What's happening
Writing a plain-English summary… Track this bill to get it by email.
Why it matters
Albany, before your first meeting.
Every bill that moved yesterday, summarized in a sentence and ranked by impact. The Albany Scorecard follows on Sundays.
Free. Unsubscribe in one click. Want alerts on specific bills? Create an account.
Who cares
Headline styles
Sponsors
No co-sponsors yet.
History
- Referred to codes
- Referred to codes
Full text
The text isn't available here yet. Check nysenate.gov.
Sponsor's memo
Title of bill
An act to amend the penal law, in relation to establishing definitions pertaining to offenses involving computers, establishing the crimes of computer intrusion in the third degree, computer intrusion in the second degree, computer intrusion in the first degree, aggravated computer intrusion, use of a minor in the commission of a computer offense, and cyberterrorism; to amend the criminal procedure law, in relation to making certain technical corrections thereto; and repealing certain provisions of such laws relating thereto
Purpose
This bill would amend the penal law to create the new crimes of computer intrusion, aggravated computer intrusion, use of a minor in the commission of a computer offense and cyberterrorism and to clarify the methodology of calculating damages caused by an individual who commits the crime of computer tampering.
Summary of provisions
Section 1 Repeals sections 156.00, 156.05, 156.10, 156.20, 156.25, 156.26, 156.27 and 156.50 of the penal law. Section 2 Establishes definitions for the terms "computer network," "computer software or computer program," "computer operating system," "computer material," "computer program," "computer exploit," and "peripheral computer device." Section 3 Establishes a new section computer intrusion in the third degree, a class A misdemeanor. A person would be guilty of computer intrusion in the third degree when he or she, without authorization, alters or destroys computer programs, installs a computer program on a computer without authorization, commits a denial of service attack or uses a computer or device connected and controlled by a computer. Section 4 Establishes a new section computer intrusion in the second degree, a class E felony. A person would be guilty of computer intrusion in the second degree when he or she commits computer intrusion in the third degree and he or she has previously been convicted of any crime under this article, alters or destroys computer material, he or she commits the third degree crime with the intention of committing any felony or he or she causes damages in an aggregate of $2500. Section 5 Establishes a new section computer intrusion in the first degree, a class D felony. A person would be guilty of this crime when he or she has been convicted of computer intrusion in the third degree and causes damages in an aggregate of $10,000. Section 6 Establishes a new crime of aggravated computer intrusion, a class E felony. A person is guilty of aggravated computer intrusion when he or she commits the crime of computer intrusion in the third degree and in furtherance of the crime encrypts a deleterious set of computer instructions, develops a computer exploit that modifies a computer operating system making it difficult to repair, or creates an exploit to attack a specific vulnerability as identified by a software developer who develops a "patch" or software update for a computer operating system. Section 7 Establishes the crime of use of a minor in the commission of a computer offense. A person is guilty of use of a minor in the commission of a computer offense when he or she intentionally influences a child to commit a computer offense or intentionally and willfully supplies the child with the information to commit a computer offense. Section 8 Would add a new section 156.50 of the penal law to provide that it shall be a defense under sections 156.05, 156.10, 156.20, 156.25, and 156.40 if the defendant was authorized to use the computer pursuant to a service agreement and where such use 'Originated from a service location within the United States or Canada. Section 9 Defines the term "Act of Cyberterrorism." Section 10 Amends article 490 of the penal law by adding a new section 490.28, creating the crime of cyberterrorism, a class B felony. A person would be guilty of the crime of cyberterrorism when, with intent to intimidate or coerce a civilian population, influence the policy of a unit of government by intimidation or coercion, or affect the conduct of a unit of government, he or she commits any of the crimes contained within article 156 of the penal law. Section 11 Removes paragraph U) of subdivision 1 of section 240.20 of the Criminal Procedure Law that refers to sections repealed by section 1 of this act. Section 12 Repeals section 250.30 of the Criminal Procedure Law.
Read the full memo (1,267 words)
Justification
Three out of four households in America have access to a home computer today, according to the U.S. Census Bureau. Yet New York's existing computer crimes law doesn't protect the average person or business that uses a computer on a daily basis.
Technology has exponentially evolved during the two decades since the state law that created computer crimes was enacted. For example, we use computers to store banking records, credit card data, medical history and other presumably confidential information that is transferred millions of times a day through cyberspace.
Computers control the systems that provide us with power, emergency services and transportation. People with extensive computer knowledge and nefarious motives have also evolved with the times and economic landscape of cyberspace. Therefore, it is necessary that the penal law punish computer criminals who may not be violent but nonetheless pose a significant threat to individuals and the economy.
This bill updates the 20-year-old law and cracks down on hackers that:
* Illegally obtain personal financial, medical or other information;
* Alter or destroy computer programs;
* Install computer programs without authorization;
* Use a computer or device connected and controlled by a computer with- out authorization;
* Create and send computer "viruses" and "worms" designed to damage or destroy a computer system; or
* Use children to commit a computer offense.
Penalties in existing law apply only when a person asks to use a computer, is told no, and uses the computer anyway.
Today's victims of cyber- malfeasance often do not know the assailant, and the assailant only knows the victim as a target or a potential source of income. Also, some hackers only want to see their "worms" and "viruses" become household names and be seen by their peers as the best in their field.
The proposed crime of computer intrusion aims to target those who willfully and knowingly transmit computer "contaminants," -- that is, those programs designed to damage or destroy a computer or computer system.
The proposed crime of aggravated computer intrusion targets those who develop a computer contaminant so destructive that it hides, prohibits the computer user from fixing the damage, and targets those whose computers have specific vulnerabilities that a hacker can exploit.
Computer experts have testified that computer hackers operate in an underworld where children are used to do their bidding. Therefore, it is necessary to provide an appropriate crime in instances where older, more experienced hackers provide knowledge and influence children to develop computer contaminants with the specific intent to do as much damage as possible.
This legislation also holds accountable those who conduct cyber attacks against utilities and financial institutions. Existing law does not contemplate systemic, coordinated and well executed electronic attacks against critical, computer-operated systems such as government administration, electrical grids, water delivery systems, emergency services, and financial systems.
Current prohibitions in the penal law deal with individual or very small-scale efforts to tamper with a single computer, not coordinated and systematic attacks against the large-scale computer systems that control critical infrastructure assets, protect public safety and maintain stability in New York State's Financial industries.
Prior legislative history
2008 - S.3811-A - Referred to Veterans, Military Affairs and Homeland Security Committee
Fiscal implications
None Noted.
Effective date
This act shall take effect on the first of November.
Summaries, headlines and scores are AI-generated from the official bill text. How we score bills. Source: NYS Open Legislation.