Amended in Senate July 15, 2015

Amended in Assembly April 7, 2015

California Legislature—2015–16 Regular Session

Assembly BillNo. 32


Introduced by Assembly Member Waldron

(Coauthors: Assembly Members Chávez and Jones)

(Coauthor: Senator Allen)

December 1, 2014


An act to amendbegin delete Sectionsend deletebegin insert Sectionend insert 502begin delete and 803end delete of the Penal Code, relating to computer crimes.

LEGISLATIVE COUNSEL’S DIGEST

AB 32, as amended, Waldron. Computer crimes.

Existing law establishes various crimes relating to computer services and systems, including to knowingly and without permission disrupt or cause the disruption of computer services including government computer services or public safety infrastructure computer system computer services, add, alter, damage, delete, or destroy any computer data, software, or program, introduce a computer contaminant, use the Internet domain name or profile of another. Existing law makes a violation of these provisions punishable by specified fines or terms of imprisonment, or by both those fines and imprisonment.begin delete Existing law establishes the time limitation during which a criminal complaint for a violation of these provisions may be filed.end delete

This bill wouldbegin delete increase the fine for a misdemeanor violation of those crimes from a fine not exceeding $5,000 to a fine not exceeding $10,000. The bill would toll, until discovery of the offense, the time for filing a criminal complaint for a violation of those provisions when it is alleged that the defendant acquired, copied, or distributed a digital image of an intimate body part, as defined, of a person.end deletebegin insert clarify the criminal penalties for specified computer crimes by making a person who violates those provisions guilty of a felony, punishable by imprisonment in a county jail for 16 months, or 2 or 3 years and a fine not exceeding $10,000, or a misdemeanor, punishable by imprisonment in a county jail not exceeding one year, by a fine not exceeding $5,000, or by both that fine and imprisonment.end insert

Vote: majority. Appropriation: no. Fiscal committee: no. State-mandated local program: no.

The people of the State of California do enact as follows:

P2    1

SECTION 1.  

Section 502 of the Penal Code is amended to
2read:

3

502.  

(a) It is the intent of the Legislature in enacting this
4section to expand the degree of protection afforded to individuals,
5businesses, and governmental agencies from tampering,
6interference, damage, and unauthorized access to lawfully created
7computer data and computer systems. The Legislature finds and
8declares that the proliferation of computer technology has resulted
9in a concomitant proliferation of computer crime and other forms
10of unauthorized access to computers, computer systems, and
11computer data.

12The Legislature further finds and declares that protection of the
13integrity of all types and forms of lawfully created computers,
14computer systems, and computer data is vital to the protection of
15the privacy of individuals as well as to the well-being of financial
16institutions, business concerns, governmental agencies, and others
17within this state that lawfully utilize those computers, computer
18systems, and data.

19(b) For the purposes of this section, the following terms have
20the following meanings:

21(1) “Access” means to gain entry to, instruct, cause input to,
22cause output from, cause data processing with, or communicate
23with, the logical, arithmetical, or memory function resources of a
24computer, computer system, or computer network.

25(2) “Computer network” means any system that provides
26communications between one or more computer systems and
27input/output devices, including, but not limited to, display
P3    1terminals, remote systems, mobile devices, and printers connected
2by telecommunication facilities.

3(3) “Computer program or software” means a set of instructions
4or statements, and related data, that when executed in actual or
5modified form, cause a computer, computer system, or computer
6network to perform specified functions.

7(4) “Computer services” includes, but is not limited to, computer
8time, data processing, or storage functions, Internet services,
9electronic mail services, electronic message services, or other uses
10of a computer, computer system, or computer network.

11(5) “Computer system” means a device or collection of devices,
12including support devices and excluding calculators that are not
13programmable and capable of being used in conjunction with
14external files, one or more of which contain computer programs,
15electronic instructions, input data, and output data, that performs
16functions, including, but not limited to, logic, arithmetic, data
17storage and retrieval, communication, and control.

18(6) “Government computer system” means any computer system,
19or part thereof, that is owned, operated, or used by any federal,
20state, or local governmental entity.

21(7) “Public safety infrastructure computer system” means any
22computer system, or part thereof, that is necessary for the health
23and safety of the public including computer systems owned,
24operated, or used by drinking water and wastewater treatment
25facilities, hospitals, emergency service providers,
26telecommunication companies, and gas and electric utility
27companies.

28(8) “Data” means a representation of information, knowledge,
29facts, concepts, computer software,begin insert orend insert computer programs or
30instructions. Data may be in any form, in storage media, or as
31stored in the memory of the computer or in transit or presented on
32a display device.

33(9) “Supporting documentation” includes, but is not limited to,
34all information, in any form, pertaining to the design, construction,
35classification, implementation, use, or modification of a computer,
36computer system, computer network, computer program, or
37computer software, which information is not generally available
38to the public and is necessary for the operation of a computer,
39computer system, computer network, computer program, or
40computer software.

P4    1(10) “Injury” means any alteration, deletion, damage, or
2destruction of a computer system, computer network, computer
3program, or data caused by the access, or the denial of access to
4legitimate users of a computer system, network, or program.

5(11) “Victim expenditure” means any expenditure reasonably
6and necessarily incurred by the owner or lessee to verify that a
7computer system, computer network, computer program, or data
8was or was not altered, deleted, damaged, or destroyed by the
9access.

10(12) “Computer contaminant” means any set of computer
11instructions that are designed to modify, damage, destroy, record,
12or transmit information within a computer, computer system, or
13computer network without the intent or permission of the owner
14of the information. They include, but are not limited to, a group
15of computer instructions commonly called viruses or worms, that
16are self-replicating or self-propagating and are designed to
17contaminate other computer programs or computer data, consume
18computer resources, modify, destroy, record, or transmit data, or
19in some other fashion usurp the normal operation of the computer,
20computer system, or computer network.

21(13) “Internet domain name” means a globally unique,
22hierarchical reference to an Internet host or service, assigned
23through centralized Internet naming authorities, comprising a series
24of character strings separated by periods, with the rightmost
25character string specifying the top of the hierarchy.

26(14) “Electronic mail” means an electronic message or computer
27file that is transmitted between two or more telecommunications
28devices; computers; computer networks, regardless of whether the
29network is a local, regional, or global network; or electronic devices
30capable of receiving electronic messages, regardless of whether
31the message is converted to hard copy format after receipt, viewed
32upon transmission, or stored for later retrieval.

33(15) “Profile” means either of the following:

34(A) A configuration of user data required by a computer so that
35the user may access programs or services and have the desired
36functionality on that computer.

37(B) An Internet Web site user’s personal page or section of a
38page that is made up of data, in text or graphical form, that displays
39significant, unique, or identifying information, including, but not
P5    1limited to, listing acquaintances, interests, associations, activities,
2or personal statements.

3(c) Except as provided in subdivision (h), any person who
4commits any of the following acts is guilty of a public offense:

5(1) Knowingly accesses and without permission alters, damages,
6deletes, destroys, or otherwise uses any data, computer, computer
7system, or computer network in order to either (A) devise or
8execute any scheme or artifice to defraud, deceive, or extort, or
9(B) wrongfully control or obtain money, property, or data.

10(2) Knowingly accesses and without permission takes, copies,
11or makes use of any data from a computer, computer system, or
12computer network, or takes or copies any supporting
13documentation, whether existing or residing internal or external
14to a computer, computer system, or computer network.

15(3) Knowingly and without permission uses or causes to be used
16computer services.

17(4) Knowingly accesses and without permission adds, alters,
18damages, deletes, or destroys any data, computer software, or
19computer programs which reside or exist internal or external to a
20computer, computer system, or computer network.

21(5) Knowingly and without permission disrupts or causes the
22disruption of computer services or denies or causes the denial of
23computer services to an authorized user of a computer, computer
24system, or computer network.

25(6) Knowingly and without permission provides or assists in
26providing a means of accessing a computer, computer system, or
27computer network in violation of this section.

28(7) Knowingly and without permission accesses or causes to be
29accessed any computer, computer system, or computer network.

30(8) Knowingly introduces any computer contaminant into any
31computer, computer system, or computer network.

32(9) Knowingly and without permission uses the Internet domain
33name or profile of another individual, corporation, or entity in
34connection with the sending of one or more electronic mail
35messages or posts and thereby damages or causes damage to a
36 computer, computer data, computer system, or computer network.

37(10) Knowingly and without permission disrupts or causes the
38disruption of government computer services or denies or causes
39the denial of government computer services to an authorized user
40of a government computer, computer system, or computer network.

P6    1(11) Knowingly accesses and without permission adds, alters,
2damages, deletes, or destroys any data, computer software, or
3computer programs which reside or exist internal or external to a
4public safety infrastructure computer system computer, computer
5system, or computer network.

6(12) Knowingly and without permission disrupts or causes the
7disruption of public safety infrastructure computer system computer
8services or denies or causes the denial of computer services to an
9authorized user of a public safety infrastructure computer system
10computer, computer system, or computer network.

11(13) Knowingly and without permission provides or assists in
12providing a means of accessing a computer, computer system, or
13public safety infrastructure computer system computer, computer
14system, or computer network in violation of this section.

15(14) Knowingly introduces any computer contaminant into any
16public safety infrastructure computer system computer, computer
17system, or computer network.

18(d) (1) Any person who violates any of the provisions of
19paragraph (1), (2), (4), (5), (10), (11), or (12) of subdivision (c) is
20begin insert guilty of a felony,end insert punishable bybegin delete a fine not exceeding ten thousand
21dollars ($10,000), or byend delete
imprisonment pursuant to subdivision (h)
22of Section 1170 for 16 months, or two or threebegin delete years, or by both
23that fine and imprisonment, or by a fine not exceeding ten thousand
24dollars ($10,000), orend delete
begin insert years and a fine not exceeding ten thousand
25dollars ($10,000), or a misdemeanor, punishableend insert
by imprisonment
26in a county jail not exceeding one year,begin insert by a fine not exceeding
27five thousand dollars ($5,000),end insert
or by both that fine and
28imprisonment.

29(2) Any person who violates paragraph (3) of subdivision (c)
30is punishable as follows:

31(A) For the first violation that does not result in injury, and
32where the value of the computer services used does not exceed
33nine hundred fifty dollars ($950), by a fine not exceedingbegin delete tenend deletebegin insert fiveend insert
34 thousand dollarsbegin delete ($10,000),end deletebegin insert ($5,000),end insert or by imprisonment in a
35county jail not exceeding one year, or by both that fine and
36imprisonment.

37(B) For any violation that results in a victim expenditure in an
38amount greater than five thousand dollars ($5,000) or in an injury,
39or if the value of the computer services used exceeds nine hundred
40fifty dollars ($950), or for any second or subsequent violation, by
P7    1a fine not exceeding ten thousand dollars ($10,000), or by
2imprisonment pursuant to subdivision (h) of Section 1170 for 16
3months, or two or three years, or by both that fine and
4imprisonment, or by a fine not exceedingbegin delete tenend deletebegin insert fiveend insert thousand dollars
5begin delete ($10,000),end deletebegin insert ($5,000),end insert or by imprisonment in a county jail not
6exceeding one year, or by both that fine and imprisonment.

7(3) Any person who violates paragraph (6), (7), or (13) of
8subdivision (c) is punishable as follows:

9(A) For a first violation that does not result in injury, an
10infraction punishable by a fine not exceeding one thousand dollars
11($1,000).

12(B) For any violation that results in a victim expenditure in an
13amount not greater than five thousand dollars ($5,000), or for a
14second or subsequent violation, by a fine not exceedingbegin delete tenend deletebegin insert fiveend insert
15 thousand dollarsbegin delete ($10,000),end deletebegin insert ($5,000),end insert or by imprisonment in a
16county jail not exceeding one year, or by both that fine and
17imprisonment.

18(C) For any violation that results in a victim expenditure in an
19amount greater than five thousand dollars ($5,000), by a fine not
20exceeding ten thousand dollars ($10,000), or by imprisonment
21pursuant to subdivision (h) of Section 1170 for 16 months, or two
22or three years, or by both that fine and imprisonment, or by a fine
23not exceedingbegin delete tenend deletebegin insert fiveend insert thousand dollarsbegin delete ($10,000),end deletebegin insert ($5,000),end insert or by
24imprisonment in a county jail not exceeding one year, or by both
25that fine and imprisonment.

26(4) Any person who violates paragraph (8) or (14) of subdivision
27(c) is punishable as follows:

28(A) For a first violation that does not result in injury, a
29misdemeanor punishable by a fine not exceedingbegin delete tenend deletebegin insert fiveend insert thousand
30dollarsbegin delete ($10,000),end deletebegin insert ($5,000),end insert or by imprisonment in a county jail
31not exceeding one year, or by both that fine and imprisonment.

32(B) For any violation that results in injury, or for a second or
33subsequent violation, by a fine not exceeding ten thousand dollars
34($10,000), or by imprisonment in a county jail not exceeding one
35year, or by imprisonment pursuant to subdivision (h) of Section
361170, or by both that fine and imprisonment.

37(5) Any person who violates paragraph (9) of subdivision (c)
38is punishable as follows:

P8    1(A) For a first violation that does not result in injury, an
2infraction punishable by a fine not exceeding one thousand dollars
3($1,000).

4(B) For any violation that results in injury, or for a second or
5subsequent violation, by a fine not exceedingbegin delete tenend deletebegin insert fiveend insert thousand
6dollarsbegin delete ($10,000),end deletebegin insert ($5,000),end insert or by imprisonment in a county jail
7not exceeding one year, or by both that fine and imprisonment.

8(e) (1) In addition to any other civil remedy available, the owner
9or lessee of the computer, computer system, computer network,
10computer program, or data who suffers damage or loss by reason
11of a violation of any of the provisions of subdivision (c) may bring
12a civil action against the violator for compensatory damages and
13injunctive relief or other equitable relief. Compensatory damages
14shall include any expenditure reasonably and necessarily incurred
15by the owner or lessee to verify that a computer system, computer
16network, computer program, or data was or was not altered,
17damaged, or deleted by the access. For the purposes of actions
18authorized by this subdivision, the conduct of an unemancipated
19minor shall be imputed to the parent or legal guardian having
20control or custody of the minor, pursuant to the provisions of
21Section 1714.1 of the Civil Code.

22(2) In any action brought pursuant to this subdivision the court
23may award reasonable attorney’s fees.

24(3) A community college, state university, or academic
25institution accredited in this state is required to include
26computer-related crimes as a specific violation of college or
27university student conduct policies and regulations that may subject
28a student to disciplinary sanctions up to and including dismissal
29from the academic institution. This paragraph shall not apply to
30the University of California unless the Board of Regents adopts a
31resolution to that effect.

32(4) In any action brought pursuant to this subdivision for a
33willful violation of the provisions of subdivision (c), where it is
34proved by clear and convincing evidence that a defendant has been
35guilty of oppression, fraud, or malice as defined in subdivision (c)
36of Section 3294 of the Civil Code, the court may additionally award
37punitive or exemplary damages.

38(5) No action may be brought pursuant to this subdivision unless
39it is initiated within three years of the date of the act complained
40of, or the date of the discovery of the damage, whichever is later.

P9    1(f) This section shall not be construed to preclude the
2applicability of any other provision of the criminal law of this state
3which applies or may apply to any transaction, nor shall it make
4illegal any employee labor relations activities that are within the
5scope and protection of state or federal labor laws.

6(g) Any computer, computer system, computer network, or any
7software or data, owned by the defendant, that is used during the
8commission of any public offense described in subdivision (c) or
9any computer, owned by the defendant, which is used as a
10repository for the storage of software or data illegally obtained in
11violation of subdivision (c) shall be subject to forfeiture, as
12specified in Section 502.01.

13(h) (1) Subdivision (c) does not apply to punish any acts which
14are committed by a person within the scope of his or her lawful
15employment. For purposes of this section, a person acts within the
16scope of his or her employment when he or she performs acts
17which are reasonably necessary to the performance of his or her
18work assignment.

19(2) Paragraph (3) of subdivision (c) does not apply to penalize
20any acts committed by a person acting outside of his or her lawful
21employment, provided that the employee’s activities do not cause
22an injury, to the employer or another, or provided that the value
23of supplies or computer services which are used does not exceed
24an accumulated total of two hundred fifty dollars ($250).

25(i) No activity exempted from prosecution under paragraph (2)
26of subdivision (h) which incidentally violates paragraph (2), (4),
27or (7) of subdivision (c) shall be prosecuted under those paragraphs.

28(j) For purposes of bringing a civil or a criminal action under
29this section, a person who causes, by any means, the access of a
30computer, computer system, or computer network in one
31jurisdiction from another jurisdiction is deemed to have personally
32accessed the computer, computer system, or computer network in
33each jurisdiction.

34(k) In determining the terms and conditions applicable to a
35person convicted of a violation of this section the court shall
36consider the following:

37(1) The court shall consider prohibitions on access to and use
38of computers.

39(2) Except as otherwise required by law, the court shall consider
40alternate sentencing, including community service, if the defendant
P10   1shows remorse and recognition of the wrongdoing, and an
2inclination not to repeat the offense.

begin delete
3

SEC. 2.  

Section 803 of the Penal Code is amended to read:

4

803.  

(a) Except as provided in this section, a limitation of time
5prescribed in this chapter is not tolled or extended for any reason.

6(b) No time during which prosecution of the same person for
7the same conduct is pending in a court of this state is a part of a
8limitation of time prescribed in this chapter.

9(c) A limitation of time prescribed in this chapter does not
10commence to run until the discovery of an offense described in
11this subdivision. This subdivision applies to an offense punishable
12by imprisonment in the state prison or imprisonment pursuant to
13subdivision (h) of Section 1170, a material element of which is
14fraud or breach of a fiduciary obligation, the commission of the
15crimes of theft or embezzlement upon an elder or dependent adult,
16or the basis of which is misconduct in office by a public officer,
17employee, or appointee, including, but not limited to, the following
18offenses:

19(1) Grand theft of any type, forgery, falsification of public
20records, or acceptance of a bribe by a public official or a public
21employee.

22(2) A violation of Section 72, 118, 118a, 132, 134, or 186.10.

23(3) A violation of Section 25540, of any type, or Section 25541
24of the Corporations Code.

25(4) A violation of Section 1090 or 27443 of the Government
26Code.

27(5) Felony welfare fraud or Medi-Cal fraud in violation of
28Section 11483 or 14107 of the Welfare and Institutions Code.

29(6) Felony insurance fraud in violation of Section 548 or 550
30of this code or former Section 1871.1, or Section 1871.4 of the
31Insurance Code.

32(7) A violation of Section 580, 581, 582, 583, or 584 of the
33Business and Professions Code.

34(8) A violation of Section 22430 of the Business and Professions
35Code.

36(9) A violation of Section 103800 of the Health and Safety
37Code.

38(10) A violation of Section 529a.

39(11) A violation of subdivision (d) or (e) of Section 368.

P11   1(d) If the defendant is out of the state when or after the offense
2is committed, the prosecution may be commenced as provided in
3Section 804 within the limitations of time prescribed by this
4chapter, and no time up to a maximum of three years during which
5the defendant is not within the state shall be a part of those
6limitations.

7(e) A limitation of time prescribed in this chapter does not
8commence to run until the offense has been discovered, or could
9have reasonably been discovered, with regard to offenses under
10Division 7 (commencing with Section 13000) of the Water Code,
11under Chapter 6.5 (commencing with Section 25100) of, Chapter
126.7 (commencing with Section 25280) of, or Chapter 6.8
13(commencing with Section 25300) of, Division 20 of, or Part 4
14(commencing with Section 41500) of Division 26 of, the Health
15and Safety Code, or under Section 386, or offenses under Chapter
165 (commencing with Section 2000) of Division 2 of, Chapter 9
17(commencing with Section 4000) of Division 2 of, Section 6126
18of, Chapter 10 (commencing with Section 7301) of Division 3 of,
19or Chapter 19.5 (commencing with Section 22440) of Division 8
20of, the Business and Professions Code.

21(f) (1) Notwithstanding any other limitation of time described
22in this chapter, a criminal complaint may be filed within one year
23of the date of a report to a California law enforcement agency by
24a person of any age alleging that he or she, while under the age of
2518 years, was the victim of a crime described in Section 261, 286,
26288, 288a, 288.5, or 289, or Section 289.5 as enacted by Chapter
27293 of the Statutes of 1991 relating to penetration by an unknown
28object.

29(2) This subdivision applies only if all of the following occur:

30(A) The limitation period specified in Section 800, 801, or 801.1,
31whichever is later, has expired.

32(B) The crime involved substantial sexual conduct, as described
33in subdivision (b) of Section 1203.066, excluding masturbation
34that is not mutual.

35(C) There is independent evidence that corroborates the victim’s
36allegation. If the victim was 21 years of age or older at the time
37of the report, the independent evidence shall clearly and
38convincingly corroborate the victim’s allegation.

39(3) No evidence may be used to corroborate the victim’s
40allegation that otherwise would be inadmissible during trial.
P12   1Independent evidence does not include the opinions of mental
2health professionals.

3(4) (A) In a criminal investigation involving any of the crimes
4listed in paragraph (1) committed against a child, when the
5applicable limitations period has not expired, that period shall be
6tolled from the time a party initiates litigation challenging a grand
7jury subpoena until the end of the litigation, including any
8associated writ or appellate proceeding, or until the final disclosure
9of evidence to the investigating or prosecuting agency, if that
10disclosure is ordered pursuant to the subpoena after the litigation.

11(B) Nothing in this subdivision affects the definition or
12applicability of any evidentiary privilege.

13(C) This subdivision shall not apply where a court finds that the
14grand jury subpoena was issued or caused to be issued in bad faith.

15(g) (1) Notwithstanding any other limitation of time described
16in this chapter, a criminal complaint may be filed within one year
17of the date on which the identity of the suspect is conclusively
18established by DNA testing, if both of the following conditions
19are met:

20(A) The crime is one that is described in subdivision (c) of
21Section 290.

22(B) The offense was committed prior to January 1, 2001, and
23biological evidence collected in connection with the offense is
24analyzed for DNA type no later than January 1, 2004, or the offense
25was committed on or after January 1, 2001, and biological evidence
26collected in connection with the offense is analyzed for DNA type
27no later than two years from the date of the offense.

28(2) For purposes of this section, “DNA” means deoxyribonucleic
29acid.

30(h) For any crime, the proof of which depends substantially
31upon evidence that was seized under a warrant, but which is
32unavailable to the prosecuting authority under the procedures
33described in People v. Superior Court (Laff) (2001) 25 Cal.4th
34703, People v. Superior Court (Bauman & Rose) (1995) 37
35Cal.App.4th 1757, or subdivision (c) of Section 1524, relating to
36claims of evidentiary privilege or attorney work product, the
37limitation of time prescribed in this chapter shall be tolled from
38the time of the seizure until final disclosure of the evidence to the
39prosecuting authority. Nothing in this section otherwise affects
P13   1the definition or applicability of any evidentiary privilege or
2attorney work product.

3(i) Notwithstanding any other limitation of time described in
4this chapter, a criminal complaint may be filed within one year of
5the date on which a hidden recording is discovered related to a
6violation of paragraph (2) or (3) of subdivision (j) of Section 647.

7(j) Notwithstanding any other limitation of time described in
8this chapter, if a person flees the scene of an accident that caused
9death or permanent, serious injury, as defined in subdivision (d)
10of Section 20001 of the Vehicle Code, a criminal complaint brought
11pursuant to paragraph (2) of subdivision (b) of Section 20001 of
12the Vehicle Code may be filed within the applicable time period
13described in Section 801 or 802 or one year after the person is
14initially identified by law enforcement as a suspect in the
15commission of the offense, whichever is later, but in no case later
16than six years after the commission of the offense.

17(k) (1) A limitation of time prescribed in this chapter for an
18offense described in subdivision (c) of Section 502 for which it is
19alleged the defendant acquired, copied, or distributed one or more
20digital images of a person that displays an intimate body part of
21the person shall not commence to run until the discovery of the
22offense.

23(2) As used in this subdivision, “intimate body part” means any
24portion of the genitals, the anus, and in the case of a female also
25includes any portion of the breasts below the top of the areola, that
26is either uncovered or clearly visible through clothing.

27(3) As used in this subdivision, “digital images of a person” do
28not include representational images, artwork, or cartoon drawings.

end delete


O

    97