Ban Computer Spyware

Section 1. This act shall be known and be cited as the "computer spyware protection act".

§ 2. It is the intent of the legislature to protect owners and operators of computers in this state from the use of spyware and malware that is deceptively or surreptitiously installed on the owner's or the operator's computer.

§ 3. The general business law is amended by adding a new section 399-k to read as follows:

§ 399-k. Computer spyware protection. 1. For the purposes of this section the following terms shall have the following meanings:

(a) "Cause to be copied" means to distribute or transfer computer software, or any component thereof. Such term shall not include providing:

(i) transmission, routing, provision of intermediate temporary storage, or caching of software;

(ii) a storage or hosting medium, such as a compact disk, web site, or computer server through which the software was distributed by a third party; or

(iii) an information location tool, such as a directory, index, reference, pointer, or hypertext link, through which the user of the computer located the software.

(b) "Computer software" means a sequence of instructions written in any programming language that is executed on a computer. "Computer software" does not include a data component of a web page that is not executable independently of the web page.

EXPLANATION--Matter in italics (underscored) is new; matter in brackets

[ ] is old law to be omitted.

LBD04691-01-7

A. 506 2

(c) "Computer virus" means a computer program or other set of instructions that is designed to degrade the performance of or disable a computer or computer network and is designed to have the ability to replicate itself on other computers or computer networks without the authorization of the owners of those computers or computer networks.

(d) "Damage" means any significant impairment to the integrity or availability of data, software, a system, or information.

(e) "Execute", when used with respect to computer software, means the performance of the functions or the carrying out of the instructions of the computer software.

(f) "Intentionally deceptive" means any of the following:

(i) An intentionally and materially false or fraudulent statement.

(ii) A statement or description that intentionally omits or misrepresents material information in order to deceive an owner or operator of a computer.

(iii) An intentional and material failure to provide a notice to an owner or operator regarding the installation or execution of computer software for the purpose of deceiving the owner or operator.

(g) "Internet" means the global information system that is logically linked together by a globally unique address space based on the Internet protocol (IP), or its subsequent extensions, and that is able to support communications using the transmission control protocol/Internet protocol (TCP/IP) suite, or its subsequent extensions, or other IP-compatible protocols, and that provides, uses, or makes accessible, either publicly or privately, high-level services layered on the communications and related infrastructure described in this paragraph.

(h) "Owner or operator" means the owner or lessee of a computer, or a person using such computer with the owner or lessee's authorization, but does not include a person who owned a computer prior to the first retail sale of the computer.

(i) "Message" means a graphical or text communication presented to an authorized user of a computer.

(j) "Person" means any individual, partnership, corporation, limited liability company, or other organization, or any combination thereof.

(k) "Personally identifiable information" means any of the following information if it allows the entity holding the information to identify the owner or operator of a computer:

(i) the first name or first initial in combination with the last name;

(ii) a home or other physical address including street name;

(iii) personal identification code in conjunction with a password required to access an identified account, other than a password, personal identification number or other identification number transmitted by an authorized user to the issuer of the account or its agent;

(iv) social security number, tax identification number, driver's license number, passport number, or any other government-issued identification number; or

(v) account balance, overdraft history, or payment history that personally identifies an owner or operator of a computer.

2. It is unlawful for a person who is not an owner or operator of a computer to cause computer software to be copied on such computer knowingly or with conscious avoidance of actual knowledge or willfully, and to use such software to do any of the following:

(a) Modify, through intentionally deceptive means, settings of a computer that control any of the following:

A. 506 3

(i) the web page that appears when an owner or operator launches an Internet browser or similar computer software used to access and navigate the Internet.

(ii) the default provider or web proxy that an owner or operator uses to access or search the Internet.

(iii) an owner's or an operator's list of bookmarks used to access web pages.

(b) Collect, through intentionally deceptive means, personally identifiable information through any of the following means:

(i) the use of a keystroke-logging function that records all or substantially all keystrokes made by an owner or operator of a computer and transfers that information from the computer to another person;

(ii) in a manner that correlates personally identifiable information with data regarding all or substantially all of the web sites visited by an owner or operator, other than web sites operated by the person providing such software, if the computer software was installed in a manner designed to conceal from all authorized users of the computer the fact that the software is being installed; or

(iii) by extracting from the hard drive of an owner's or an operator's computer, an owner's or an operator's social security number, tax identification number, driver's licence number, passport number, any other government-issued identification number, account balances, or overdraft history for a purpose unrelated to any of the purposes of this software or service described to an authorized user.

(c) Prevent, through intentionally deceptive means, an owner's or an operator's reasonable efforts to block the installation of or execution of, or to disable computer software by causing computer software that the owner or operator has properly removed or disabled to automatically reinstall or reactivate on the computer without the authorization of an authorized user.

(d) Intentionally misrepresent that computer software will be uninstalled or disabled by an owner's or an operator's action.

(e) Through intentionally deceptive means, remove, disable, or render inoperative security, antispyware, or antivirus computer software installed on an owner's or an operator's computer.

(f) Enable use of an owner's or an operator's computer to do any of the following:

(i) Accessing or using a modem or Internet service for the purpose of causing damage to an owner's or an operator's computer or causing an owner or operator, or a third party affected by such conduct to incur financial charges for a service that the owner or operator did not authorize;

(ii) Opening multiple, sequential, stand-alone messages in an owner's or an operator's computer without the authorization of an owner or operator and with knowledge that a reasonable computer user could not close the messages without turning off the computer or closing the software application in which the messages appear; provided that this paragraph shall not apply to communications originated by the computer's operating system, originated by a software application that the user chooses to activate, originated by a service provider that the user chooses to use, or presented for any of the purposes described in this subdivision; or

(iii) Transmitting or relaying commercial electronic mail or a computer virus from the computer, where the transmission or relaying is initiated by a person other than the authorized user and without the authorization of an authorized user.

A. 506 4

(g) Modify any of the following settings related to the computer's access to, or use of, the Internet:

(i) Settings that protect information about an owner or operator for the purpose of taking personally identifiable information of the owner or operator;

(ii) Security settings for the purpose of causing damage to a computer; or

(iii) Settings that protect the computer from the uses identified in paragraph (f) of this subdivision.

(h) Prevent, without the authorization of an owner or operator, an owner's or an operator's reasonable efforts to block the installation of, or to disable, computer software by doing any of the following:

(i) Presenting the owner or operator with an option to decline installation of computer software with knowledge that, when the option is selected by the authorized user, the installation nevertheless proceeds;

(ii) Falsely representing that computer software has been disabled;

(iii) Requiring in an intentionally deceptive manner the user to access the Internet to remove the software with knowledge or reckless disregard of the fact that the software frequently operates in a manner that prevents the user from accessing the Internet;

(iv) Changing the name, location or other designation information of the software for the purpose of preventing an authorized user from locating the software to remove it;

(v) Using randomized or intentionally deceptive filenames, directory folders, formats, or registry entries for the purpose of avoiding detection and removal of the software by an authorized user;

(vi) Causing the installation of software in a particular computer directory or computer memory for the purpose of evading authorized users' attempts to remove the software from the computer; or

(vii) Requiring, without the authority of the owner of the computer, that an authorized user obtain a special code or download software from a third party to uninstall the software.

3. It is unlawful for a person who is not an owner or operator of a computer to do any of the following with regard to the computer:

(a) Induce an owner or operator to install a computer software component onto the owner's or the operator's computer by intentionally misrepresenting that installing computer software is necessary for security or privacy reasons or in order to open, view, or play a particular type of content; or

(b) Using intentionally deceptive means to cause the execution of a computer software component with the intent of causing the computer to use such component in a manner that violates any other provision of this chapter.

4. Subdivisions two and three of this section shall not apply to the monitoring of, or interaction with, an owner's or an operator's Internet or other network connection, service, or computer, by a telecommunications carrier, cable operator, computer hardware or software provider, or provider of information service or interactive computer service for network or computer security purposes, diagnostics, technical support, maintenance, repair, network management, authorized updates of computer software or system firmware, authorized remote system management, or detection or prevention of the unauthorized use of or fraudulent or other illegal activities in connection with a network, service, or computer software, including scanning for and removing computer software prescribed under this section.

A. 506 5

5. (a) The attorney general, an Internet service provider or software company that expends resources in good faith assisting authorized users harmed by a violation of this section, or a trademark owner whose mark is used to deceive authorized users in violation of this section, may bring a civil action against a person who violates any provision of this section to recover actual damages, liquidated damages of at least one thousand dollars per violation of this section, not to exceed one million dollars for a pattern or practice of such violations, attorney fees, and costs.

(b) The court may increase a damage award to an amount equal to not more than three times the amount otherwise recoverable under paragraph (a) of this subdivision if the court determines that the defendant committed the violation willfully and knowingly.

(c) The court may reduce liquidated damages recoverable under paragraph (a) of this subdivision, to a minimum of one hundred dollars, not to exceed one hundred thousand dollars for each violation if the court finds that the defendant established and implemented practices and procedures reasonably designed to prevent a violation of this section.