BILL ANALYSIS Ó AB 195 Page 1 ASSEMBLY THIRD READING AB 195 (Chau) As Amended April 6, 2015 Majority vote -------------------------------------------------------------------- |Committee |Votes |Ayes |Noes | |----------------+------+-----------------------+--------------------| |Public Safety |6-0 |Quirk, Melendez, | | | | |Gonzalez, Lackey, Low, | | | | |Santiago | | |----------------+------+-----------------------+--------------------| |Privacy |10-0 |Gatto, Wilk, Baker, | | | | |Calderon, Chau, | | | | |Cooper, Dababneh, | | | | |Dahle, Gordon, Low | | |----------------+------+-----------------------+--------------------| |Appropriations |16-0 |Gomez, Bigelow, Bonta, | | | | |Calderon, Chang, Daly, | | | | |Eggman, Gallagher, | | | | |Eduardo Garcia, | | | | |Holden, Jones, Quirk, | | | | |Rendon, Wagner, Weber, | | | | |Wood | | -------------------------------------------------------------------- SUMMARY: Makes it a misdemeanor, punishable by up to six months, for any person to solicit another to join in the commission of specified crimes relating to unauthorized access of computer systems. Specifically, this bill: AB 195 Page 2 1)Provides that every person who, with the intent that the crime be committed, solicits another to commit one of a number of specified computer crimes shall be punished by imprisonment in a county jail for a period not to exceed six months. Every subsequent violation of this subdivision by that same person shall be punished by imprisonment in a county jail not exceeding one year. 2)Provides that every person who, with the intent that the crime be committed, offers to solicit assistance for another to conduct activities in violation of a number of specified computer crimes shall be punished by imprisonment in a county jail for a period not to exceed six months. Every subsequent violation of this subdivision by that same person shall be punished by imprisonment in a county jail not exceeding one year: a) Specifies that this includes persons operating websites that offer to assist others in locating hacking services; b) Defines "hacking services" as assistance in the unauthorized access to computers, computer systems, or computer data in violation of specified computer crimes; and c) Specifies that this offense shall be proven by the testimony of one witness and corroborating circumstances. EXISTING LAW: 1)Punishes any person who knowingly and without permission accesses or causes to be accessed any computer, computer system, AB 195 Page 3 or computer network as follows: a) For a first violation that does not result in injury, an infraction punishable by a fine not exceeding $1,000. b) For any violation that results in a victim expenditure in an amount not greater than $5,000, or for a second or subsequent violation, by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment. c) For any violation that results in a victim expenditure in an amount greater than $5,000), by a fine not exceeding $10,000, or by imprisonment pursuant to Penal Code Section 1170 subdivision (h) for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment. 2)Punishes any person who knowingly and without permission provides or assists in providing a means of accessing a computer, computer system, or public safety infrastructure computer system computer, computer system, or computer network as follows: a) For a first violation that does not result in injury, an infraction punishable by a fine not exceeding $1,000. b) For any violation that results in a victim expenditure in an amount not greater than $5,000, or for a second or subsequent violation, by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment. AB 195 Page 4 c) For any violation that results in a victim expenditure in an amount greater than $5,000, by a fine not exceeding $10,000, or by imprisonment pursuant to Penal Code Section 1170 subdivision (h) for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment. 3)Defines the following terms as follows: "Computer network" means any system that provides communications between one or more computer systems and input/output devices including, but not limited to, display terminals, remote systems, mobile devices, and printers connected by telecommunication facilities. FISCAL EFFECT: According to the Assembly Appropriations Committee, moderate nonreimbursable local costs for incarceration, offset to a degree by fee revenue as this type of crimes will probably be added to another computer crime charge. COMMENTS: According to the author, "Today, we live in a digitally connected world where more of our devices are equipped with sensors and connected to the internet. This includes our phones, cars and household appliances; all of which perform functions that where once exclusive to our computers. "This new form of digital access has also spawned a new type of criminal, one who can invade our homes and offices not by breaking down doors and windows, but by breaking into our computer networks from the convenience and safety of their own homes. These cybercrimes range from breaking into someone's computer network to steal financial information to other crimes such as corporate espionage, fraud, and extortion. AB 195 Page 5 "Under current law, it is a crime to solicit another to commit certain crimes, such as bribery, kidnapping, and robbery, among others. In addition, it is a crime for someone to knowingly hack into another's computer network without permission. However, it is not a crime to solicit someone to knowingly and without permission hack into a computer network or smartphone. "Cybercrimes have greater and longer lasting effects on victims, because the personal information stolen can result in identify theft, fraud, and personal embarrassment, all of which could take years to recover from, if ever. In fact, according to the FBI's Internet Crime Complaint Center, in 2013, it received over 200,000 consumer complaints about online scams, which resulted in a loss of over 781 million dollars; an almost 50% increase from the year before. "In recent years, we have seen the growth of so called Hacker-for-Hire websites where individuals solicit hackers to perform certain projects. These websites work in different ways. Some work by requiring the person to submit a description of the hacking job along with contact information. The website then sets up a time to connect the person with a hacker over the phone or video-conferencing to complete the process. Others websites work by creating a platform that allows customers to register and post projects on the website for different hackers to bid on. The websites then holds the money in an escrow account until both parties agree that the transaction has been completed. The website then takes a commission from each transaction and releases the money. "Hacker-for-Hire projects range from recovering lost passwords to tracking stolen devices. But some of these websites also provide a platform for individuals seeking illegal hacking services from less than ethical hackers, such as installing spyware on devices and gaining access to the email and social media accounts of AB 195 Page 6 unsuspecting victims. "AB 195 would make it a crime to solicit someone to knowingly and without permission gain access to a computer network or smartphone. This includes offering to obtain or assist in locating hacking services. The bill would also clarify that a computer network includes smartphones. This bill would make any violation punishable by imprisonment not to exceed six months. Any subsequent violation would be punishable by imprisonment not to exceed one year." Analysis Prepared by: Gabriel Caswell / PUB. S. / (916) 319-3744 FN: 0000176