Moldovan government approves harsher penalties for cyberattacks on information systems part of critical infrastructure

Cyberattacks on information systems that are part of critical infrastructure, such as the ones in the energy, healthcare, transport and banking sectors, will be subject to harsher penalties. The government approved a draft providing for this today.

At the cabinet meeting, Justice Minister Vladislav Cojuhari has said that the draft would strengthen the criminal protection of data, information systems and essential services, while also providing criminal investigators, prosecutors and courts with clearer and more predictable rules for combating cybercrime.

„The draft provides for harsher criminal penalties for attacks targeting information systems that are part of critical infrastructure, such as the ones in the energy, healthcare, transport and banking sectors, taking into account the serious consequences which such acts may have for the population and the working of essential services. Therefore, in the context of the growing risks to the security of information systems, also highlighted by the recent cyberattack, the draft will strengthen the criminal protection of data, information systems and essential services, while also providing criminal investigators, prosecutors and courts with clearer and more predictable rules for combating cybercrime,” Minister Cojuhari said.

Vladislav Cojuhari emphasized that the bill had been drafted under circumstances in which the criminal framework already regulates the main forms of cybercrime. However, the compatibility analysis highlighted the need for adjustments that would more accurately reflect the way such attacks are committed today.

„This draft clarifies and supplements the provisions concerning unauthorized access to information systems, interference with data and disruption of system operations. Thus, it is clarified that illegal access may target either an entire information system or only part of it, while violating security measures, such as passwords or other access-control mechanisms, constitutes an aggravating circumstance,” Vladislav Cojuhari noted.

The document also expands the list of ways offenses may be committed, so that the unlawful insertion, compromise or deletion of computer data, preventing access to such data and interrupting the operation of an information system are expressly punishable.

Other amendments concern the tools used to commit cybercrime. The draft distinguishes between computer programmes and technical means, on the one hand, and passwords and access codes, on the other. The sanctioned actions also include acquiring or distributing these tools on criminal purposes.