Establishes the crimes of computer intrusion in the third degree, computer intrusion in the second degree, computer intrusion in the first degree, aggravated computer intrusion, use of a minor in the commission of a computer offense, and cyberterrorism, repealing certain sections of law related therewith, and making technical corrections.
STATE OF NEW YORK
________________________________________________________________________
5083
2009-2010 Regular Sessions
IN SENATE
April 27, 2009
___________
Introduced by Sen. LEIBELL -- read twice and ordered printed, and when
printed to be committed to the Committee on Codes
AN ACT to amend the penal law, in relation to establishing definitions
pertaining to offenses involving computers, establishing the crimes of
computer intrusion in the third degree, computer intrusion in the
second degree, computer intrusion in the first degree, aggravated
computer intrusion, use of a minor in the commission of a computer
offense, and cyberterrorism; to amend the criminal procedure law, in
relation to making certain technical corrections thereto; and repeal-
ing certain provisions of such laws relating thereto
The People of the State of New York, represented in Senate and Assem-bly, do enact as follows:
1 Section 1. Sections 156.00, 156.05, 156.10, 156.20, 156.25, 156.26,
2 156.27 and 156.50 of the penal law are REPEALED.
3 § 2. The penal law is amended by adding a new section 156.00 to read
4 as follows:
5 § 156.00 Offenses involving computers; definition of terms.
6 The following definitions are applicable to this chapter except where
7 different meanings are expressly specified:
8 1. "Computer" means a device or group of devices which, by manipu-
9 lation of electronic, magnetic, optical or electrochemical impulses,
10 pursuant to a computer program, can automatically perform arithmetic,
11 logical, storage or retrieval operations with or on computer data, and
12 includes any connected or directly related device, equipment or facility
13 which enables such computer to store, retrieve or communicate to or from
14 a person, another computer or another device the results of computer
15 operations, computer programs or computer data.
16 2. "Computer data" is property and means a representation of informa-
17 tion, knowledge, facts, concepts or instructions which are being proc-
18 essed, or have been processed in a computer and may be in any form,
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[] is old law to be omitted.
LBD11331-01-9
S. 5083 2
1 including magnetic storage media, punched cards, or stored internally in
2 the memory of the computer.
3 3. "Data network" means a computer system that provides communications
4 between one or more computer systems and its input or output devices,
5 including, but not limited to, display terminals that are intercon-
6 nected.
7 4. "Computer software or computer application" means a set of
8 instructions or statements and related data which, when executed in
9 actual or modified form, cause a computer, computer system, or data
10 network to perform specified functions.
11 5. "Computer operating system" means a computer program that controls
12 internal and external computer software or computer applications, that
13 may be used to execute other computer programs, generate output in the
14 form of visual, print or storage media, or to control peripheral comput-
15 er devices.
16 6. "Computer material" is property and means any computer data or
17 computer program which:
18 (a) contains records of the medical history or medical treatment of an
19 identified or readily identifiable individual or individuals. This term
20 shall not apply to the gaining access to or duplication solely of the
21 medical history or medical treatment records of a person by that person
22 or by another person specifically authorized by the person whose records
23 are gained access to or duplicated; or
24 (b) contains records maintained by the state or any political subdivi-
25 sion thereof or any governmental instrumentality within the state which
26 contains any information concerning a person which because of name,
27 number, symbol, mark or other identifier, can be used to identify the
28 person and which is otherwise prohibited by law from being disclosed.
29 This term shall not apply to the gaining access to or duplication solely
30 of records of a person by that person or by another person specifically
31 authorized by the person whose records are gained access to or dupli-
32 cated; or
33 (c) contains the financial information of a person. This term shall
34 not apply to the gaining access to or duplication solely of records of a
35 person by that person or by another person specifically authorized by
36 the person whose records are gained access to or duplicated; or
37 (d) is not and is not intended to be available to anyone other than
38 the person or persons rightfully in possession thereof or selected
39 persons having access thereto with his, her or their consent and which
40 accords or may accord such rightful possessors an advantage over compet-
41 itors or other persons who do not have knowledge or the benefit thereof.
42 7. "Computer exploit" means a computer program or set of computer
43 instructions designed to modify, damage, destroy, record or transmit
44 information within a computer, computer system or data network without
45 the intent or permission of the owner of the information or of the
46 computer, computer system or data network. This includes, but is not
47 limited to, intrusions known as malicious codes, viruses or worms which
48 may be self-replicating or self-propagating and which are designed to
49 contaminate other computers, computer applications, computer systems or
50 computer data networks; consume computer resources; modify, destroy,
51 record, or transmit data; or in some other fashion usurp the normal
52 operation of the computer, computer application, computer system, or
53 data network.
54 8. "Computer system" means a group of one or more computers linked
55 together with the ability to share information and resources.
S. 5083 3
1 9. "Computer program" is property and means an ordered set of data
2 representing coded instructions or statements that, when executed by a
3 computer, causes the computer to process data or direct the computer to
4 perform one or more computer operations or both and may be in any form.
5 10. "Computer service" means any and all services provided by or
6 through the facilities of any computer, data network, application or
7 operating system allowing the input, output, examination, or transfer,
8 of computer data or computer program from one computer to another.
9 11. "Peripheral computer device" means a device directly connected to
10 a computer or indirectly through a data network.
11 12. "Patch" means a software or application update distributed by the
12 computer software maker designed to fix a vulnerability in computer
13 software or computer application.
14 § 3. The penal law is amended by adding a new section 156.05 to read
15 as follows:
16 § 156.05 Computer intrusion in the third degree.
17 A person is guilty of computer intrusion in the third degree when he
18 or she directly or indirectly:
19 1. willfully, knowingly and without authorization modifies, destroys,
20 accesses or discloses applications or supporting documentation residing
21 or existing internally or externally to a computer or computer system or
22 data network; or
23 2. willfully, knowingly and without authorization installs a computer
24 application or software; or
25 3. willfully, knowingly and without authorization, directly or indi-
26 rectly, uses a computer, computer operating system, data network or
27 peripheral computer device connected through a data network; or
28 4. willfully and knowingly commits a denial of service attack. For
29 the purposes of this section, "denial of service attack" means prevent-
30 ing authorized access to computer resources or delaying time critical
31 computer operations by inundating or otherwise overloading a data
32 network, or attempting to inundate or otherwise overload a computer
33 service.
34 Computer intrusion in the third degree is a class A misdemeanor.
35 § 4. The penal law is amended by adding a new section 156.10 to read
36 as follows:
37 § 156.10 Computer intrusion in the second degree.
38 A person is guilty of computer intrusion in the second degree when he
39 or she commits computer intrusion in the third degree and:
40 1. he or she has previously been convicted of any crime under this
41 article; or
42 2. he or she intentionally and without authorization alters in any
43 manner or destroys computer material, as defined in section 156.00 of
44 this article; or
45 3. he or she does so with the intent to commit or further the commis-
46 sion of any felony; or
47 4. he or she causes damages as a result of the computer intrusion in
48 an aggregate amount exceeding twenty-five hundred dollars.
49 Computer intrusion in the second degree is a class E felony.
50 § 5. The penal law is amended by adding a new section 156.20 to read
51 as follows:
52 § 156.20 Computer intrusion in the first degree.
53 A person is guilty of computer intrusion in the first degree when he
54 or she commits the crime of computer intrusion in the third degree so as
55 to cause damages as a result of the computer intrusion in an aggregate
56 amount exceeding ten thousand dollars.
S. 5083 4
1 Computer intrusion in the first degree is a class D felony.
2 § 6. The penal law is amended by adding a new section 156.25 to read
3 as follows:
4 § 156.25 Aggravated computer intrusion.
5 A person is guilty of aggravated computer intrusion when he or she
6 commits the crime of computer intrusion in the third degree and in
7 furtherance of such crime he or she:
8 1. encrypts a computer exploit or deleterious set of instructions in
9 an image or computer file; or
10 2. develops a computer exploit that modifies the computer, computer
11 system, or computer operating system so that a computer user is unable
12 to repair the modification; or
13 3. develops a computer exploit that uses a patch developed by a soft-
14 ware company to target a computer, computer system, computer program,
15 data network, computer service or computer operating system to target
16 and exploit a vulnerability in the computer operating system or computer
17 program.
18 Aggravated computer intrusion is a class E felony.
19 § 7. The penal law is amended by adding a new section 156.40 to read
20 as follows:
21 § 156.40 Use of a minor in the commission of a computer offense.
22 A person is guilty of use of a minor in the commission of a computer
23 offense when, being eighteen years of age or older, he or she uses a
24 child under the age of eighteen to effectuate the commission of any
25 computer offense under this article by:
26 1. influencing or coercing the child to commit the computer offense;
27 or
28 2. intentionally or willfully supplies the child with the information
29 necessary to commit the computer offense with the knowledge that the
30 child intends to commit a computer offense.
31 Use of a minor in the commission of a computer offense is a class E
32 felony.
33 § 8. The penal law is amended by adding a new section 156.50 to read
34 as follows:
35 § 156.50 Offenses involving computers; defenses.
36 Under sections 156.05, 156.10, 156.20, 156.25, and 156.40 of this
37 article it shall be a defense that the defendant was authorized to use
38 the computer pursuant to a service agreement and where such use origi-
39 nated from a service location within the United States or Canada.
40 § 9. Section 490.05 of the penal law is amended by adding a new subdi-
41 vision 18 to read as follows:
42 18. "Act of cyberterrorism" means the use of computing resources
43 including but not limited to computers, computer systems, data networks,
44 computer software, computer applications and computer operating systems
45 as such terms are defined in section 156.00 of this chapter, against
46 persons or property to intimidate or coerce a government, the popu-
47 lation, or any segment thereof, in furtherance of political or social
48 objectives.
49 § 10. The penal law is amended by adding a new section 490.28 to read
50 as follows:
51 § 490.28 Cyberterrorism.
52 A person is guilty of cyberterrorism when, with the intent to intim-
53 idate a civilian population, influence the policy of a unit of govern-
54 ment by intimidation or coercion, or affect the conduct of a unit of
55 government, he or she commits any of the crimes contained within article
56 one hundred fifty-six of this chapter directed against any computer,
S. 5083 5
1 computer system or data network owned or operated by a local, state or
2 federal government entity, any utility including but not limited to, any
3 electric or water utility, or a financial institution.
4 Cyberterrorism is a class B felony.
5 § 11. Paragraphs (j) and (k) of subdivision 1 of section 240.20 of the
6 criminal procedure law, paragraph (j) as added by chapter 514 of the
7 laws of 1986 and paragraph (k) as added by chapter 536 of the laws of
8 1989, are amended to read as follows:
9 (j) In [any prosecution under penal law section 156.05 or 156.10, the
10 time, place and manner of notice given pursuant to subdivision six of
11 section 156.00 of such law.
12 (k) in] any prosecution commenced in a manner set forth in this subdi-
13 vision alleging a violation of the vehicle and traffic law, in addition
14 to any material required to be disclosed pursuant to this article, any
15 other provision of law, or the constitution of this state or of the
16 United States, any written report or document, or portion thereof,
17 concerning a physical examination, a scientific test or experiment,
18 including the most recent record of inspection, or calibration or repair
19 of machines or instruments utilized to perform such scientific tests or
20 experiments and the certification certificate, if any, held by the oper-
21 ator of the machine or instrument, which tests or examinations were made
22 by or at the request or direction of a public servant engaged in law
23 enforcement activity or which was made by a person whom the prosecutor
24 intends to call as a witness at trial, or which the people intend to
25 introduce at trial.
26 § 12. Section 250.30 of the criminal procedure law is REPEALED.
27 § 13. This act shall take effect on the first of November next
28 succeeding the date on which it shall have become a law.
