Tougher Computer Crime Laws

Section 1. Section 156.00 of the penal law, as amended by chapter 558 of the laws of 2006, is amended to read as follows: § 156.00 Offenses involving computers; definition of terms.

The following definitions are applicable to this chapter except where different meanings are expressly specified:

1. "Computer" means a device or group of devices which, by manipulation of electronic, magnetic, optical or electrochemical impulses, pursuant to a computer program, can automatically perform arithmetic, logical, storage or retrieval operations with or on computer data, and includes any connected or directly related device, equipment or facility which enables such computer to store, retrieve or communicate to or from a person, another computer or another device the results of computer operations, computer programs or computer data.

2. "Computer program" is property and means an ordered set of data representing coded instructions or statements that, when executed by computer, cause the computer, computer system or computer network to process data or direct the computer, computer system or computer network to perform one or more computer operations or both and may be in any form, including magnetic storage media, punched cards, or stored internally in the memory of the computer.

3. "Computer data" is property and means a representation of information, knowledge, facts, concepts or instructions which are being processed, or have been processed in a computer and may be in any form, including magnetic storage media, punched cards, or stored internally in the memory of the computer.

EXPLANATION--Matter in italics (underscored) is new; matter in brackets

[ ] is old law to be omitted.

LBD08736-01-9

S. 2475 2

4. "Computer service" means any and all services provided by or through the facilities of any computer communication system allowing the input, output, examination, or transfer, of computer data or computer programs from one computer to another , including, but not limited to, computer time, data processing, storage functions, internet services, electronic mail services, electronic message services, or other use of a computer, computer system or computer network.

5. "Computer material" is property and means any computer data or computer program which:

(a) contains records of the medical history or medical treatment of an identified or readily identifiable individual or individuals. This term shall not apply to the gaining access to or duplication solely of the medical history or medical treatment records of a person by that person or by another specifically authorized by the person whose records are gained access to or duplicated; or

(b) contains records maintained by the state or any political subdivision thereof or any governmental instrumentality within the state which contains any information concerning a person, as defined in subdivision seven of section 10.00 of this chapter, which because of name, number, symbol, mark or other identifier, can be used to identify the person and which is otherwise prohibited by law from being disclosed. This term shall not apply to the gaining access to or duplication solely of records of a person by that person or by another specifically authorized by the person whose records are gained access to or duplicated; or

(c) is not and is not intended to be available to anyone other than the person or persons rightfully in possession thereof or selected persons having access thereto with his, her or their consent and which accords or may accord such rightful possessors an advantage over competitors or other persons who do not have knowledge or the benefit thereof.

6. "Computer network" means the interconnection of hardwire or wireless communication lines with a computer through remote terminals, or a complex consisting of two or more interconnected computers, including, but not limited to, display terminals, remote systems, mobile devices, and printers connected by computer facilities.

7. "Access" means to gain entry to, instruct, cause input to, cause output from, cause data processing with, communicate with, store data in, retrieve from, or otherwise make use of any resources of a computer, computer system or computer network, physically, directly or by electronic means.

8. "Without authorization" means to use or to access a computer, computer service or computer network without the permission of the owner or lessor or someone licensed or privileged by the owner or lessor where such person knew that his or her use or access was without permission or after actual notice to such person that such use or access was without permission. It shall also mean the access of a computer service by a person without permission where such person knew that such access was without permission or after actual notice to such person, that such access was without permission.

Proof that such person used or accessed a computer, computer service or computer network through the knowing use of a set of instructions, code or computer program that bypasses, defrauds or otherwise circumvents a security measure installed or used with the user's authorization on the computer, computer service or computer network shall be presumptive evidence that such person used or accessed such computer, computer service or computer network without authorization.

S. 2475 3

9. "Felony" as used in this article means any felony defined in the laws of this state or any offense defined in the laws of any other jurisdiction for which a sentence to a term of imprisonment in excess of one year is authorized in this state.

10. "Computer system" means a device or collection of devices, including support devices and excluding calculators that are not programmable and capable of being used in conjunction with external files, one or more of which contain computer programs, electronic instructions, input data, and output data, that performs functions, including, but not limited to, logic, arithmetic, data storage and retrieval, communication, and control.

11. "Government computer system" means any computer system, or part thereof, that is owned, operated, or used by any federal, state, or local governmental entity.

12. "Public safety infrastructure computer system" means any computer system, or part thereof, that is necessary for the health and safety of the public including computer systems owned, operated, or used by drinking water and wastewater treatment facilities, hospitals, emergency service providers, telecommunication companies, and gas and electric utility companies.

13. "Supporting documentation" includes, but is not limited to, all information, in any form, pertaining to the design, construction, classification, implementation, use, or modification of a computer, computer system, computer network, computer program, or computer software, which information is not generally available to the public and is necessary for the operation of a computer, computer system, computer network, computer program, or computer software.

14. "Injury" means any alteration, deletion, damage, or destruction of a computer system, computer network, computer program, or data caused by the access, or the denial of access to legitimate users of a computer system, network, or program.

15. "Victim expenditure" means any expenditure reasonably and necessarily incurred by the owner or lessee to verify that a computer system, computer network, computer program, or data was or was not altered, deleted, damaged, or destroyed by the access.

16. "Computer contaminant" means any set of computer instructions that are designed to modify, damage, destroy, record, or transmit information within a computer, computer system, or computer network without the intent or permission of the owner of the information. They include, but are not limited to, a group of computer instructions commonly called viruses or worms, that are self-replicating or self-propagating and are designed to contaminate other computer programs or computer data, consume computer resources, modify, destroy, record, or transmit data, or in some other fashion usurp the normal operation of the computer, computer system, or computer network.

17. "Internet domain name" means a globally unique, hierarchical reference to an internet host or service, assigned through centralized internet naming authorities, comprising a series of character strings separated by periods, with the rightmost character string specifying the top of the hierarchy.

18. "Electronic mail" means an electronic message or computer file that is transmitted between two or more telecommunications devices; computers; computer networks, regardless of whether the network is a local, regional, or global network; or electronic devices capable of receiving electronic messages, regardless of whether the message is

S. 2475 4

converted to hard copy format after receipt, viewed upon transmission, or stored for later retrieval.

19. "Profile" means either of the following:

(a) a configuration of user data required by a computer so that the user may access programs or services and have the desired functionality on that computer; or

(b) an internet web site user's personal page or section of a page that is made up of data, in text or graphical form, that displays significant, unique, or identifying information, including, but not limited to, listing acquaintances, interests, associations, activities, or personal statements.

§ 2. Section 156.29 of the penal law, as added by chapter 590 of the laws of 2008, is amended to read as follows: § 156.29 Unlawful duplication of computer related material in the second

degree.

A person is guilty of unlawful duplication of computer related material in the second degree when having no right to do so, he or she copies, reproduces or duplicates or makes use of in any manner any data or computer material [that contains records of the medical history or medical treatment of an identified or readily identifiable individual or individuals with an intent to commit or further the commission of any crime under this chapter] from a computer, computer system, or computer network or takes or copies any supporting documentation, whether existing or residing internal or external to a computer, computer system, or computer network.

Unlawful duplication of computer related material in the second degree is a class B misdemeanor.

§ 3. Section 156.25 of the penal law, as amended by chapter 89 of the laws of 1993, subdivision 2 as amended by chapter 376 of the laws of 1997, is amended to read as follows: § 156.25 Computer tampering in the third degree.

A person is guilty of computer tampering in the third degree when he or she commits the crime of computer tampering in the fourth degree and:

1. he or she does so with an intent: (a) to commit or attempt to commit or further the commission of any felony, (b) to devise or execute any scheme or artifice to defraud, deceive, or extort, or (c) to wrongfully control or obtain money, property or data; or

2. he or she has been previously convicted of any crime under this article or subdivision eleven of section 165.15 of this chapter; or

3. he or she intentionally alters in any manner or destroys computer material; or

4. he or she intentionally alters in any manner or destroys computer data or a computer program so as to cause damages in an aggregate amount exceeding one thousand dollars; or

5. he or she alters in any manner or destroys any data, computer software, or computer programs which reside or exist internal or external to a public safety infrastructure computer system computer, computer system or computer network.

Computer tampering in the third degree is a class E felony.

§ 4. The penal law is amended by adding a new section 156.45 to read as follows: § 156.45 Unlawful disruption of computer services in the second degree.

A person is guilty of unlawful disruption of computer services in the second degree when he or she knowingly and without permission disrupts or causes the disruption of computer services or denies or causes the

S. 2475 5

denial of computer services to an authorized user of a computer, computer system, or computer network.

Unlawful disruption of computer services in the second degree is a class A misdemeanor.

§ 5. The penal law is amended by adding a new section 156.46 to read as follows: § 156.46 Unlawful disruption of computer services in the first degree.

A person is guilty of unlawful disruption of computer services in the first degree when he or she commits the crime of unlawful disruption of computer services in the second degree and:

1. he or she disrupts government computer services or denies or causes the denial of government computer services to an authorized user of a government computer, computer system, or computer network; or

2. he or she disrupts public safety infrastructure computer system computer services or denies or causes the denial of computer services to an authorized user of a public safety infrastructure computer system computer, computer system, or computer network.

Unlawful disruption of computer services in the second degree is a class E felony.

§ 6. The penal law is amended by adding a new section 156.15 to read as follows: § 156.15 Unlawful computer access assistance in the second degree.