PRINTER'S NO. 3563
No. 2595 Session of 1998
INTRODUCED BY BENNINGHOFF, CLARK, DeLUCA, HERMAN, FAIRCHILD,
GODSHALL, HALUSKA, HUTCHINSON, LYNCH, MAITLAND, McCALL,
MILLER, OLASZ, READSHAW, ROBINSON, ROSS, SATHER, SERAFINI,
SEYFERT, E. Z. TAYLOR, THOMAS, TRELLO, WALKO, YOUNGBLOOD AND
HENNESSEY, MAY 6, 1998
REFERRED TO COMMITTEE ON JUDICIARY, MAY 6, 1998
AN ACT
1 Regulating criminal conduct concerning computer activities;
2 providing for remedies, for penalties, for forfeiture and for
3 defenses.
4 The General Assembly of the Commonwealth of Pennsylvania
5 hereby enacts as follows:
6 Section 1. Short title.
7 This act shall be known and may be cited as the Computer
8 Crimes Control Act.
9 Section 2. Legislative intent.
10 The General Assembly finds and declares as follows:
11 (1) It is the intent of the General Assembly in enacting
12 this act to expand the degree of protection afforded to
13 individuals, businesses and governmental agencies from
14 tampering, interference, damage and unauthorized access to
15 lawfully created computer data and computer systems.
16 (2) The proliferation of computer technology has
17 resulted in a concomitant proliferation of computer crime and
1 other forms of unauthorized access to computers, computer
2 systems and computer data.
3 (3) Protection of the integrity of all types and forms
4 of lawfully created computers, computer systems and computer
5 data is vital to the protection of the privacy of individuals
6 as well as to the well-being of financial institutions,
7 business concerns, governmental agencies and others within
8 this Commonwealth that lawfully utilize those computers,
9 computer systems and data.
10 Section 3. Definitions.
11 The following words and phrases when used in this act shall
12 have the meanings given to them in this section unless the
13 context clearly indicates otherwise:
14 "Access." To gain entry to, instruct or communicate with the
15 logical, arithmetical or memory function resources of a
16 computer, computer system or computer network.
17 "Computer contaminant." Any set of computer instructions
18 that are designed to modify, damage, destroy, record or transmit
19 information within a computer, computer system or computer
20 network without the intent or permission of the owner of the
21 information. They include, but are not limited to, a group of
22 computer instructions commonly called viruses or worms, which
23 are self-replicating or self-propagating and are designed to
24 contaminate other computer programs or computer data, consume
25 computer resources, modify, destroy, record or transmit data or
26 in some other fashion usurp the normal operation of the
27 computer, computer system or computer network.
28 "Computer network." Any system which provides communications
29 between one or more computer systems and input/output devices,
30 including, but not limited to, display terminals and printers
19980H2595B3563 - 2 -
1 connected by telecommunication facilities.
2 "Computer program or software." A set of instructions or
3 statements and related data that, when executed in actual or
4 modified form, cause a computer, computer system or computer
5 network to perform specified functions.
6 "Computer services." The term includes, but is not limited
7 to, computer time, data processing or storage functions, or
8 other uses of a computer, computer system or computer network.
9 "Computer system." A device or collection of devices,
10 including support devices and excluding calculators which are
11 not programmable and capable of being used in conjunction with
12 external files, one or more of which contain computer programs,
13 electronic instructions, input data and output data, that
14 perform functions, including, but not limited to, logic,
15 arithmetic, data storage and retrieval, communication and
16 control.
17 "Data." A representation of information, knowledge, facts,
18 concepts, computer software, computer programs or instructions.
19 Data may be in any form, in storage media or as stored in the
20 memory of the computer or in transit or presented on a display
21 device.
22 "Injury." Any alteration, deletion, damage or destruction of
23 a computer system, computer network, computer program or data
24 caused by the access.
25 "Supporting documentation." The term includes, but is not
26 limited to, all information, in any form, pertaining to the
27 design, construction, classification, implementation, use or
28 modification of a computer, computer system, computer network,
29 computer program or computer software, which information is not
30 generally available to the public and is necessary for the
19980H2595B3563 - 3 -
1 operation of a computer, computer system, computer network,
2 computer program or computer software.
3 "Victim expenditure." Any expenditure reasonably and
4 necessarily incurred by the owner or lessee to verify that a
5 computer system, computer network, computer program or data was
6 or was not altered, deleted, damaged or destroyed by the access.
7 Section 4. Computer crimes.
8 A person commits the crime of computer interference if he:
9 (1) Knowingly accesses and without permission alters,
10 damages, deletes, destroys or otherwise uses any data,
11 computer, computer system or computer network in order to
12 either:
13 (i) devise or execute any scheme or artifice to
14 defraud, deceive or extort; or
15 (ii) wrongfully control or obtain money, property or
16 data.
17 (2) Knowingly accesses and without permission takes,
18 copies or makes use of any data from a computer, computer
19 system or computer network or takes or copies any supporting
20 documentation, whether existing or residing internal or
21 external to a computer, computer system or computer network.
22 (3) Knowingly and without permission uses or causes to
23 be used computer services.
24 (4) Knowingly accesses and without permission adds,
25 alters damages, deletes or destroys any data, computer
26 software or computer programs which reside or exist internal
27 or external to a computer, computer system or computer
28 network.
29 (5) Knowingly and without permission disrupts or causes
30 the disruption of computer services or denies or causes the
19980H2595B3563 - 4 -
1 denial of computer services to an authorized user of a
2 computer, computer system or computer network.
3 (6) Knowingly and without permission provides or assists
4 in providing a means of accessing a computer, computer system
5 or computer network in violation of this section.
6 (7) Knowingly and without permission accesses or causes
7 to be accessed any computer, computer system or computer
8 network.
9 (8) Knowingly introduces any computer contaminant into
10 any computer, computer system or computer network.
11 Section 5. Penalties.
12 Any person who violates:
13 (1) Any of the provisions of section 4(1), (2), (4) or
14 (5) commits a misdemeanor of the first degree.
15 (2) Section 4(3):
16 (i) For the first violation which does not result in
17 injury and where the value of the computer services used
18 does not exceed $400 commits a misdemeanor of the second
19 degree.
20 (ii) For any violation which results in a victim
21 expenditure in an amount greater than $5,000 or in an
22 injury, or if the value of the computer services used
23 exceeds $400, or for any second or subsequent violation,
24 commits a misdemeanor of the first degree.
25 (3) Section 4(6), (7) or (8):
26 (i) For a first violation which does not result in
27 injury, commits a summary offense.
28 (ii) For any violation which results in a victim
29 expenditure in an amount not greater than $5,000, or for
30 a second or subsequent violation, commits a misdemeanor
19980H2595B3563 - 5 -
1 of the second degree.
2 (iii) For any violation which results in a victim
3 expenditure in an amount greater than $5,000 commits a
4 misdemeanor of the first degree.
5 Section 6. Civil action.
6 (a) General rule.--In addition to any other civil remedy
7 available, the owner or lessee of the computer, computer system,
8 computer network, computer program or data may bring a civil
9 action against any person convicted under this section for
10 compensatory damages, including any expenditure reasonably and
11 necessarily incurred by the owner or lessee to verify that a
12 computer system, computer network, computer program or data was
13 or was not altered, damaged or deleted by the access. For the
14 purposes of actions authorized by this section, the conduct of
15 an unemancipated minor shall be imputed to the parent or legal
16 guardian having control or custody of the minor.
17 (b) Attorney fees.--In any action brought pursuant to this
18 section, the court may award reasonable attorney fees to a
19 prevailing party.
20 (c) Education facilities.--A community college, State
21 university or academic institution accredited in this
22 Commonwealth shall include computer-related crimes as a specific
23 violation of college or university student conduct policies and
24 regulations that may subject a student to disciplinary sanctions
25 up to and including dismissal from the academic institution.
26 Section 7. Forfeiture of property.
27 Any computer, computer system or computer network, or any
28 software or data, owned by a defendant which is used during the
29 commission of any offense described in section 4 or any computer
30 owned by the defendant which is used as a repository for the
19980H2595B3563 - 6 -
1 storage of software or data illegally obtained shall be subject
2 to forfeiture.
3 Section 8. Defenses.
4 Section 4 shall not apply to any person who accesses his or
5 her employer's computer system, computer network, computer
6 program or data when acting within the scope of his or her
7 lawful employment. Section 4(3) shall not apply to any employee
8 who accesses or uses his or her employer's computer system,
9 computer network, computer program or data when acting outside
10 the scope of his or her lawful employment, so long as the
11 employee's activities do not cause an injury to the employer or
12 others or so long as the value of supplies and computer services
13 which are used do not exceed an accumulated total of $100.
14 Section 9. Applicability to remote access.
15 For purposes of bringing a civil or a criminal action under
16 this act, a person who causes, by any means, the access of a
17 computer, computer system or computer network in one
18 jurisdiction from another jurisdiction is deemed to have
19 personally accessed the computer, computer system or computer
20 network in each jurisdiction.
21 Section 10. Effective date.
22 This act shall take effect in 60 days.
B19L18JRW/19980H2595B3563 - 7 -