STATE OF NEW YORK
        ________________________________________________________________________

                                          4638

                               2023-2024 Regular Sessions

                   IN ASSEMBLY

                                    February 21, 2023
                                       ___________

        Introduced  by M. of A. MAMDANI -- read once and referred to the Commit-
          tee on Codes

        AN ACT to amend the criminal procedure law, in relation  to  prohibiting
          the  creation of fake electronic communication service accounts and to
          prohibiting the collection and use of individuals' account information
          by law enforcement officers and other government entities

          The People of the State of New York, represented in Senate and  Assem-
        bly, do enact as follows:

     1    Section  1.  Short  title. This act shall be known and may be cited as
     2  the "stop online police fake accounts and keep everyone safe act" or the
     3  "stop fakes act".
     4    § 2. The criminal procedure law is amended by adding a new article 702
     5  to read as follows:
     6                                 ARTICLE 702
     7    DECEPTIVE LAW ENFORCEMENT ACCESS TO ELECTRONIC COMMUNICATION SERVICE
     8                             ACCOUNTS PROHIBITED
     9  Section 702.00 Definitions.
    10          702.10 Law enforcement creation of fake accounts prohibited.
    11          702.20 Law enforcement use of fake accounts prohibited.
    12          702.30 Third party use of fake accounts.
    13          702.40 Law enforcement collection of account information prohib-
    14                  ited.
    15          702.50 Law enforcement use of account information prohibited.
    16          702.60 Fake accounts and collection of credentials;  suppression
    17                  of evidence.
    18          702.70  Fake  accounts  and  collection  of account information;
    19                  private right of action.
    20  § 702.00 Definitions.
    21    As used in this article, the following terms shall have the  following
    22  meanings:

         EXPLANATION--Matter in italics (underscored) is new; matter in brackets
                              [ ] is old law to be omitted.
                                                                   LBD06096-01-3

        A. 4638                             2

     1    1.  "Government  entity"  shall  mean  any department or agency of the
     2  state or any political subdivision thereof, or any individual acting for
     3  or on behalf of such department or agency  of  the  state  or  political
     4  subdivision thereof.
     5    2.  "Law enforcement officer" means any police officer, peace officer,
     6  school resource officer or prosecutor.
     7    3. "Electronic communication" means  any  communication  sent  between
     8  account holders using an electronic communication service.
     9    4. "Electronic communication information" means information related to
    10  an  electronic communication   or the use of an electronic communication
    11  service including, but not limited to the contents, sender,  recipients,
    12  or  format  of  an  electronic communication; the precise or approximate
    13  location of the sender or recipient of an electronic   communication  at
    14  any  time  during  such  electronic communication; the time or date such
    15  electronic communication was created, sent, or received and  information
    16  pertaining to an individual or device involved in such electronic commu-
    17  nication  including  but  not  limited  to an internet protocol address.
    18  "Electronic communication information" shall not include information  in
    19  the public domain.
    20    5.  "Electronic  communication  service" means a service that provides
    21  subscribers to or users of such service the ability to send  or  receive
    22  an  electronic communication, including a service that acts as an inter-
    23  mediary in the transmission of electronic communications, or that stores
    24  electronic communication information.
    25    6. "Account" means an individual profile or account created  using  an
    26  electronic communication service.
    27    7.  "Account information" means information used to access or identify
    28  an individual's account including, but not limited  to,  access  creden-
    29  tials, usernames, passwords, and/or biometric identifiers.
    30    8.  "Fake  account"  means any account created with or used with false
    31  identifying information, including, but not limited  to,  name,  occupa-
    32  tion, or pictures.
    33    9.  "Collect" or "collection" means any method used to obtain an indi-
    34  vidual's account information, including but not limited to,  requesting,
    35  demanding, and/or coercing any individual to provide such account infor-
    36  mation from individuals in person, electronically, in writing, or other-
    37  wise.
    38    10. "Account holder" means the creator and operator of an account.
    39  § 702.10 Law enforcement creation of fake accounts prohibited.
    40    No  law  enforcement officer shall create a fake account with an elec-
    41  tronic communication service.
    42  § 702.20 Law enforcement use of fake accounts prohibited.
    43    No law enforcement officer shall access or use a fake account for  any
    44  purpose,  including,  but  not limited to, communication with individual
    45  accounts, public communications, updates to account information,  and/or
    46  requests to access information or content from the user of any electron-
    47  ic communication service.
    48  § 702.30 Third party use of fake accounts.
    49    No  government entity or government official shall seek the assistance
    50  of any non-government entity, any agency of the federal  government,  or
    51  any  agency of the government of another state or subdivision thereof in
    52  obtaining information or data using a fake account  if  such  government
    53  entity or government official would be barred from directly seeking such
    54  information under this article.
    55  § 702.40 Law enforcement collection of account information prohibited.

        A. 4638                             3

     1    No  law  enforcement  officer  or  government  official shall request,
     2  demand, and/or coerce any account holder to provide such  account  hold-
     3  er's account information.
     4  § 702.50 Law enforcement use of account information prohibited.
     5    No  law  enforcement  officer  or  government  official  shall use any
     6  account information obtained in violation  of  section  702.40  of  this
     7  article,  including, but not limited to, by logging into an individual's
     8  account.  Nothing in this section shall prohibit a law enforcement offi-
     9  cer or government official from creating and  maintaining  accounts  for
    10  personal  use,  provided that such accounts are not used in the scope of
    11  any law enforcement or investigative duties.
    12  § 702.60 Fake accounts and collection  of  credentials;  suppression  of
    13             evidence.
    14    1.  Upon motion from a defendant, a court shall order that evidence be
    15  suppressed or excluded if the court finds that such evidence:
    16    (a) consists of a record acquired via a fake account;
    17    (b) was obtained as a result of other  records  obtained  via  a  fake
    18  account; or
    19    (c)  consists  of  a  record,  or  was  obtained  as a result of other
    20  records, acquired via account access credentials obtained  in  violation
    21  of this article.
    22    2.  This section shall apply regardless of any claim that the informa-
    23  tion or evidence is attenuated from an unlawful order or request,  would
    24  inevitably  have  been discovered, or was simultaneously or subsequently
    25  obtained or reobtained through other means.
    26  § 702.70 Fake accounts and collection of  account  information;  private
    27             right of action.
    28    1.  Any  individual  whose  account information, records, evidence, or
    29  other information were either  accessed  by  any  government  entity  or
    30  government  official  or by a third party at the request of a government
    31  entity or government official in violation of this article may institute
    32  a civil action against such government entity or government official for
    33  any or all of the following:
    34    (a) Ten thousand dollars per violation or actual damages, whichever is
    35  greater;
    36    (b) Punitive damages;
    37    (c) Injunctive or declaratory relief; and/or
    38    (d) Any other relief the court deems proper.
    39    2. In assessing the amount of punitive damages under this section, the
    40  court shall consider:
    41    (a) The number of people whose  electronic  communication  information
    42  was disclosed;
    43    (b)  The  targeting  of  accounts  with  heightened  privacy concerns,
    44  including, but not limited to, houses of  worship,  political  organiza-
    45  tions, and medical facilities, and individuals associated therewith; and
    46    (c)  The persistence of violations by the particular government entity
    47  or government official.
    48    3. In any action brought under this section,  the  court  shall  award
    49  reasonable  attorneys'  fees, expenses, and costs to a prevailing plain-
    50  tiff.
    51    § 3. This act shall take effect immediately.