Establishes the computer security act

Section two amends the general business law by adding a new article 9-D.

It states the following:

* It shall be illegal for a person or entity that is not an authorized user of a computer in this state to knowingly, willfully, or with conscious indifference or disregard cause computer software to be copied onto such computer and use the software to modify through intentionally deceptive means.

* Collection through intentionally deceptive means, prevent, without the authorization of an authorized user, through intentionally deceptive means, intentionally misrepresent that software will be uninstalled or disabled by an authorized user's action.

* The attorney general may bring a civil action against any person violating the provisions of this article to the penalties for the violation.

* Preempting other jurisdictional actions about spyware.

Justification

The Computer Security Act is designed to provide Internet users in New York State from cyberattacks, identity theft, invasion of their privacy and misuse of their computing or network resources by unsolicited commercial email. There are four principal types of Internet malicious behavior and/or malware against which the Act protects. They are: botnet attacks, identity theft, "SPAM" email, spyware and use of various types of malicious software for attack upon computers in New York State.

A Botnet is a JARGON term for a collection of SOFTWARE AGENTS , or robots, that run autonomously and automatically. Botnets are often used to send spam, but can also be used to carry out coordinated security attacks on targets elsewhere on the Internet such as bank and credit card company computers, public utilities, and home computers that may have confidential information on them.

Identity theft refers to a specific type of fraud, either computer-assisted or not, which involves someone pretending to be someone else in order to steal money or get other benefits. The person whose identity is used can suffer various consequences when, or if, he or she is held responsible for the perpetrator's actions. Frequently, identity theft is accomplished via the use of Botnets, or by keystroke logger software surreptitiously placed upon one's computer. Such keystroke logger software records and transmits to a remote location, all of a computer user's passwords, confidential information and Internet use.

Spam, otherwise known as unsolicited commercial email (UCE), misuses resources, invades privacy and costs Internet users money. Some spam email is designed to trick people into giving out their credit card information, or to become victimized by other frauds, and other spam simply overloads Corporate email systems, which must be repaired at great expense.

Spyware can pose serious threats to the safety of computers. The damages can range from simply clogging up the internal workings of one's computer, to slowing down your applications and eventually causing your system to crash, to theft of one's identity or other confidential information.

All of these types of malicious software and malicious computer attacks can cause very costly damage to New Yorkers' home computers, and to corporate and government computers. More importantly, the type of behavior this act guards against can undermine the health, safety and welfare of the State and its citizens.

Legislative history

New bill.

Fiscal implications

None.

Effective date

The act shall take effect on the first of November next succeeding the date on which it shall have become a law.