Amended in Assembly March 28, 2016

Amended in Assembly March 8, 2016

California Legislature—2015–16 Regular Session

Assembly Bill No. 1681

Introduced by Assembly Member Cooper

(Coauthor: Assembly Member Gallagher)

(Coauthors: Senators Bates and Hall)

January 20, 2016

An act to add Section 22762 to the Business and Professions Code, relating to smartphones.

LEGISLATIVE COUNSEL’S DIGEST

AB 1681, as amended, Cooper. Smartphones.

Existing law requires that a smartphone that is manufactured on or after July 1, 2015, and sold in California after that date, include a technological solution at the time of sale, which may consist of software, hardware, or both software and hardware, that, once initiated and successfully communicated to the smartphone, can render inoperable the essential features, as defined, of the smartphone to an unauthorized user when the smartphone is not in the possession of an authorized user.

This bill would require a begin delete smartphone that is manufactured on or after January 1, 2017, and sold in California, to be capable of being decrypted and unlocked by its manufacturer or its operating system provider. The bill would subject a end delete manufacturer or operating system provider begin delete that knowingly failed to comply with that requirement end delete begin insert of a smartphone sold or leased in California on or after January 1, 2017, that is unable to decrypted the smartphone pursuant to a state court order end insert to begin insert be subject to end insert a civil penalty of $2,500 for each begin delete smartphone sold or leased. end delete begin insert instance in which the smartphone is unable to be decrypted. end insert The bill would prohibit a manufacturer or operating system provider who has paid this civil penalty from passing any portion of the penalty on to purchasers of smartphones. The bill would authorize only the Attorney General or a district attorney to bring a civil suit to enforce these provisions. This bill would make findings and declarations related to smartphones and criminal activity.

Vote: majority. Appropriation: no. Fiscal committee: yes. State-mandated local program: no.

The people of the State of California do enact as follows:

SECTION 1.  

The Legislature finds and declares all of the
following:

(a) Worldwide, human trafficking is a $32 billion per year
industry.

(b) After drug trafficking and counterfeiting, human trafficking
is the world’s most profitable criminal activity.

(c) Although previously believed to be an international problem,
current statistics show that human trafficking is increasingly a
domestic issue.

(d) According to estimates by the Federal Bureau of
Investigation (FBI), human trafficking or the commercial sexual
exploitation of children in the United States currently involves
over 100,000 children. The San Francisco Bay area, Los Angeles,
and San Diego metropolitan areas comprise three of the nation’s
13 areas of “high intensity” child exploitation in this country, as
described by the FBI.

(e) Studies have estimated that anywhere from 50 to 80 percent
of victims of commercial sexual exploitation are, or were formerly,
involved with the child welfare system.

(f) Smartphones are increasingly becoming a weapon of choice
for criminals and criminal organizations involved in human
trafficking and sexual exploitation of children.

(g) In 2014, smartphones with full-disk encryption (FDE)
became available on the market.

(h) On smartphones with FDE, when a user creates a password,
that phrase generates a key that is used in combination with a
hardware key on a chip inside the phone, which blocks access to
all “data at rest” stored in the device.

(i) “Data at rest” on a smartphone is data that is parked, stored,
and no longer in motion, such as pictures and text messages.

(j) Only the password holder can unlock the FDE-equipped
smartphone and provide access to all “data at rest.”

(k) Before 2014, when smartphones without FDE were used in
crimes, law enforcement obtained and served a court order on the
phone manufacturer and was able to have access to “data at rest”
on the device, to aid in an investigation.

(l) In order to successfully access “data at rest” on smartphones
in a criminal investigation, law enforcement must have physical
possession of the phone.

(m) Since the introduction of FDE on smartphones in 2014,
“data at rest” on FDE-equipped smartphones has become virtually
impossible to access.

(n) A smartphone belonging to one of the shooters in the County
of San Bernardino mass shooting, which left 14 people dead and
many more injured, is equipped with FDE and has prevented law
enforcement from accessing the phone’s content for evidence.

(o) Since 2014, FDE in smartphones has created a public safety
crisis that has armed criminals and criminal organizations with a
powerful weapon to conduct illicit activities while simultaneously
providing a shield to conceal crimes and remain out of reach of
law enforcement.

(p) Since 2014, FDE in smartphones has rendered court orders
to access critical evidence on smartphones useless.

(q) Since 2014, FDE in smartphones has interfered with law
enforcement human trafficking investigations and prosecutions.

(r) Smartphones play an essential role in facilitating cases of
domestic minor sex trafficking. Human traffickers text logistical
information, such as time, place, pricing, types of services, and
descriptions of exploited minors using smartphones.

(s) Human traffickers rely on smartphones to communicate with
each other, organize, and advertise their illicit business.

(t) Technology-facilitated sex trafficking networks rely upon
anonymity of victims and traffickers in order to operate. Fully
encrypted smartphones, immune to search warrants, make this
possible.

(u) Individuals suspected of crimes are, upon the issuance of a
court order, subject to search of their homes, vehicles, and even
their bodies, but not their smartphones that are equipped with FDE.

SEC. 2.  

Section 22762 is added to the Business and Professions
Code, immediately following Section 22761, to read:

22762.  

(a) For the purposes of this section, the following terms
have the following meanings:

(1) “Smartphone” has the same meaning as in Section 22761.

(2) “Sold in California” has the same meaning as in Section
22761.

(3) “Leased in California,” or any variation thereof, means that
the smartphone is contracted for a specified period of time to an
end-use consumer at an address within the state.

begin delete

(b) A smartphone that is manufactured on or after January 1,
2017, and sold or leased in California, shall be capable of being
decrypted and unlocked by its manufacturer or its operating system
provider.

(c) 

end delete

begin insert (b) end insert begin insert   end insert A begin delete smartphone manufactured on or after January 1, 2017,
that is not capable of being decrypted and unlocked by its
manufacturer or its operating system provider shall subject the end delete
manufacturer or operating system provider begin insert of a smartphone sold
or leased in California on or after January 1, 2017, shall be subject end insert
to a civil penalty of two thousand five hundred dollars ($2,500)
for each begin delete smartphone sold or leased in California if end delete begin insert instance in
which end insert the manufacturer or operating system provider of the
smartphone begin delete knew at the time of the sale or lease that the
smartphone was not capable of being decrypted and unlocked by
the manufacturer or its operating system provider. end delete begin insert is unable to
decrypt the contents of the smartphone pursuant to a state court
order. end insert A manufacturer or operating system provider who pays a
civil penalty imposed pursuant to this subdivision shall not pass
on any portion of that penalty to purchasers of smartphones. begin insert This
civil penalty shall not preclude the imposition of any other penalty
pursuant to law. end insert

begin delete

(d)

end delete

begin insert (c) end insert  The begin delete sale or lease end delete begin insert inability end insert of a smartphone begin delete manufactured on
or after January 1, 2017, that is not capable of being decrypted and
unlocked by its end delete manufacturer or its operating system provider begin insert to
decrypt the contents of the smartphone pursuant to this section end insert
shall not result in liability to the seller or lessor.

begin delete

(e)

end delete

begin insert (d) end insert  A civil suit to enforce this section may only be brought by
the Attorney begin delete General, for the sale or lease of a smartphone in
California, end delete begin insert General end insert or a district begin delete attorney for the sale or lease of a
smartphone in the county represented by the district end delete attorney. A
manufacturer or operating system provider shall not be subject to
more than a single penalty begin insert pursuant to this section end insert for each begin delete sale
or lease of a smartphone. end delete begin insert smartphone that it is unable to decrypt
pursuant to a state court order. end insert