Strengthen Cyber Crime Penalties

Section 1. Subdivisions 1, 2, 3 and 4 of section 155.00 of the penal law, subdivision 1 as amended by chapter 514 of the laws of 1986, are amended and two new subdivisions 10 and 11 are added to read as follows:

1. "Property" means any money, personal property, real property, computer data, computer program, personal identifying information, secret scientific material, thing in action, evidence of debt or contract, or any article, substance or thing of value, including any gas, steam, water or electricity, which is provided for a charge or compensation.

2. "Obtain" includes, but is not limited to, the bringing about of a transfer or purported transfer of property or of a legal interest therein, whether to the obtainer or another. With regard to personal identifying information, computer data or computer program, obtain includes duplicating, recording, copying, downloading, uploading or printing out the information, data, or program, or obtaining a physical object containing such information. With regard to service, obtain includes, but is not limited to, using or accessing a service.

3. "Deprive." To "deprive" another of property means (a) to withhold it or cause it to be withheld from him or her permanently or for so extended a period or under such circumstances that the major portion of its economic value or benefit is lost to him or her, or (b) to dispose of the property in such manner or under such circumstances as to render

EXPLANATION--Matter in italics (underscored) is new; matter in brackets

[ ] is old law to be omitted.

LBD03876-03-7

S. 2406--A 2

it unlikely that an owner will recover such property. When the property is personal identifying information, computer data or computer program, to deprive another of its means to obtain it or cause a third person to obtain it under such circumstances that a substantial portion of the economic benefit or value of having control over it or authority over its use is lost to an owner. To deprive another of service is to use or access a service or cause a third person to use or access a service under such circumstances that some of the economic benefit or value of having control or authority over providing the service is lost to an owner.

4. "Appropriate." To "appropriate" property of another to oneself or a third person means (a) to exercise control over it, or to aid a third person to exercise control over it, permanently or for so extended a period or under such circumstances as to acquire the major portion of its economic value or benefit, or (b) to dispose of the property for the benefit of oneself or a third person. When the property is personal identifying information, computer data or computer program of another, to appropriate it to oneself or a third person means to obtain it under such circumstances as to acquire the ability to use it or dispose of it to the economic benefit of oneself or a third person or to the economic detriment or damage of an owner. To appropriate a service provided by another to oneself or a third person means to use or access the service under such circumstances as to acquire the ability to use it to the economic benefit of oneself or a third person or to the economic detriment or damage of an owner.

10. "Computer program" means an ordered set of data representing coded instructions or statements that when executed by the computer, cause the computer to process data or direct the computer to perform one or more computer operations or both and may be in any form, including magnetic storage media, optical media, computing devices, punched cards, or stored internally in the memory of the computer.

11. "Computer data" means a representation of information, knowledge, facts, concept or instructions which are being processed, or have been processed in a computer and may be in any form including magnetic storage media, punched cards, or stored internally in the memory of the computer.

§ 2. Paragraph (c) of subdivision 2 of section 155.05 of the penal law is amended and a new paragraph (f) is added to read as follows:

(c) By committing the crime of issuing a bad check, as defined in section 190.05, or by obtaining property or service by using or presenting a form of payment or personal identifying information the actor knows he or she is not authorized to use or knows is expired or forged or otherwise not valid;

(f) By theft of service. Theft of service means either: (i) using or accessing a service in a manner that otherwise requires payment and intentionally failing to pay for such use or access by either tampering without authority with a delivery, payment, or measurement device or mechanism, or by entering or leaving premises where the service is provided by stealth or by evading a physical barrier, or (ii) using or accessing a service in a manner that otherwise requires payment or the presentation of personal identifying information and using or presenting a form of payment or personal identifying information the actor knows he or she is not authorized to use or knows is expired or forged or otherwise not valid.

§ 3. Subdivision 1 of section 155.20 of the penal law is amended to read as follows:

S. 2406--A 3

1. Except as otherwise specified in this section, value means the market value of the property at the time and place of the crime, or if such cannot be satisfactorily ascertained, the cost of replacement of the property within a reasonable time after the crime. With regard to service, value shall also mean the cost of providing the service at the time of the crime, and with regard to the value of computer data or computer program value shall mean the replacement cost or the market value at the time and place of the crime, or the cost to write or develop such data and/or program, whichever is greater.

§ 4. The penal law is amended by adding a new section 155.23 to read as follows: § 155.23 Petit theft of service.

A person is guilty of petit theft of service when he or she steals a service.

Petit theft of service is a class B misdemeanor.

§ 5. Section 155.25 of the penal law is amended to read as follows: § 155.25 Petit larceny.

A person is guilty of petit larceny when he or she steals property, or steals a service and the value of the service exceeds five hundred dollars.

Petit larceny is a class A misdemeanor.

§ 6. The opening paragraph and subdivisions 1, 4 and 6 of section 155.30 of the penal law, the opening paragraph and subdivisions 1 and 6 as amended by chapter 515 of the laws of 1986, subdivision 4 as amended by chapter 556 of the laws of 1987, are amended to read as follows:

A person is guilty of grand larceny in the fourth degree when he or she steals property or a service and when:

1. The value of the property or service exceeds one thousand dollars; or

4. The property consists of a credit card or debit card or personal identifying information; or

6. The property or service, regardless of its nature and value, is obtained by extortion; or

§ 7. Section 155.35 of the penal law, as amended by chapter 464 of the laws of 2010, is amended to read as follows: § 155.35 Grand larceny in the third degree.

A person is guilty of grand larceny in the third degree when he or she steals property or a service and:

1. when the value of the property exceeds three thousand dollars, or

2. the property is an automated teller machine or the contents of an automated teller machine, or

3. the property is personal identifying information of twenty-five or more persons.

Grand larceny in the third degree is a class D felony.

§ 8. Section 155.40 of the penal law, as amended by chapter 515 of the laws of 1986, is amended to read as follows: § 155.40 Grand larceny in the second degree.

A person is guilty of grand larceny in the second degree when he or she steals property or a service and when:

1. The value of the property or service exceeds fifty thousand dollars; or

2. The property or service, regardless of its nature and value, is obtained by extortion committed by instilling in the victim a fear that the actor or another person will (a) cause physical injury to some person in the future, or (b) cause damage to property, or (c) use or abuse his or her position as a public servant by engaging in conduct

S. 2406--A 4

within or related to his or her official duties, or by failing or refusing to perform an official duty, in such manner as to affect some person adversely, or

3. the property is personal identifying information of one hundred or more persons.

Grand larceny in the second degree is a class C felony.

§ 9. Section 155.42 of the penal law, as added by chapter 515 of the laws of 1986, is amended to read as follows: § 155.42 Grand larceny in the first degree.

A person is guilty of grand larceny in the first degree when he or she steals property or a service and when the value of the property or service exceeds one million dollars; or the property is personal identifying information of one thousand or more persons.

Grand larceny in the first degree is a class B felony.

§ 10. Subdivisions 5 and 8 of section 156.00 of the penal law, subdivision 5 as amended and subdivision 8 as added by chapter 558 of the laws of 2006, are amended to read as follows:

5. "Computer material" is property and means any computer data or computer program which:

(a) contains records of the medical history or medical treatment of an identified or readily identifiable individual or individuals. This term shall not apply to the gaining access to or duplication solely of the medical history or medical treatment records of a person by that person or by another specifically authorized by the person whose records are gained access to or duplicated; or

(b) contains records maintained by the state or any political subdivision thereof or any governmental instrumentality within the state which contains any information concerning a person, as defined in subdivision seven of section 10.00 of this chapter, which because of name, number, symbol, mark or other identifier, can be used to identify the person and which is otherwise prohibited by law from being disclosed. This term shall not apply to the gaining access to or duplication solely of records of a person by that person or by another specifically authorized by the person whose records are gained access to or duplicated; or

(c) is not and is not intended to be available to anyone other than the person or persons rightfully in possession thereof or selected persons having access thereto with his, her or their consent and which [accords or may accord such rightful possessors an advantage over competitors or other persons who do not have knowledge or the benefit thereof] any person, other than a person rightfully in possession, knows or should know is not intended to be available to him or her.

8. "Without authorization" means to use or to access a computer, computer service or computer network without the permission of the owner or lessor or someone licensed or privileged by the owner or lessor where such person knew that his or her use or access was without permission or after actual notice to such person that such use or access was without permission, or that such use or access was for purposes other than those for which permission was granted by the owner, lessor, or someone licensed or privileged by such owner or lessor. It shall also mean the access of a computer service by a person without permission where such person knew that such access was without permission or after actual notice to such person, that such access was without permission.

Proof that such person used or accessed a computer, computer service or computer network through the knowing use of a set of instructions, code or computer program that bypasses, defrauds or otherwise circumvents a security measure installed or used with the user's authorization

S. 2406--A 5

on the computer, computer service or computer network shall be presumptive evidence that such person used or accessed such computer, computer service or computer network without authorization.

§ 11. Section 156.20 of the penal law, as amended by chapter 558 of the laws of 2006, is amended to read as follows: § 156.20 Computer tampering in the [fourth] fifth degree.

A person is guilty of computer tampering in the [fourth] fifth degree when he or she uses, causes to be used, or accesses a computer, computer service, or computer network without authorization and he or she intentionally alters in any manner or destroys computer data or a computer program of another person.

Computer tampering in the [fourth] fifth degree is a class A misdemeanor.

§ 12. Section 156.25 of the penal law, as amended by chapter 89 of the laws of 1993, subdivision 2 as amended by chapter 376 of the laws of 1997, is amended to read as follows: § 156.25 Computer tampering in the [third] fourth degree.

A person is guilty of computer tampering in the third degree when he or she commits the crime of computer tampering in the [fourth] fifth degree and:

1. he or she does so with an intent to commit or attempt to commit or further the commission of any felony; or

2. he or she has been previously convicted of any crime under this article or subdivision eleven of section 165.15 of this chapter; or