PRINTER'S NO. 3563
No. 2595 Session of 1998
INTRODUCED BY BENNINGHOFF, CLARK, DeLUCA, HERMAN, FAIRCHILD, GODSHALL, HALUSKA, HUTCHINSON, LYNCH, MAITLAND, McCALL, MILLER, OLASZ, READSHAW, ROBINSON, ROSS, SATHER, SERAFINI, SEYFERT, E. Z. TAYLOR, THOMAS, TRELLO, WALKO, YOUNGBLOOD AND HENNESSEY, MAY 6, 1998
REFERRED TO COMMITTEE ON JUDICIARY, MAY 6, 1998
AN ACT 1 Regulating criminal conduct concerning computer activities; 2 providing for remedies, for penalties, for forfeiture and for 3 defenses. 4 The General Assembly of the Commonwealth of Pennsylvania 5 hereby enacts as follows: 6 Section 1. Short title. 7 This act shall be known and may be cited as the Computer 8 Crimes Control Act. 9 Section 2. Legislative intent. 10 The General Assembly finds and declares as follows: 11 (1) It is the intent of the General Assembly in enacting 12 this act to expand the degree of protection afforded to 13 individuals, businesses and governmental agencies from 14 tampering, interference, damage and unauthorized access to 15 lawfully created computer data and computer systems. 16 (2) The proliferation of computer technology has 17 resulted in a concomitant proliferation of computer crime and
1 other forms of unauthorized access to computers, computer 2 systems and computer data. 3 (3) Protection of the integrity of all types and forms 4 of lawfully created computers, computer systems and computer 5 data is vital to the protection of the privacy of individuals 6 as well as to the well-being of financial institutions, 7 business concerns, governmental agencies and others within 8 this Commonwealth that lawfully utilize those computers, 9 computer systems and data. 10 Section 3. Definitions. 11 The following words and phrases when used in this act shall 12 have the meanings given to them in this section unless the 13 context clearly indicates otherwise: 14 "Access." To gain entry to, instruct or communicate with the 15 logical, arithmetical or memory function resources of a 16 computer, computer system or computer network. 17 "Computer contaminant." Any set of computer instructions 18 that are designed to modify, damage, destroy, record or transmit 19 information within a computer, computer system or computer 20 network without the intent or permission of the owner of the 21 information. They include, but are not limited to, a group of 22 computer instructions commonly called viruses or worms, which 23 are self-replicating or self-propagating and are designed to 24 contaminate other computer programs or computer data, consume 25 computer resources, modify, destroy, record or transmit data or 26 in some other fashion usurp the normal operation of the 27 computer, computer system or computer network. 28 "Computer network." Any system which provides communications 29 between one or more computer systems and input/output devices, 30 including, but not limited to, display terminals and printers 19980H2595B3563 - 2 -
1 connected by telecommunication facilities. 2 "Computer program or software." A set of instructions or 3 statements and related data that, when executed in actual or 4 modified form, cause a computer, computer system or computer 5 network to perform specified functions. 6 "Computer services." The term includes, but is not limited 7 to, computer time, data processing or storage functions, or 8 other uses of a computer, computer system or computer network. 9 "Computer system." A device or collection of devices, 10 including support devices and excluding calculators which are 11 not programmable and capable of being used in conjunction with 12 external files, one or more of which contain computer programs, 13 electronic instructions, input data and output data, that 14 perform functions, including, but not limited to, logic, 15 arithmetic, data storage and retrieval, communication and 16 control. 17 "Data." A representation of information, knowledge, facts, 18 concepts, computer software, computer programs or instructions. 19 Data may be in any form, in storage media or as stored in the 20 memory of the computer or in transit or presented on a display 21 device. 22 "Injury." Any alteration, deletion, damage or destruction of 23 a computer system, computer network, computer program or data 24 caused by the access. 25 "Supporting documentation." The term includes, but is not 26 limited to, all information, in any form, pertaining to the 27 design, construction, classification, implementation, use or 28 modification of a computer, computer system, computer network, 29 computer program or computer software, which information is not 30 generally available to the public and is necessary for the 19980H2595B3563 - 3 -
1 operation of a computer, computer system, computer network, 2 computer program or computer software. 3 "Victim expenditure." Any expenditure reasonably and 4 necessarily incurred by the owner or lessee to verify that a 5 computer system, computer network, computer program or data was 6 or was not altered, deleted, damaged or destroyed by the access. 7 Section 4. Computer crimes. 8 A person commits the crime of computer interference if he: 9 (1) Knowingly accesses and without permission alters, 10 damages, deletes, destroys or otherwise uses any data, 11 computer, computer system or computer network in order to 12 either: 13 (i) devise or execute any scheme or artifice to 14 defraud, deceive or extort; or 15 (ii) wrongfully control or obtain money, property or 16 data. 17 (2) Knowingly accesses and without permission takes, 18 copies or makes use of any data from a computer, computer 19 system or computer network or takes or copies any supporting 20 documentation, whether existing or residing internal or 21 external to a computer, computer system or computer network. 22 (3) Knowingly and without permission uses or causes to 23 be used computer services. 24 (4) Knowingly accesses and without permission adds, 25 alters damages, deletes or destroys any data, computer 26 software or computer programs which reside or exist internal 27 or external to a computer, computer system or computer 28 network. 29 (5) Knowingly and without permission disrupts or causes 30 the disruption of computer services or denies or causes the 19980H2595B3563 - 4 -
1 denial of computer services to an authorized user of a 2 computer, computer system or computer network. 3 (6) Knowingly and without permission provides or assists 4 in providing a means of accessing a computer, computer system 5 or computer network in violation of this section. 6 (7) Knowingly and without permission accesses or causes 7 to be accessed any computer, computer system or computer 8 network. 9 (8) Knowingly introduces any computer contaminant into 10 any computer, computer system or computer network. 11 Section 5. Penalties. 12 Any person who violates: 13 (1) Any of the provisions of section 4(1), (2), (4) or 14 (5) commits a misdemeanor of the first degree. 15 (2) Section 4(3): 16 (i) For the first violation which does not result in 17 injury and where the value of the computer services used 18 does not exceed $400 commits a misdemeanor of the second 19 degree. 20 (ii) For any violation which results in a victim 21 expenditure in an amount greater than $5,000 or in an 22 injury, or if the value of the computer services used 23 exceeds $400, or for any second or subsequent violation, 24 commits a misdemeanor of the first degree. 25 (3) Section 4(6), (7) or (8): 26 (i) For a first violation which does not result in 27 injury, commits a summary offense. 28 (ii) For any violation which results in a victim 29 expenditure in an amount not greater than $5,000, or for 30 a second or subsequent violation, commits a misdemeanor 19980H2595B3563 - 5 -
1 of the second degree. 2 (iii) For any violation which results in a victim 3 expenditure in an amount greater than $5,000 commits a 4 misdemeanor of the first degree. 5 Section 6. Civil action. 6 (a) General rule.--In addition to any other civil remedy 7 available, the owner or lessee of the computer, computer system, 8 computer network, computer program or data may bring a civil 9 action against any person convicted under this section for 10 compensatory damages, including any expenditure reasonably and 11 necessarily incurred by the owner or lessee to verify that a 12 computer system, computer network, computer program or data was 13 or was not altered, damaged or deleted by the access. For the 14 purposes of actions authorized by this section, the conduct of 15 an unemancipated minor shall be imputed to the parent or legal 16 guardian having control or custody of the minor. 17 (b) Attorney fees.--In any action brought pursuant to this 18 section, the court may award reasonable attorney fees to a 19 prevailing party. 20 (c) Education facilities.--A community college, State 21 university or academic institution accredited in this 22 Commonwealth shall include computer-related crimes as a specific 23 violation of college or university student conduct policies and 24 regulations that may subject a student to disciplinary sanctions 25 up to and including dismissal from the academic institution. 26 Section 7. Forfeiture of property. 27 Any computer, computer system or computer network, or any 28 software or data, owned by a defendant which is used during the 29 commission of any offense described in section 4 or any computer 30 owned by the defendant which is used as a repository for the 19980H2595B3563 - 6 -
1 storage of software or data illegally obtained shall be subject 2 to forfeiture. 3 Section 8. Defenses. 4 Section 4 shall not apply to any person who accesses his or 5 her employer's computer system, computer network, computer 6 program or data when acting within the scope of his or her 7 lawful employment. Section 4(3) shall not apply to any employee 8 who accesses or uses his or her employer's computer system, 9 computer network, computer program or data when acting outside 10 the scope of his or her lawful employment, so long as the 11 employee's activities do not cause an injury to the employer or 12 others or so long as the value of supplies and computer services 13 which are used do not exceed an accumulated total of $100. 14 Section 9. Applicability to remote access. 15 For purposes of bringing a civil or a criminal action under 16 this act, a person who causes, by any means, the access of a 17 computer, computer system or computer network in one 18 jurisdiction from another jurisdiction is deemed to have 19 personally accessed the computer, computer system or computer 20 network in each jurisdiction. 21 Section 10. Effective date. 22 This act shall take effect in 60 days. B19L18JRW/19980H2595B3563 - 7 -