Bill Text: NY S05083 | 2009-2010 | General Assembly | Introduced
Bill Title: Establishes the crimes of computer intrusion in the third degree, computer intrusion in the second degree, computer intrusion in the first degree, aggravated computer intrusion, use of a minor in the commission of a computer offense, and cyberterrorism, repealing certain sections of law related therewith, and making technical corrections.
Spectrum: Partisan Bill (Republican 1-0)
Status: (Introduced - Dead) 2010-01-06 - REFERRED TO CODES [S05083 Detail]
Download: New_York-2009-S05083-Introduced.html
S T A T E O F N E W Y O R K ________________________________________________________________________ 5083 2009-2010 Regular Sessions I N S E N A T E April 27, 2009 ___________ Introduced by Sen. LEIBELL -- read twice and ordered printed, and when printed to be committed to the Committee on Codes AN ACT to amend the penal law, in relation to establishing definitions pertaining to offenses involving computers, establishing the crimes of computer intrusion in the third degree, computer intrusion in the second degree, computer intrusion in the first degree, aggravated computer intrusion, use of a minor in the commission of a computer offense, and cyberterrorism; to amend the criminal procedure law, in relation to making certain technical corrections thereto; and repeal- ing certain provisions of such laws relating thereto THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM- BLY, DO ENACT AS FOLLOWS: 1 Section 1. Sections 156.00, 156.05, 156.10, 156.20, 156.25, 156.26, 2 156.27 and 156.50 of the penal law are REPEALED. 3 S 2. The penal law is amended by adding a new section 156.00 to read 4 as follows: 5 S 156.00 OFFENSES INVOLVING COMPUTERS; DEFINITION OF TERMS. 6 THE FOLLOWING DEFINITIONS ARE APPLICABLE TO THIS CHAPTER EXCEPT WHERE 7 DIFFERENT MEANINGS ARE EXPRESSLY SPECIFIED: 8 1. "COMPUTER" MEANS A DEVICE OR GROUP OF DEVICES WHICH, BY MANIPU- 9 LATION OF ELECTRONIC, MAGNETIC, OPTICAL OR ELECTROCHEMICAL IMPULSES, 10 PURSUANT TO A COMPUTER PROGRAM, CAN AUTOMATICALLY PERFORM ARITHMETIC, 11 LOGICAL, STORAGE OR RETRIEVAL OPERATIONS WITH OR ON COMPUTER DATA, AND 12 INCLUDES ANY CONNECTED OR DIRECTLY RELATED DEVICE, EQUIPMENT OR FACILITY 13 WHICH ENABLES SUCH COMPUTER TO STORE, RETRIEVE OR COMMUNICATE TO OR FROM 14 A PERSON, ANOTHER COMPUTER OR ANOTHER DEVICE THE RESULTS OF COMPUTER 15 OPERATIONS, COMPUTER PROGRAMS OR COMPUTER DATA. 16 2. "COMPUTER DATA" IS PROPERTY AND MEANS A REPRESENTATION OF INFORMA- 17 TION, KNOWLEDGE, FACTS, CONCEPTS OR INSTRUCTIONS WHICH ARE BEING PROC- 18 ESSED, OR HAVE BEEN PROCESSED IN A COMPUTER AND MAY BE IN ANY FORM, EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets [ ] is old law to be omitted. LBD11331-01-9 S. 5083 2 1 INCLUDING MAGNETIC STORAGE MEDIA, PUNCHED CARDS, OR STORED INTERNALLY IN 2 THE MEMORY OF THE COMPUTER. 3 3. "DATA NETWORK" MEANS A COMPUTER SYSTEM THAT PROVIDES COMMUNICATIONS 4 BETWEEN ONE OR MORE COMPUTER SYSTEMS AND ITS INPUT OR OUTPUT DEVICES, 5 INCLUDING, BUT NOT LIMITED TO, DISPLAY TERMINALS THAT ARE INTERCON- 6 NECTED. 7 4. "COMPUTER SOFTWARE OR COMPUTER APPLICATION" MEANS A SET OF 8 INSTRUCTIONS OR STATEMENTS AND RELATED DATA WHICH, WHEN EXECUTED IN 9 ACTUAL OR MODIFIED FORM, CAUSE A COMPUTER, COMPUTER SYSTEM, OR DATA 10 NETWORK TO PERFORM SPECIFIED FUNCTIONS. 11 5. "COMPUTER OPERATING SYSTEM" MEANS A COMPUTER PROGRAM THAT CONTROLS 12 INTERNAL AND EXTERNAL COMPUTER SOFTWARE OR COMPUTER APPLICATIONS, THAT 13 MAY BE USED TO EXECUTE OTHER COMPUTER PROGRAMS, GENERATE OUTPUT IN THE 14 FORM OF VISUAL, PRINT OR STORAGE MEDIA, OR TO CONTROL PERIPHERAL COMPUT- 15 ER DEVICES. 16 6. "COMPUTER MATERIAL" IS PROPERTY AND MEANS ANY COMPUTER DATA OR 17 COMPUTER PROGRAM WHICH: 18 (A) CONTAINS RECORDS OF THE MEDICAL HISTORY OR MEDICAL TREATMENT OF AN 19 IDENTIFIED OR READILY IDENTIFIABLE INDIVIDUAL OR INDIVIDUALS. THIS TERM 20 SHALL NOT APPLY TO THE GAINING ACCESS TO OR DUPLICATION SOLELY OF THE 21 MEDICAL HISTORY OR MEDICAL TREATMENT RECORDS OF A PERSON BY THAT PERSON 22 OR BY ANOTHER PERSON SPECIFICALLY AUTHORIZED BY THE PERSON WHOSE RECORDS 23 ARE GAINED ACCESS TO OR DUPLICATED; OR 24 (B) CONTAINS RECORDS MAINTAINED BY THE STATE OR ANY POLITICAL SUBDIVI- 25 SION THEREOF OR ANY GOVERNMENTAL INSTRUMENTALITY WITHIN THE STATE WHICH 26 CONTAINS ANY INFORMATION CONCERNING A PERSON WHICH BECAUSE OF NAME, 27 NUMBER, SYMBOL, MARK OR OTHER IDENTIFIER, CAN BE USED TO IDENTIFY THE 28 PERSON AND WHICH IS OTHERWISE PROHIBITED BY LAW FROM BEING DISCLOSED. 29 THIS TERM SHALL NOT APPLY TO THE GAINING ACCESS TO OR DUPLICATION SOLELY 30 OF RECORDS OF A PERSON BY THAT PERSON OR BY ANOTHER PERSON SPECIFICALLY 31 AUTHORIZED BY THE PERSON WHOSE RECORDS ARE GAINED ACCESS TO OR DUPLI- 32 CATED; OR 33 (C) CONTAINS THE FINANCIAL INFORMATION OF A PERSON. THIS TERM SHALL 34 NOT APPLY TO THE GAINING ACCESS TO OR DUPLICATION SOLELY OF RECORDS OF A 35 PERSON BY THAT PERSON OR BY ANOTHER PERSON SPECIFICALLY AUTHORIZED BY 36 THE PERSON WHOSE RECORDS ARE GAINED ACCESS TO OR DUPLICATED; OR 37 (D) IS NOT AND IS NOT INTENDED TO BE AVAILABLE TO ANYONE OTHER THAN 38 THE PERSON OR PERSONS RIGHTFULLY IN POSSESSION THEREOF OR SELECTED 39 PERSONS HAVING ACCESS THERETO WITH HIS, HER OR THEIR CONSENT AND WHICH 40 ACCORDS OR MAY ACCORD SUCH RIGHTFUL POSSESSORS AN ADVANTAGE OVER COMPET- 41 ITORS OR OTHER PERSONS WHO DO NOT HAVE KNOWLEDGE OR THE BENEFIT THEREOF. 42 7. "COMPUTER EXPLOIT" MEANS A COMPUTER PROGRAM OR SET OF COMPUTER 43 INSTRUCTIONS DESIGNED TO MODIFY, DAMAGE, DESTROY, RECORD OR TRANSMIT 44 INFORMATION WITHIN A COMPUTER, COMPUTER SYSTEM OR DATA NETWORK WITHOUT 45 THE INTENT OR PERMISSION OF THE OWNER OF THE INFORMATION OR OF THE 46 COMPUTER, COMPUTER SYSTEM OR DATA NETWORK. THIS INCLUDES, BUT IS NOT 47 LIMITED TO, INTRUSIONS KNOWN AS MALICIOUS CODES, VIRUSES OR WORMS WHICH 48 MAY BE SELF-REPLICATING OR SELF-PROPAGATING AND WHICH ARE DESIGNED TO 49 CONTAMINATE OTHER COMPUTERS, COMPUTER APPLICATIONS, COMPUTER SYSTEMS OR 50 COMPUTER DATA NETWORKS; CONSUME COMPUTER RESOURCES; MODIFY, DESTROY, 51 RECORD, OR TRANSMIT DATA; OR IN SOME OTHER FASHION USURP THE NORMAL 52 OPERATION OF THE COMPUTER, COMPUTER APPLICATION, COMPUTER SYSTEM, OR 53 DATA NETWORK. 54 8. "COMPUTER SYSTEM" MEANS A GROUP OF ONE OR MORE COMPUTERS LINKED 55 TOGETHER WITH THE ABILITY TO SHARE INFORMATION AND RESOURCES. S. 5083 3 1 9. "COMPUTER PROGRAM" IS PROPERTY AND MEANS AN ORDERED SET OF DATA 2 REPRESENTING CODED INSTRUCTIONS OR STATEMENTS THAT, WHEN EXECUTED BY A 3 COMPUTER, CAUSES THE COMPUTER TO PROCESS DATA OR DIRECT THE COMPUTER TO 4 PERFORM ONE OR MORE COMPUTER OPERATIONS OR BOTH AND MAY BE IN ANY FORM. 5 10. "COMPUTER SERVICE" MEANS ANY AND ALL SERVICES PROVIDED BY OR 6 THROUGH THE FACILITIES OF ANY COMPUTER, DATA NETWORK, APPLICATION OR 7 OPERATING SYSTEM ALLOWING THE INPUT, OUTPUT, EXAMINATION, OR TRANSFER, 8 OF COMPUTER DATA OR COMPUTER PROGRAM FROM ONE COMPUTER TO ANOTHER. 9 11. "PERIPHERAL COMPUTER DEVICE" MEANS A DEVICE DIRECTLY CONNECTED TO 10 A COMPUTER OR INDIRECTLY THROUGH A DATA NETWORK. 11 12. "PATCH" MEANS A SOFTWARE OR APPLICATION UPDATE DISTRIBUTED BY THE 12 COMPUTER SOFTWARE MAKER DESIGNED TO FIX A VULNERABILITY IN COMPUTER 13 SOFTWARE OR COMPUTER APPLICATION. 14 S 3. The penal law is amended by adding a new section 156.05 to read 15 as follows: 16 S 156.05 COMPUTER INTRUSION IN THE THIRD DEGREE. 17 A PERSON IS GUILTY OF COMPUTER INTRUSION IN THE THIRD DEGREE WHEN HE 18 OR SHE DIRECTLY OR INDIRECTLY: 19 1. WILLFULLY, KNOWINGLY AND WITHOUT AUTHORIZATION MODIFIES, DESTROYS, 20 ACCESSES OR DISCLOSES APPLICATIONS OR SUPPORTING DOCUMENTATION RESIDING 21 OR EXISTING INTERNALLY OR EXTERNALLY TO A COMPUTER OR COMPUTER SYSTEM OR 22 DATA NETWORK; OR 23 2. WILLFULLY, KNOWINGLY AND WITHOUT AUTHORIZATION INSTALLS A COMPUTER 24 APPLICATION OR SOFTWARE; OR 25 3. WILLFULLY, KNOWINGLY AND WITHOUT AUTHORIZATION, DIRECTLY OR INDI- 26 RECTLY, USES A COMPUTER, COMPUTER OPERATING SYSTEM, DATA NETWORK OR 27 PERIPHERAL COMPUTER DEVICE CONNECTED THROUGH A DATA NETWORK; OR 28 4. WILLFULLY AND KNOWINGLY COMMITS A DENIAL OF SERVICE ATTACK. FOR 29 THE PURPOSES OF THIS SECTION, "DENIAL OF SERVICE ATTACK" MEANS PREVENT- 30 ING AUTHORIZED ACCESS TO COMPUTER RESOURCES OR DELAYING TIME CRITICAL 31 COMPUTER OPERATIONS BY INUNDATING OR OTHERWISE OVERLOADING A DATA 32 NETWORK, OR ATTEMPTING TO INUNDATE OR OTHERWISE OVERLOAD A COMPUTER 33 SERVICE. 34 COMPUTER INTRUSION IN THE THIRD DEGREE IS A CLASS A MISDEMEANOR. 35 S 4. The penal law is amended by adding a new section 156.10 to read 36 as follows: 37 S 156.10 COMPUTER INTRUSION IN THE SECOND DEGREE. 38 A PERSON IS GUILTY OF COMPUTER INTRUSION IN THE SECOND DEGREE WHEN HE 39 OR SHE COMMITS COMPUTER INTRUSION IN THE THIRD DEGREE AND: 40 1. HE OR SHE HAS PREVIOUSLY BEEN CONVICTED OF ANY CRIME UNDER THIS 41 ARTICLE; OR 42 2. HE OR SHE INTENTIONALLY AND WITHOUT AUTHORIZATION ALTERS IN ANY 43 MANNER OR DESTROYS COMPUTER MATERIAL, AS DEFINED IN SECTION 156.00 OF 44 THIS ARTICLE; OR 45 3. HE OR SHE DOES SO WITH THE INTENT TO COMMIT OR FURTHER THE COMMIS- 46 SION OF ANY FELONY; OR 47 4. HE OR SHE CAUSES DAMAGES AS A RESULT OF THE COMPUTER INTRUSION IN 48 AN AGGREGATE AMOUNT EXCEEDING TWENTY-FIVE HUNDRED DOLLARS. 49 COMPUTER INTRUSION IN THE SECOND DEGREE IS A CLASS E FELONY. 50 S 5. The penal law is amended by adding a new section 156.20 to read 51 as follows: 52 S 156.20 COMPUTER INTRUSION IN THE FIRST DEGREE. 53 A PERSON IS GUILTY OF COMPUTER INTRUSION IN THE FIRST DEGREE WHEN HE 54 OR SHE COMMITS THE CRIME OF COMPUTER INTRUSION IN THE THIRD DEGREE SO AS 55 TO CAUSE DAMAGES AS A RESULT OF THE COMPUTER INTRUSION IN AN AGGREGATE 56 AMOUNT EXCEEDING TEN THOUSAND DOLLARS. S. 5083 4 1 COMPUTER INTRUSION IN THE FIRST DEGREE IS A CLASS D FELONY. 2 S 6. The penal law is amended by adding a new section 156.25 to read 3 as follows: 4 S 156.25 AGGRAVATED COMPUTER INTRUSION. 5 A PERSON IS GUILTY OF AGGRAVATED COMPUTER INTRUSION WHEN HE OR SHE 6 COMMITS THE CRIME OF COMPUTER INTRUSION IN THE THIRD DEGREE AND IN 7 FURTHERANCE OF SUCH CRIME HE OR SHE: 8 1. ENCRYPTS A COMPUTER EXPLOIT OR DELETERIOUS SET OF INSTRUCTIONS IN 9 AN IMAGE OR COMPUTER FILE; OR 10 2. DEVELOPS A COMPUTER EXPLOIT THAT MODIFIES THE COMPUTER, COMPUTER 11 SYSTEM, OR COMPUTER OPERATING SYSTEM SO THAT A COMPUTER USER IS UNABLE 12 TO REPAIR THE MODIFICATION; OR 13 3. DEVELOPS A COMPUTER EXPLOIT THAT USES A PATCH DEVELOPED BY A SOFT- 14 WARE COMPANY TO TARGET A COMPUTER, COMPUTER SYSTEM, COMPUTER PROGRAM, 15 DATA NETWORK, COMPUTER SERVICE OR COMPUTER OPERATING SYSTEM TO TARGET 16 AND EXPLOIT A VULNERABILITY IN THE COMPUTER OPERATING SYSTEM OR COMPUTER 17 PROGRAM. 18 AGGRAVATED COMPUTER INTRUSION IS A CLASS E FELONY. 19 S 7. The penal law is amended by adding a new section 156.40 to read 20 as follows: 21 S 156.40 USE OF A MINOR IN THE COMMISSION OF A COMPUTER OFFENSE. 22 A PERSON IS GUILTY OF USE OF A MINOR IN THE COMMISSION OF A COMPUTER 23 OFFENSE WHEN, BEING EIGHTEEN YEARS OF AGE OR OLDER, HE OR SHE USES A 24 CHILD UNDER THE AGE OF EIGHTEEN TO EFFECTUATE THE COMMISSION OF ANY 25 COMPUTER OFFENSE UNDER THIS ARTICLE BY: 26 1. INFLUENCING OR COERCING THE CHILD TO COMMIT THE COMPUTER OFFENSE; 27 OR 28 2. INTENTIONALLY OR WILLFULLY SUPPLIES THE CHILD WITH THE INFORMATION 29 NECESSARY TO COMMIT THE COMPUTER OFFENSE WITH THE KNOWLEDGE THAT THE 30 CHILD INTENDS TO COMMIT A COMPUTER OFFENSE. 31 USE OF A MINOR IN THE COMMISSION OF A COMPUTER OFFENSE IS A CLASS E 32 FELONY. 33 S 8. The penal law is amended by adding a new section 156.50 to read 34 as follows: 35 S 156.50 OFFENSES INVOLVING COMPUTERS; DEFENSES. 36 UNDER SECTIONS 156.05, 156.10, 156.20, 156.25, AND 156.40 OF THIS 37 ARTICLE IT SHALL BE A DEFENSE THAT THE DEFENDANT WAS AUTHORIZED TO USE 38 THE COMPUTER PURSUANT TO A SERVICE AGREEMENT AND WHERE SUCH USE ORIGI- 39 NATED FROM A SERVICE LOCATION WITHIN THE UNITED STATES OR CANADA. 40 S 9. Section 490.05 of the penal law is amended by adding a new subdi- 41 vision 18 to read as follows: 42 18. "ACT OF CYBERTERRORISM" MEANS THE USE OF COMPUTING RESOURCES 43 INCLUDING BUT NOT LIMITED TO COMPUTERS, COMPUTER SYSTEMS, DATA NETWORKS, 44 COMPUTER SOFTWARE, COMPUTER APPLICATIONS AND COMPUTER OPERATING SYSTEMS 45 AS SUCH TERMS ARE DEFINED IN SECTION 156.00 OF THIS CHAPTER, AGAINST 46 PERSONS OR PROPERTY TO INTIMIDATE OR COERCE A GOVERNMENT, THE POPU- 47 LATION, OR ANY SEGMENT THEREOF, IN FURTHERANCE OF POLITICAL OR SOCIAL 48 OBJECTIVES. 49 S 10. The penal law is amended by adding a new section 490.28 to read 50 as follows: 51 S 490.28 CYBERTERRORISM. 52 A PERSON IS GUILTY OF CYBERTERRORISM WHEN, WITH THE INTENT TO INTIM- 53 IDATE A CIVILIAN POPULATION, INFLUENCE THE POLICY OF A UNIT OF GOVERN- 54 MENT BY INTIMIDATION OR COERCION, OR AFFECT THE CONDUCT OF A UNIT OF 55 GOVERNMENT, HE OR SHE COMMITS ANY OF THE CRIMES CONTAINED WITHIN ARTICLE 56 ONE HUNDRED FIFTY-SIX OF THIS CHAPTER DIRECTED AGAINST ANY COMPUTER, S. 5083 5 1 COMPUTER SYSTEM OR DATA NETWORK OWNED OR OPERATED BY A LOCAL, STATE OR 2 FEDERAL GOVERNMENT ENTITY, ANY UTILITY INCLUDING BUT NOT LIMITED TO, ANY 3 ELECTRIC OR WATER UTILITY, OR A FINANCIAL INSTITUTION. 4 CYBERTERRORISM IS A CLASS B FELONY. 5 S 11. Paragraphs (j) and (k) of subdivision 1 of section 240.20 of the 6 criminal procedure law, paragraph (j) as added by chapter 514 of the 7 laws of 1986 and paragraph (k) as added by chapter 536 of the laws of 8 1989, are amended to read as follows: 9 (j) In [any prosecution under penal law section 156.05 or 156.10, the 10 time, place and manner of notice given pursuant to subdivision six of 11 section 156.00 of such law. 12 (k) in] any prosecution commenced in a manner set forth in this subdi- 13 vision alleging a violation of the vehicle and traffic law, in addition 14 to any material required to be disclosed pursuant to this article, any 15 other provision of law, or the constitution of this state or of the 16 United States, any written report or document, or portion thereof, 17 concerning a physical examination, a scientific test or experiment, 18 including the most recent record of inspection, or calibration or repair 19 of machines or instruments utilized to perform such scientific tests or 20 experiments and the certification certificate, if any, held by the oper- 21 ator of the machine or instrument, which tests or examinations were made 22 by or at the request or direction of a public servant engaged in law 23 enforcement activity or which was made by a person whom the prosecutor 24 intends to call as a witness at trial, or which the people intend to 25 introduce at trial. 26 S 12. Section 250.30 of the criminal procedure law is REPEALED. 27 S 13. This act shall take effect on the first of November next 28 succeeding the date on which it shall have become a law.