in damage is done.

The problem, of course, is that these measures would do little to deter ransomware operators themselves. Ransomware campaigns are almost universally run by overseas crime rings, many of them in Russia or other countries that would be unlikely to extradite for violations of a state law. And there are no provisions regarding actual security standards for the local government and other non-state agencies that have been the most public victims of these sorts of attacks in Maryland.