Delegation presses for tougher penalties for attacks on 9-1-1 centers and other critical infrastructure

House Bills 445 and 444, both presented by Delegate Terry Hill, would expand Maryland's criminal penalties for interfering with 9-1-1 public-safety answering points and for interference with broader categories of critical infrastructure, including cyber attacks such as ransomware and denial-of-service assaults.

"These are the systems that we use to keep our residents safe and we need to be able to rely on those," Sarah Sample of the Maryland Association of Counties told the committee in support, adding local governments worry about increasingly sophisticated attacks. Chief Robert Phillips, legislative chair for the Maryland State Firefighters Association and former Cambridge fire chief, said the call-routing and supporting infrastructure are vital to first-responder operations and service interruptions can be "catastrophic."

Delegate Hill told the committee 444 expands the protections of 445 by defining "critical infrastructure" to include both physical and virtual systems whose incapacitation would have a debilitating impact on public security, economic security, public health or public safety. The bill sets felony penalties for certain intentional or successful attacks, with proposed penalties of up to five years and $25,000 for attempted disabling acts and up to 10 years and $50,000 when successful, Hill said; the sponsor said the work group that developed the penalties looked to related statutes for guidance.

Witnesses urged a favorable vote; no committee vote was recorded during the hearing. Supporters said the change would align Maryland law with the modern character of cyber threats and provide clearer tools for prosecutors to charge bad actors targeting public-safety and critical systems.