Relates to cyber crimes and identity theft

LARCENY

Amends section 155.00 of the penal law to enlarge the definition of "property" to include personal identifying information and secret scientific material, to update definitions of "obtain," "deprive," "appropriate" for the computer age, and to add definitions of "computer program" and "computer data" Extends definition of larceny to include personal identifying information and theft of service. Changes definition of larceny to include theft of service and changes penalty structure to match the penalty to the numbers of people or the amount of damages, as follows:

*Creates a new crime, Petit Theft of Service (155.23), stealing a service, a B misdemeanor.

*Adds to Petit larceny (155.25), stealing a service with a value in excess of $500.

*Adds to Grand larceny 4th (155.30) stealing a service or personal identifying information maintains $1,000 value - E felony.

*Adds to Grand larceny 3rd (155.35), stealing a service, or that the property stolen is personal identifying information of 25 or more persons; maintains $3,000 value - D felony.

*Adds to Grand larceny 2nd, personal identifying information of 100 or more persons maintains $50,000 limit - C felony.

*Adds to Grand larceny 1st, personal identifying information of 1,000 or more persons maintains $1 million valuation - B felony.

COMPUTER TAMPERING

Changes definition of without authorization in computer use to include going beyond the scope of permission granted Renumbers computer tampering to include a new computer tampering in the first degree by renumbering fourth, third, and second degrees one step lower The new computer tampering framework is as follows:

*Computer tampering 5th degree (formerly the 4th) - remains a class A misdemeanor.

*Computer tampering 4th degree - damages of $1,000 - remains an E felony.

*Computer tampering 3rd degree - damages of $3,000 - remains a D felony.

*Computer tampering 2nd degree - $50,000 - remains a C felony.

*Computer Tampering 1st degree - $1 million in damages - B felony.

DENIAL OF SERVICE ATTACK

New crimes against denial of service defined as the transmission of a program, information, code, or command, or other electronic communication, and as a result of such conduct, intentionally makes the computer, computer service, computer program, or computer network temporarily or indefinitely unavailable to its intended users.

*Denial of Service Attack 5th - A misdemeanor.

*Denial of service attack 4th - damages or loss that exceeds $1,000 - E felony.

*Denial of service attack 3rd - damages or loss of $3,000 - D felony.

*Denial of service attack 2nd - damages or loss that exceeds $50,000 - C felony.

*Denial of service attack 1st - damages or loss that exceeds $1 million - B felony.

CRIMINAL POSSESSION OF STOLEN PROPERTY

Adds personally identifying information to the definition of stolen property, and creates a new framework:

*Criminal possession of stolen property 4th - adds personal identifying information.

*Criminal possession of stolen property 3rd - value exceeds $3,000 or 25 or more victims - D felony.

*Criminal possession of stolen property 2nd - value exceeds $50,000 or the consists of personal identifying information of one hundred or more persons - C felony.

*Criminal possession of stolen property 1st - value exceeds $1 million or the consists of personal identifying information of one thousand or more persons - B felony.

SCHEME TO DEFRAUD

Creates graduated scheme to defraud:

*Scheme to Defraud 5th - No specified value or number of victims - A Misdemeanor.

*Scheme to Defraud 4th - Greater than $1,000 or 10 or more victims or one vulnerable elderly person - E Felony.

*Scheme to Defraud 3rd - Greater than $3,000 or 25 or more victims - D Felony.

*Scheme to Defraud 2nd - Greater than $50,000 or 100 or more victims - C Felony.

*Scheme to Defraud 1st - Greater than $1,000,000 or 1,000 or more victims - B Felony.

IDENTIFY THEFT

Renumbers current sections to Create a graduated provision in place of the level penalty that currently exists:

*Identity Theft 5th - No specified value or number of victims - A Misdemeanor.

*Identity Theft 4th - Greater than $500 or 3 or more victims - E Felony.

*Identity Theft 3rd - Greater than $2,000 or 10 or more victims - D Felony.

*Identity Theft 2nd - Greater than $25,000 or 25 or more victims - C Felony

*Identity Theft 1st - Greater than $500,000 or 100 or more victims - B Felony.

*Aggravated identity theft - includes vulnerable elderly person or a physically disabled person in an aggregate amount that exceeds five hundred dollars - D felony.

SKIMMER DEVICE

*Criminal possession of a skimmer device 2nd - D Felony.

*Criminal possession of a skimmer device 1st - C Felony.

VENUE & SEARCH WARRANTS

*Adds to CPL Geographical jurisdiction of offenses an offense of larceny, criminal possession of stolen property, and personal identifying information or computer data or computer program.

*CPL Search warrants - adds electronic communication service or remote computing service, defines "Electronic Communications services" and adds any company, corporation or entity which is headquartered or located outside of the State of New York, and which conducts its regular business in New York or that offers its services to residents of New York.

Existing law

New bill.

Justification

Cybercrime and identity theft are the fastest growing crimes in New York and around the country, with almost daily reports of breaches of customer information from large and small institutions. New York's criminal laws have not kept pace with technology, and do not reflect new modes of communication, or the ways companies conduct their businesses, or provide adequate punishment for the serious damage suffered by victims of cybercrimes and identity thefts. This legislation modernizes the criminal laws, provides new tools for law enforcement, and creates an appropriate graduated scheme for prosecutions:

1. Identity Theft and Related Statutes -

a. Increase Identity Theft Penalties to Reflect the Severity of the Crime The most severe criminal statute that penalizes identity theft is Penal Law 190.80 (Identity Theft in the First Degree), which provides, in relevant part, that one who engages in identity theft that causes more than $2,000 in losses is guilty of a Class D felony (See Penal Law § 190.80(2)), but the statute does not distinguish between more and less severe instances of identity theft, meaning that theft that causes $2,001 in losses faces the same charge as theft that causes losses of $500,000, or more. Similarly, stealing numerous victims may be subject to no greater penalty than stealing the identity of a single person

b. Repeat Offenders. The bill extends the lookback period from five years to 10 years, similar to Persistent Sexual Abuse, Vehicular Assault in the First Degree, Menacing in the First Degree, and others It also provides a tolling provision that "stops the clock" during the time a defendant is incarcerated. Finally, it includes a prior conviction for any larceny crime in Article 155, any criminal possession of stolen property crime in Article 165, and any offense listed in Articles 170 ("Other Frauds") and 190 ("Forgery or Related Offenses") as a qualifying predicate offense for "bump up."

c. Aggravated Identity Theft-In 2007, the legislature created Aggravated Identity Theft (Penal Law § 190.80-a), which makes it a Class D felony to engage in identity theft and thereby cause gain or loss of $500 or more, while knowing that the person whose identity is stolen is a member of the armed forces serving overseas. The bill includes other vulnerable groups, the elderly, the incompetent, and the physically disabled in the ambit of the law.

2. Criminal Possession of a Skimmer Device

A "skimmer device" is defined as a "device designed or adapted to obtain person identifying information from a credit card, debit card, public benefit card, access card or device, or other card or device that contains personal identifying information." Skimmer devices are essential in almost all cybercrime, identity theft, and forgery-related crimes. Because of skimmer devices' central importance to such crimes, the penalties for unlawful possession of skimmer devices should be increased.

3. Computer Crimes

a. Definition of "Computer Material." The current definition is restricted to medical records, government records, or data that provides a competitive advantage to the individual accessing it without permission As a consequence, computer trespass, duplication, or tampering that affect other kinds of computer data - such as personal, non-commercial information that may be equally dear to the rightful owners of such data - cannot be effectively prosecuted. For example, hacking into private citizens' emails may be prosecuted as only a misdemeanor rather than a felony. The definition of "computer material" is broadened so that Computer Trespass, Unlawful Duplication of Computer Related Material in the Second Degree, and Computer Tampering in the Second and Third Degrees may be charged even where the material trespassed, duplicated, or tampered with is not medical or government records or competitively sensitive data. The measure also clarifies "Without Authorization" to include exceeding limited access to engage in wrongdoing.

b. Computer Tampering - The highest level of computer tampering, which is the alteration or destruction of any of the data or programs on a computer by one whose use of or access to the computer is without authorization, is Computer Tampering in the First Degree, a C felony, which applies in any instance in which one engaged computer tampering and thereby causes damages exceeding $50,000. This does not meaningfully distinguish between more and less severe instances of computer tampering, and it provides an insufficient penalty for very serious instances of computer tampering, the change is to create a graduated set of penalties based on damages or the numbers of people affected.

c. Scheme to Defraud- The crime is only a Class E felony, regardless of the value of property obtained. A defendant who defrauds numerous victims may be subject to no greater penalty than a defendant who defrauds a single victim. The bill creates a graduated scheme to defraud

d. Larceny and Criminal Possession of Stolen Property - Larceny and stolen property laws largely apply only to circumstances surrounding the fraudulent and unauthorized use of personal identifying information, as opposed to the theft and possession of the personal identifying information itself. The bill expands larceny and criminal possession of stolen property laws to cover individuals who steal and possess personal identifying information and provides graduated offenses involving possession of stolen personal identifying information.

e. Venue - the bill changes the law so that the same venue provisions apply to larceny and criminal possession of stolen property as they relate to personal identifying information. Identity theft often crosses county, state, and even national borders.

f. Search Warrants - Under CPL Article 690 20(1), search warrants issued by New York courts cannot be executed outside of the State As a consequence, it is difficult to execute search warrants for email content or social media accounts (many of which are based in California) In several other states search warrants issued by the state's courts may be executed outside of the state. The bill amends CPL to allow for the execution of search warrants for electronic records, email accounts, etc., outside New York State. It does not seek to permit the execution outside of the state of search warrants that seek non-electronic content.

Legislative history

2015 S. 4072 Passed Senate.

Fiscal implications

To be determined, but it is likely that this will result in an increase in penalty revenues.

Effective date

Immediate.