California Legislature—2013–14 Regular Session

Assembly BillNo. 1649


Introduced by Assembly Member Waldron

February 11, 2014


An act to amend Section 502 of the Penal Code, relating to computer crimes.

LEGISLATIVE COUNSEL’S DIGEST

AB 1649, as introduced, Waldron. Computer crimes.

(1) Existing law makes it a crime to knowingly and without permission disrupt or cause the disruption of computer services or deny or cause the denial of computer services to an authorized user of a computer, computer system, or computer network. Existing law makes a violation of this provision punishable by a fine not exceeding $10,000, or by imprisonment in a county jail for 16 months, or 2 or 3 years, or by both that fine and imprisonment, or by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.

This bill would increase the fine to $20,000 for a felony violation, and to $10,000 for a misdemeanor violation, for a person who knowingly and without permission disrupts or causes the disruption of government computer services or public safety infrastructure computer system computer services, as defined, or denies or causes the denial of government computer services or public safety infrastructure computer system computer services to an authorized user.

(2) Existing law makes it a crime to knowingly access and without permission add, alter, damage, delete, or destroy any data, computer software, or computer program which resides or exists internal or external to a computer, computer system, or computer network. Existing law makes a violation of this provision punishable by a fine not exceeding $10,000, or by imprisonment in a county jail for 16 months, or 2 or 3 years, or by both that fine and imprisonment, or by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.

This bill would increase the fine to $20,000 for a felony violation, and to $10,000 for a misdemeanor violation, for a person who knowingly accesses and without permission adds, alters, damages, deletes, or destroys any data, computer software, or computer programs which reside or exist internal or external to a public safety infrastructure computer system computer, computer system, or computer network.

(3) Existing law makes it a crime to knowingly and without permission provide or assist in providing a means of accessing a computer, computer system, or computer network in violation of law. Existing law makes a violation this provision punishable by a fine not exceeding $1,000 for a first violation that does not result in injury, by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment for a violation that results in a victim expenditure in an amount not greater than $5,000, or for a 2nd or subsequent violation, and by a fine not exceeding $10,000, or by imprisonment in a county jail for 16 months, or 2 or 3 years, or by both that fine and imprisonment, or by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment, for a violation that results in a victim expenditure in an amount greater than $5,000.

The bill would increase the fine to $2,000 for a first violation that does not result in injury, to $10,000 for a violation that results in a victim expenditure in an amount not greater than $5,000, or for a 2nd or subsequent violation, and to $20,000 for a felony violation and to $10,000 for a misdemeanor violation, for a violation that results in victim expenditure in an amount greater than $5,000 for any person who knowingly and without permission provides or assists in providing a means of accessing a public safety infrastructure computer system computer, computer system, or computer network.

(4) Existing law makes it a crime to knowingly introduce a computer contaminant into any computer, computer system, or computer network. Existing law makes a violation of this provision punishable by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment, for a first violation that does not result in injury, and by a fine not exceeding $10,000, or by imprisonment in a county jail not exceeding one year, or by imprisonment in a county jail for 16 months, 2 or 3 years, or by both that fine and imprisonment for a violation that results in injury, or for a 2nd or subsequent violation.

This bill would increase the fine to $10,000 for a first violation that does not result in injury, and to $20,000 for a violation that results in injury, or for a 2nd or subsequent violation.

(5) Existing law makes it a crime to knowingly and without permission use the Internet domain name of another individual, corporation, or entity in connection with the sending of one or more electronic mail messages, and to thereby damage a computer, computer system, or computer network. Existing law makes a violation of these provisions punishable by a fine of $1,000 for a first violation that does not cause injury, and by imprisonment in a county jail not exceeding one year, or by a fine not exceeding $5,000, or by both that fine and imprisonment, for a violation that results in injury or for a 2nd or subsequent offense.

This bill would revise this crime to apply to any person who knowingly and without permission uses the Internet domain name or profile, as defined, of another individual, corporation, or entity in connection with the sending of one or more electronic mail messages or posts and thereby causes damage. The bill would define electronic mail for these purposes. By expanding the definition of a crime, this bill would impose a state-mandated local program.

The bill would also revise the definitions of “access,” “computer network,” and “computer services” for purposes of these provisions.

(6) The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Vote: majority. Appropriation: no. Fiscal committee: yes. State-mandated local program: yes.

The people of the State of California do enact as follows:

P3    1

SECTION 1.  

Section 502 of the Penal Code is amended to
2read:

3

502.  

(a) It is the intent of the Legislature in enacting this
4section to expand the degree of protection afforded to individuals,
P4    1businesses, and governmental agencies from tampering,
2interference, damage, and unauthorized access to lawfully created
3computer data and computer systems. The Legislature finds and
4declares that the proliferation of computer technology has resulted
5in a concomitant proliferation of computer crime and other forms
6of unauthorized access to computers, computer systems, and
7computer data.

8The Legislature further finds and declares that protection of the
9integrity of all types and forms of lawfully created computers,
10computer systems, and computer data is vital to the protection of
11the privacy of individuals as well as to the well-being of financial
12institutions, business concerns, governmental agencies, and others
13within this state that lawfully utilize those computers, computer
14systems, and data.

15(b) For the purposes of this section, the following terms have
16the following meanings:

17(1) “Access” means to gain entry to, instruct,begin insert cause input to,
18cause output from, cause data processing with,end insert
or communicate
19withbegin insert,end insert the logical, arithmetical, or memory function resources of a
20computer, computer system, or computer network.

21(2) “Computer network” means any system that provides
22communications between one or more computer systems and
23input/output devices including, but not limited to, display terminalsbegin insert,
24remote systems, mobile devices,end insert
and printers connected by
25telecommunication facilities.

26(3) “Computer program or software” means a set of instructions
27or statements, and related data, that when executed in actual or
28modified form, cause a computer, computer system, or computer
29network to perform specified functions.

30(4) “Computer services” includes, but is not limited to, computer
31time, data processing, or storage functions,begin insert Internet services,
32electronic mail services, electronic message services,end insert
or other uses
33of a computer, computer system, or computer network.

34(5) “Computer system” means a device or collection of devices,
35including support devices and excluding calculators that are not
36programmable and capable of being used in conjunction with
37external files, one or more of which contain computer programs,
38electronic instructions, input data, and output data, that performs
39functions including, but not limited to, logic, arithmetic, data
40storage and retrieval, communication, and control.

begin insert

P5    1(6) “Government computer system” means any computer system,
2or part thereof, that is owned, operated, or used by any federal,
3state, or local governmental entity.

end insert
begin insert

4(7) “Public safety infrastructure computer system” means any
5computer system, or part thereof, that is necessary for the health
6and safety of the public including computer systems owned,
7operated, or used by drinking water and wastewater treatment
8facilities, hospitals, emergency service providers,
9telecommunication companies, and gas and electric utility
10companies.

end insert
begin delete

11(6)

end delete

12begin insert(8)end insert “Data” means a representation of information, knowledge,
13facts, concepts, computer software, computer programs or
14instructions. Data may be in any form, in storage media, or as
15stored in the memory of the computer or in transit or presented on
16a display device.

begin delete

17(7)

end delete

18begin insert(9)end insert “Supporting documentation” includes, but is not limited to,
19all information, in any form, pertaining to the design, construction,
20classification, implementation, use, or modification of a computer,
21computer system, computer network, computer program, or
22computer software, which information is not generally available
23to the public and is necessary for the operation of a computer,
24computer system, computer network, computer program, or
25computer software.

begin delete

26(8)

end delete

27begin insert(10)end insert “Injury” means any alteration, deletion, damage, or
28destruction of a computer system, computer network, computer
29program, or data caused by the access, or the denial of access to
30legitimate users of a computer system, network, or program.

begin delete

31(9)

end delete

32begin insert(11)end insert “Victim expenditure” means any expenditure reasonably
33and necessarily incurred by the owner or lessee to verify that a
34computer system, computer network, computer program, or data
35was or was not altered, deleted, damaged, or destroyed by the
36access.

begin delete

37(10)

end delete

38begin insert(12)end insert “Computer contaminant” means any set of computer
39instructions that are designed to modify, damage, destroy, record,
40or transmit information within a computer, computer system, or
P6    1computer network without the intent or permission of the owner
2of the information. They include, but are not limited to, a group
3of computer instructions commonly called viruses or worms, that
4are self-replicating or self-propagating and are designed to
5contaminate other computer programs or computer data, consume
6computer resources, modify, destroy, record, or transmit data, or
7in some other fashion usurp the normal operation of the computer,
8computer system, or computer network.

begin delete

9(11)

end delete

10begin insert(13)end insert “Internet domain name” means a globally unique,
11hierarchical reference to an Internet host or service, assigned
12through centralized Internet naming authorities, comprising a series
13of character strings separated by periods, with the rightmost
14character string specifying the top of the hierarchy.

begin insert

15(14) “Electronic mail” means an electronic message or
16computer file that is transmitted between two or more
17telecommunications devices; computers; computer networks,
18regardless of whether the network is a local, regional, or global
19network; or electronic devices capable or receiving electronic
20messages, regardless of whether the message is converted to hard
21copy format after receipt, viewed upon transmission, or stored for
22later retrieval.

end insert
begin insert

23(15) “Profile” means either of the following:

end insert
begin insert

24(A) A configuration of user data required by a computer so that
25the user may access programs or services and have the desired
26functionality on that computer.

end insert
begin insert

27(B) An Internet Web site user’s personal page or section of a
28page that is made up of data, in text of graphical form, that displays
29significant, unique, or identifying information, including, but not
30limited to, listing acquaintances, interests, associations, activities,
31or personal statements.

end insert

32(c) Except as provided in subdivision (h), any person who
33commits any of the following acts is guilty of a public offense:

34(1) Knowingly accesses and without permission alters, damages,
35deletes, destroys, or otherwise uses any data, computer, computer
36system, or computer network in order to either (A) devise or
37execute any scheme or artifice to defraud, deceive, or extort, or
38(B) wrongfully control or obtain money, property, or data.

39(2) Knowingly accesses and without permission takes, copies,
40or makes use of any data from a computer, computer system, or
P7    1computer network, or takes or copies any supporting
2documentation, whether existing or residing internal or external
3to a computer, computer system, or computer network.

4(3) Knowingly and without permission uses or causes to be used
5computer services.

6(4) Knowingly accesses and without permission adds, alters,
7damages, deletes, or destroys any data, computer software, or
8computer programs which reside or exist internal or external to a
9computer, computer system, or computer network.

10(5) Knowingly and without permission disrupts or causes the
11disruption of computer services or denies or causes the denial of
12computer services to an authorized user of a computer, computer
13system, or computer network.

14(6) Knowingly and without permission provides or assists in
15providing a means of accessing a computer, computer system, or
16computer network in violation of this section.

17(7) Knowingly and without permission accesses or causes to be
18accessed any computer, computer system, or computer network.

19(8) Knowingly introduces any computer contaminant into any
20computer, computer system, or computer network.

21(9) Knowingly and without permission uses the Internet domain
22namebegin insert or profileend insert of another individual, corporation, or entity in
23connection with the sending of one or more electronic mail
24messagesbegin delete,end deletebegin insert or postsend insert and thereby damages or causes damage to a
25computer,begin insert computer data,end insert computer system, or computer network.

begin insert

26(10) Knowingly and without permission disrupts or causes the
27disruption of government computer services or denies or causes
28the denial of government computer services to an authorized user
29of a government computer, computer system, or computer network.

end insert
begin insert

30(11) Knowingly accesses and without permission adds, alters,
31damages, deletes, or destroys any data, computer software, or
32computer programs which reside or exist internal or external to
33a public safety infrastructure computer system computer, computer
34system, or computer network.

end insert
begin insert

35(12) Knowingly and without permission disrupts or causes the
36disruption of public safety infrastructure computer system computer
37services or denies or causes the denial of computer services to an
38authorized user of a public safety infrastructure computer system
39computer, computer system, or computer network.

end insert
begin insert

P8    1(13) Knowingly and without permission provides or assists in
2providing a means of accessing a computer, computer system, or
3public safety infrastructure computer system computer, computer
4system, or computer network in violation of this section.

end insert
begin insert

5(14) Knowingly introduces any computer contaminant into any
6public safety infrastructure computer system computer, computer
7system, or computer network.

end insert

8(d) (1) Any person who violates any of the provisions of
9paragraph (1), (2), (4), or (5) of subdivision (c) is punishable by
10a fine not exceeding ten thousand dollars ($10,000), or by
11imprisonment pursuant to subdivision (h) of Section 1170 for 16
12months, or two or three years, or by both that fine and
13imprisonment, or by a fine not exceeding five thousand dollars
14($5,000), or by imprisonment in a county jail not exceeding one
15year, or by both that fine and imprisonment.

16(2) Any person who violates paragraph (3) of subdivision (c)
17is punishable as follows:

18(A) For the first violation that does not result in injury, and
19where the value of the computer services used does not exceed
20nine hundred fifty dollars ($950), by a fine not exceeding five
21thousand dollars ($5,000), or by imprisonment in a county jail not
22exceeding one year, or by both that fine and imprisonment.

23(B) For any violation that results in a victim expenditure in an
24amount greater than five thousand dollars ($5,000) or in an injury,
25or if the value of the computer services used exceeds nine hundred
26fifty dollars ($950), or for any second or subsequent violation, by
27a fine not exceeding ten thousand dollars ($10,000), or by
28imprisonment pursuant to subdivision (h) of Section 1170 for 16
29months, or two or three years, or by both that fine and
30imprisonment, or by a fine not exceeding five thousand dollars
31($5,000), or by imprisonment in a county jail not exceeding one
32year, or by both that fine and imprisonment.

33(3) Any person who violates paragraph (6) or (7) of subdivision
34(c) is punishable as follows:

35(A) For a first violation that does not result in injury, an
36infraction punishable by a fine not exceeding one thousand dollars
37($1,000).

38(B) For any violation that results in a victim expenditure in an
39amount not greater than five thousand dollars ($5,000), or for a
40second or subsequent violation, by a fine not exceeding five
P9    1thousand dollars ($5,000), or by imprisonment in a county jail not
2exceeding one year, or by both that fine and imprisonment.

3(C) For any violation that results in a victim expenditure in an
4amount greater than five thousand dollars ($5,000), by a fine not
5exceeding ten thousand dollars ($10,000), or by imprisonment
6pursuant to subdivision (h) of Section 1170 for 16 months, or two
7or three years, or by both that fine and imprisonment, or by a fine
8not exceeding five thousand dollars ($5,000), or by imprisonment
9in a county jail not exceeding one year, or by both that fine and
10imprisonment.

11(4) Any person who violates paragraph (8) of subdivision (c)
12is punishable as follows:

13(A) For a first violation that does not result in injury, a
14misdemeanor punishable by a fine not exceeding five thousand
15dollars ($5,000), or by imprisonment in a county jail not exceeding
16one year, or by both that fine and imprisonment.

17(B) For any violation that results in injury, or for a second or
18subsequent violation, by a fine not exceeding ten thousand dollars
19($10,000), or by imprisonment in a county jail not exceeding one
20year, or by imprisonment pursuant to subdivision (h) of Section
211170, or by both that fine and imprisonment.

22(5) Any person who violates paragraph (9) of subdivision (c)
23is punishable as follows:

24(A) For a first violation that does not result in injury, an
25infraction punishable by a fine not one thousand dollars.

26(B) For any violation that results in injury, or for a second or
27subsequent violation, by a fine not exceeding five thousand dollars
28($5,000), or by imprisonment in a county jail not exceeding one
29year, or by both that fine and imprisonment.

begin insert

30(6) Any person who violates paragraph (10) of subdivision (c)
31is punishable by a fine not exceeding twenty thousand dollars
32($20,000), or by imprisonment pursuant to subdivision (h) of
33Section 1170 for 16 months, or two or three years, or by both that
34fine and imprisonment, or by a fine not exceeding ten thousand
35dollars ($10,000), or by imprisonment in a county jail not
36exceeding one year, or by both that fine and imprisonment.

end insert
begin insert

37(7) Any person who violates any of the provisions of paragraph
38(11) or (12) of subdivision (c) is punishable by a fine not exceeding
39twenty thousand dollars ($20,000), or by imprisonment pursuant
40to subdivision (h) of Section 1170 for 16 months, or two or three
P10   1years, or by both that fine and imprisonment, or by a fine not
2exceeding ten thousand dollars ($10,000), or by imprisonment in
3a county jail not exceeding one year, or by both that fine and
4imprisonment.

end insert
begin insert

5(8) Any person who violates paragraph (13) of subdivision (c)
6is punishable as follows:

end insert
begin insert

7(A) For a first violation that does not result in injury, an
8infraction punishable by a fine not exceeding two thousand dollars
9 ($2,000).

end insert
begin insert

10(B) For a violation that results in a victim expenditure in an
11amount not greater than five thousand dollars ($5,000), or for a
12second or subsequent violation, by a fine not exceeding ten
13thousand dollars ($10,000), or by imprisonment in a county jail
14not exceeding one year, or by both that fine and imprisonment.

end insert
begin insert

15(C) For any violation that results in a victim expenditure in an
16amount greater than five thousand dollars ($5,000), by a fine not
17exceeding twenty thousand dollars ($20,000), or by imprisonment
18pursuant to subdivision (h) of Section 1170 for 16 months, or two
19or three years, or by both that fine and imprisonment, or by a fine
20not exceeding ten thousand dollars ($10,000), or by imprisonment
21in a county jail not exceeding one year, or by both that fine and
22imprisonment.

end insert
begin insert

23(9) Any person who violates paragraph (14) of subdivision (c)
24is punishable as follows:

end insert
begin insert

25(A) For a first violation that does not result in injury, a
26misdemeanor punishable by a fine not exceeding ten thousand
27dollars ($10,000), or by imprisonment in a county jail not
28exceeding one year, or by both that fine and imprisonment.

end insert
begin insert

29(B) For any violation that results in injury, or for a second or
30subsequent violation, by a fine not exceeding twenty thousand
31dollars ($20,000), or by imprisonment in a county jail not
32exceeding one year, or by imprisonment pursuant to subdivision
33(h) of Section 1170, or by both that fine and imprisonment.

end insert

34(e) (1) In addition to any other civil remedy available, the owner
35or lessee of the computer, computer system, computer network,
36computer program, or data who suffers damage or loss by reason
37of a violation of any of the provisions of subdivision (c) may bring
38a civil action against the violator for compensatory damages and
39injunctive relief or other equitable relief. Compensatory damages
40shall include any expenditure reasonably and necessarily incurred
P11   1by the owner or lessee to verify that a computer system, computer
2network, computer program, or data was or was not altered,
3damaged, or deleted by the access. For the purposes of actions
4authorized by this subdivision, the conduct of an unemancipated
5minor shall be imputed to the parent or legal guardian having
6control or custody of the minor, pursuant to the provisions of
7Section 1714.1 of the Civil Code.

8(2) In any action brought pursuant to this subdivision the court
9may award reasonable attorney’s fees.

10(3) A community college, state university, or academic
11institution accredited in this state is required to include
12computer-related crimes as a specific violation of college or
13university student conduct policies and regulations that may subject
14a student to disciplinary sanctions up to and including dismissal
15from the academic institution. This paragraph shall not apply to
16the University of California unless the Board of Regents adopts a
17resolution to that effect.

18(4) In any action brought pursuant to this subdivision for a
19willful violation of the provisions of subdivision (c), where it is
20proved by clear and convincing evidence that a defendant has been
21guilty of oppression, fraud, or malice as defined in subdivision (c)
22of Section 3294 of the Civil Code, the court may additionally award
23punitive or exemplary damages.

24(5) No action may be brought pursuant to this subdivision unless
25it is initiated within three years of the date of the act complained
26of, or the date of the discovery of the damage, whichever is later.

27(f) This section shall not be construed to preclude the
28applicability of any other provision of the criminal law of this state
29which applies or may apply to any transaction, nor shall it make
30illegal any employee labor relations activities that are within the
31scope and protection of state or federal labor laws.

32(g) Any computer, computer system, computer network, or any
33software or data, owned by the defendant, that is used during the
34commission of any public offense described in subdivision (c) or
35any computer, owned by the defendant, which is used as a
36repository for the storage of software or data illegally obtained in
37violation of subdivision (c) shall be subject to forfeiture, as
38specified in Section 502.01.

39(h) (1) Subdivision (c) does not apply to punish any acts which
40are committed by a person within the scope of his or her lawful
P12   1employment. For purposes of this section, a person acts within the
2scope of his or her employment when he or she performs acts
3which are reasonably necessary to the performance of his or her
4work assignment.

5(2) Paragraph (3) of subdivision (c) does not apply to penalize
6any acts committed by a person acting outside of his or her lawful
7employment, provided that the employee’s activities do not cause
8an injury, as defined in paragraph (8) of subdivision (b), to the
9employer or another, or provided that the value of supplies or
10computer services, as defined in paragraph (4) of subdivision (b),
11which are used does not exceed an accumulated total of two
12hundred fifty dollars ($250).

13(i) No activity exempted from prosecution under paragraph (2)
14of subdivision (h) which incidentally violates paragraph (2), (4),
15or (7) of subdivision (c) shall be prosecuted under those paragraphs.

16(j) For purposes of bringing a civil or a criminal action under
17this section, a person who causes, by any means, the access of a
18computer, computer system, or computer network in one
19jurisdiction from another jurisdiction is deemed to have personally
20accessed the computer, computer system, or computer network in
21each jurisdiction.

22(k) In determining the terms and conditions applicable to a
23person convicted of a violation of this section the court shall
24consider the following:

25(1) The court shall consider prohibitions on access to and use
26of computers.

27(2) Except as otherwise required by law, the court shall consider
28alternate sentencing, including community service, if the defendant
29shows remorse and recognition of the wrongdoing, and an
30inclination not to repeat the offense.

31

SEC. 2.  

No reimbursement is required by this act pursuant to
32Section 6 of Article XIII B of the California Constitution because
33the only costs that may be incurred by a local agency or school
34district will be incurred because this act creates a new crime or
35infraction, eliminates a crime or infraction, or changes the penalty
36for a crime or infraction, within the meaning of Section 17556 of
37the Government Code, or changes the definition of a crime within
P13   1the meaning of Section 6 of Article XIII B of the California
2Constitution.



O

    99