S T A T E O F N E W Y O R K
________________________________________________________________________
5083
2009-2010 Regular Sessions
I N S E N A T E
April 27, 2009
___________
Introduced by Sen. LEIBELL -- read twice and ordered printed, and when
printed to be committed to the Committee on Codes
AN ACT to amend the penal law, in relation to establishing definitions
pertaining to offenses involving computers, establishing the crimes of
computer intrusion in the third degree, computer intrusion in the
second degree, computer intrusion in the first degree, aggravated
computer intrusion, use of a minor in the commission of a computer
offense, and cyberterrorism; to amend the criminal procedure law, in
relation to making certain technical corrections thereto; and repeal-
ing certain provisions of such laws relating thereto
THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
BLY, DO ENACT AS FOLLOWS:
Section 1. Sections 156.00, 156.05, 156.10, 156.20, 156.25, 156.26,
156.27 and 156.50 of the penal law are REPEALED.
S 2. The penal law is amended by adding a new section 156.00 to read
as follows:
S 156.00 OFFENSES INVOLVING COMPUTERS; DEFINITION OF TERMS.
THE FOLLOWING DEFINITIONS ARE APPLICABLE TO THIS CHAPTER EXCEPT WHERE
DIFFERENT MEANINGS ARE EXPRESSLY SPECIFIED:
1. "COMPUTER" MEANS A DEVICE OR GROUP OF DEVICES WHICH, BY MANIPU-
LATION OF ELECTRONIC, MAGNETIC, OPTICAL OR ELECTROCHEMICAL IMPULSES,
PURSUANT TO A COMPUTER PROGRAM, CAN AUTOMATICALLY PERFORM ARITHMETIC,
LOGICAL, STORAGE OR RETRIEVAL OPERATIONS WITH OR ON COMPUTER DATA, AND
INCLUDES ANY CONNECTED OR DIRECTLY RELATED DEVICE, EQUIPMENT OR FACILITY
WHICH ENABLES SUCH COMPUTER TO STORE, RETRIEVE OR COMMUNICATE TO OR FROM
A PERSON, ANOTHER COMPUTER OR ANOTHER DEVICE THE RESULTS OF COMPUTER
OPERATIONS, COMPUTER PROGRAMS OR COMPUTER DATA.
2. "COMPUTER DATA" IS PROPERTY AND MEANS A REPRESENTATION OF INFORMA-
TION, KNOWLEDGE, FACTS, CONCEPTS OR INSTRUCTIONS WHICH ARE BEING PROC-
ESSED, OR HAVE BEEN PROCESSED IN A COMPUTER AND MAY BE IN ANY FORM,
EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD11331-01-9
S. 5083 2
INCLUDING MAGNETIC STORAGE MEDIA, PUNCHED CARDS, OR STORED INTERNALLY IN
THE MEMORY OF THE COMPUTER.
3. "DATA NETWORK" MEANS A COMPUTER SYSTEM THAT PROVIDES COMMUNICATIONS
BETWEEN ONE OR MORE COMPUTER SYSTEMS AND ITS INPUT OR OUTPUT DEVICES,
INCLUDING, BUT NOT LIMITED TO, DISPLAY TERMINALS THAT ARE INTERCON-
NECTED.
4. "COMPUTER SOFTWARE OR COMPUTER APPLICATION" MEANS A SET OF
INSTRUCTIONS OR STATEMENTS AND RELATED DATA WHICH, WHEN EXECUTED IN
ACTUAL OR MODIFIED FORM, CAUSE A COMPUTER, COMPUTER SYSTEM, OR DATA
NETWORK TO PERFORM SPECIFIED FUNCTIONS.
5. "COMPUTER OPERATING SYSTEM" MEANS A COMPUTER PROGRAM THAT CONTROLS
INTERNAL AND EXTERNAL COMPUTER SOFTWARE OR COMPUTER APPLICATIONS, THAT
MAY BE USED TO EXECUTE OTHER COMPUTER PROGRAMS, GENERATE OUTPUT IN THE
FORM OF VISUAL, PRINT OR STORAGE MEDIA, OR TO CONTROL PERIPHERAL COMPUT-
ER DEVICES.
6. "COMPUTER MATERIAL" IS PROPERTY AND MEANS ANY COMPUTER DATA OR
COMPUTER PROGRAM WHICH:
(A) CONTAINS RECORDS OF THE MEDICAL HISTORY OR MEDICAL TREATMENT OF AN
IDENTIFIED OR READILY IDENTIFIABLE INDIVIDUAL OR INDIVIDUALS. THIS TERM
SHALL NOT APPLY TO THE GAINING ACCESS TO OR DUPLICATION SOLELY OF THE
MEDICAL HISTORY OR MEDICAL TREATMENT RECORDS OF A PERSON BY THAT PERSON
OR BY ANOTHER PERSON SPECIFICALLY AUTHORIZED BY THE PERSON WHOSE RECORDS
ARE GAINED ACCESS TO OR DUPLICATED; OR
(B) CONTAINS RECORDS MAINTAINED BY THE STATE OR ANY POLITICAL SUBDIVI-
SION THEREOF OR ANY GOVERNMENTAL INSTRUMENTALITY WITHIN THE STATE WHICH
CONTAINS ANY INFORMATION CONCERNING A PERSON WHICH BECAUSE OF NAME,
NUMBER, SYMBOL, MARK OR OTHER IDENTIFIER, CAN BE USED TO IDENTIFY THE
PERSON AND WHICH IS OTHERWISE PROHIBITED BY LAW FROM BEING DISCLOSED.
THIS TERM SHALL NOT APPLY TO THE GAINING ACCESS TO OR DUPLICATION SOLELY
OF RECORDS OF A PERSON BY THAT PERSON OR BY ANOTHER PERSON SPECIFICALLY
AUTHORIZED BY THE PERSON WHOSE RECORDS ARE GAINED ACCESS TO OR DUPLI-
CATED; OR
(C) CONTAINS THE FINANCIAL INFORMATION OF A PERSON. THIS TERM SHALL
NOT APPLY TO THE GAINING ACCESS TO OR DUPLICATION SOLELY OF RECORDS OF A
PERSON BY THAT PERSON OR BY ANOTHER PERSON SPECIFICALLY AUTHORIZED BY
THE PERSON WHOSE RECORDS ARE GAINED ACCESS TO OR DUPLICATED; OR
(D) IS NOT AND IS NOT INTENDED TO BE AVAILABLE TO ANYONE OTHER THAN
THE PERSON OR PERSONS RIGHTFULLY IN POSSESSION THEREOF OR SELECTED
PERSONS HAVING ACCESS THERETO WITH HIS, HER OR THEIR CONSENT AND WHICH
ACCORDS OR MAY ACCORD SUCH RIGHTFUL POSSESSORS AN ADVANTAGE OVER COMPET-
ITORS OR OTHER PERSONS WHO DO NOT HAVE KNOWLEDGE OR THE BENEFIT THEREOF.
7. "COMPUTER EXPLOIT" MEANS A COMPUTER PROGRAM OR SET OF COMPUTER
INSTRUCTIONS DESIGNED TO MODIFY, DAMAGE, DESTROY, RECORD OR TRANSMIT
INFORMATION WITHIN A COMPUTER, COMPUTER SYSTEM OR DATA NETWORK WITHOUT
THE INTENT OR PERMISSION OF THE OWNER OF THE INFORMATION OR OF THE
COMPUTER, COMPUTER SYSTEM OR DATA NETWORK. THIS INCLUDES, BUT IS NOT
LIMITED TO, INTRUSIONS KNOWN AS MALICIOUS CODES, VIRUSES OR WORMS WHICH
MAY BE SELF-REPLICATING OR SELF-PROPAGATING AND WHICH ARE DESIGNED TO
CONTAMINATE OTHER COMPUTERS, COMPUTER APPLICATIONS, COMPUTER SYSTEMS OR
COMPUTER DATA NETWORKS; CONSUME COMPUTER RESOURCES; MODIFY, DESTROY,
RECORD, OR TRANSMIT DATA; OR IN SOME OTHER FASHION USURP THE NORMAL
OPERATION OF THE COMPUTER, COMPUTER APPLICATION, COMPUTER SYSTEM, OR
DATA NETWORK.
8. "COMPUTER SYSTEM" MEANS A GROUP OF ONE OR MORE COMPUTERS LINKED
TOGETHER WITH THE ABILITY TO SHARE INFORMATION AND RESOURCES.
S. 5083 3
9. "COMPUTER PROGRAM" IS PROPERTY AND MEANS AN ORDERED SET OF DATA
REPRESENTING CODED INSTRUCTIONS OR STATEMENTS THAT, WHEN EXECUTED BY A
COMPUTER, CAUSES THE COMPUTER TO PROCESS DATA OR DIRECT THE COMPUTER TO
PERFORM ONE OR MORE COMPUTER OPERATIONS OR BOTH AND MAY BE IN ANY FORM.
10. "COMPUTER SERVICE" MEANS ANY AND ALL SERVICES PROVIDED BY OR
THROUGH THE FACILITIES OF ANY COMPUTER, DATA NETWORK, APPLICATION OR
OPERATING SYSTEM ALLOWING THE INPUT, OUTPUT, EXAMINATION, OR TRANSFER,
OF COMPUTER DATA OR COMPUTER PROGRAM FROM ONE COMPUTER TO ANOTHER.
11. "PERIPHERAL COMPUTER DEVICE" MEANS A DEVICE DIRECTLY CONNECTED TO
A COMPUTER OR INDIRECTLY THROUGH A DATA NETWORK.
12. "PATCH" MEANS A SOFTWARE OR APPLICATION UPDATE DISTRIBUTED BY THE
COMPUTER SOFTWARE MAKER DESIGNED TO FIX A VULNERABILITY IN COMPUTER
SOFTWARE OR COMPUTER APPLICATION.
S 3. The penal law is amended by adding a new section 156.05 to read
as follows:
S 156.05 COMPUTER INTRUSION IN THE THIRD DEGREE.
A PERSON IS GUILTY OF COMPUTER INTRUSION IN THE THIRD DEGREE WHEN HE
OR SHE DIRECTLY OR INDIRECTLY:
1. WILLFULLY, KNOWINGLY AND WITHOUT AUTHORIZATION MODIFIES, DESTROYS,
ACCESSES OR DISCLOSES APPLICATIONS OR SUPPORTING DOCUMENTATION RESIDING
OR EXISTING INTERNALLY OR EXTERNALLY TO A COMPUTER OR COMPUTER SYSTEM OR
DATA NETWORK; OR
2. WILLFULLY, KNOWINGLY AND WITHOUT AUTHORIZATION INSTALLS A COMPUTER
APPLICATION OR SOFTWARE; OR
3. WILLFULLY, KNOWINGLY AND WITHOUT AUTHORIZATION, DIRECTLY OR INDI-
RECTLY, USES A COMPUTER, COMPUTER OPERATING SYSTEM, DATA NETWORK OR
PERIPHERAL COMPUTER DEVICE CONNECTED THROUGH A DATA NETWORK; OR
4. WILLFULLY AND KNOWINGLY COMMITS A DENIAL OF SERVICE ATTACK. FOR
THE PURPOSES OF THIS SECTION, "DENIAL OF SERVICE ATTACK" MEANS PREVENT-
ING AUTHORIZED ACCESS TO COMPUTER RESOURCES OR DELAYING TIME CRITICAL
COMPUTER OPERATIONS BY INUNDATING OR OTHERWISE OVERLOADING A DATA
NETWORK, OR ATTEMPTING TO INUNDATE OR OTHERWISE OVERLOAD A COMPUTER
SERVICE.
COMPUTER INTRUSION IN THE THIRD DEGREE IS A CLASS A MISDEMEANOR.
S 4. The penal law is amended by adding a new section 156.10 to read
as follows:
S 156.10 COMPUTER INTRUSION IN THE SECOND DEGREE.
A PERSON IS GUILTY OF COMPUTER INTRUSION IN THE SECOND DEGREE WHEN HE
OR SHE COMMITS COMPUTER INTRUSION IN THE THIRD DEGREE AND:
1. HE OR SHE HAS PREVIOUSLY BEEN CONVICTED OF ANY CRIME UNDER THIS
ARTICLE; OR
2. HE OR SHE INTENTIONALLY AND WITHOUT AUTHORIZATION ALTERS IN ANY
MANNER OR DESTROYS COMPUTER MATERIAL, AS DEFINED IN SECTION 156.00 OF
THIS ARTICLE; OR
3. HE OR SHE DOES SO WITH THE INTENT TO COMMIT OR FURTHER THE COMMIS-
SION OF ANY FELONY; OR
4. HE OR SHE CAUSES DAMAGES AS A RESULT OF THE COMPUTER INTRUSION IN
AN AGGREGATE AMOUNT EXCEEDING TWENTY-FIVE HUNDRED DOLLARS.
COMPUTER INTRUSION IN THE SECOND DEGREE IS A CLASS E FELONY.
S 5. The penal law is amended by adding a new section 156.20 to read
as follows:
S 156.20 COMPUTER INTRUSION IN THE FIRST DEGREE.
A PERSON IS GUILTY OF COMPUTER INTRUSION IN THE FIRST DEGREE WHEN HE
OR SHE COMMITS THE CRIME OF COMPUTER INTRUSION IN THE THIRD DEGREE SO AS
TO CAUSE DAMAGES AS A RESULT OF THE COMPUTER INTRUSION IN AN AGGREGATE
AMOUNT EXCEEDING TEN THOUSAND DOLLARS.
S. 5083 4
COMPUTER INTRUSION IN THE FIRST DEGREE IS A CLASS D FELONY.
S 6. The penal law is amended by adding a new section 156.25 to read
as follows:
S 156.25 AGGRAVATED COMPUTER INTRUSION.
A PERSON IS GUILTY OF AGGRAVATED COMPUTER INTRUSION WHEN HE OR SHE
COMMITS THE CRIME OF COMPUTER INTRUSION IN THE THIRD DEGREE AND IN
FURTHERANCE OF SUCH CRIME HE OR SHE:
1. ENCRYPTS A COMPUTER EXPLOIT OR DELETERIOUS SET OF INSTRUCTIONS IN
AN IMAGE OR COMPUTER FILE; OR
2. DEVELOPS A COMPUTER EXPLOIT THAT MODIFIES THE COMPUTER, COMPUTER
SYSTEM, OR COMPUTER OPERATING SYSTEM SO THAT A COMPUTER USER IS UNABLE
TO REPAIR THE MODIFICATION; OR
3. DEVELOPS A COMPUTER EXPLOIT THAT USES A PATCH DEVELOPED BY A SOFT-
WARE COMPANY TO TARGET A COMPUTER, COMPUTER SYSTEM, COMPUTER PROGRAM,
DATA NETWORK, COMPUTER SERVICE OR COMPUTER OPERATING SYSTEM TO TARGET
AND EXPLOIT A VULNERABILITY IN THE COMPUTER OPERATING SYSTEM OR COMPUTER
PROGRAM.
AGGRAVATED COMPUTER INTRUSION IS A CLASS E FELONY.
S 7. The penal law is amended by adding a new section 156.40 to read
as follows:
S 156.40 USE OF A MINOR IN THE COMMISSION OF A COMPUTER OFFENSE.
A PERSON IS GUILTY OF USE OF A MINOR IN THE COMMISSION OF A COMPUTER
OFFENSE WHEN, BEING EIGHTEEN YEARS OF AGE OR OLDER, HE OR SHE USES A
CHILD UNDER THE AGE OF EIGHTEEN TO EFFECTUATE THE COMMISSION OF ANY
COMPUTER OFFENSE UNDER THIS ARTICLE BY:
1. INFLUENCING OR COERCING THE CHILD TO COMMIT THE COMPUTER OFFENSE;
OR
2. INTENTIONALLY OR WILLFULLY SUPPLIES THE CHILD WITH THE INFORMATION
NECESSARY TO COMMIT THE COMPUTER OFFENSE WITH THE KNOWLEDGE THAT THE
CHILD INTENDS TO COMMIT A COMPUTER OFFENSE.
USE OF A MINOR IN THE COMMISSION OF A COMPUTER OFFENSE IS A CLASS E
FELONY.
S 8. The penal law is amended by adding a new section 156.50 to read
as follows:
S 156.50 OFFENSES INVOLVING COMPUTERS; DEFENSES.
UNDER SECTIONS 156.05, 156.10, 156.20, 156.25, AND 156.40 OF THIS
ARTICLE IT SHALL BE A DEFENSE THAT THE DEFENDANT WAS AUTHORIZED TO USE
THE COMPUTER PURSUANT TO A SERVICE AGREEMENT AND WHERE SUCH USE ORIGI-
NATED FROM A SERVICE LOCATION WITHIN THE UNITED STATES OR CANADA.
S 9. Section 490.05 of the penal law is amended by adding a new subdi-
vision 18 to read as follows:
18. "ACT OF CYBERTERRORISM" MEANS THE USE OF COMPUTING RESOURCES
INCLUDING BUT NOT LIMITED TO COMPUTERS, COMPUTER SYSTEMS, DATA NETWORKS,
COMPUTER SOFTWARE, COMPUTER APPLICATIONS AND COMPUTER OPERATING SYSTEMS
AS SUCH TERMS ARE DEFINED IN SECTION 156.00 OF THIS CHAPTER, AGAINST
PERSONS OR PROPERTY TO INTIMIDATE OR COERCE A GOVERNMENT, THE POPU-
LATION, OR ANY SEGMENT THEREOF, IN FURTHERANCE OF POLITICAL OR SOCIAL
OBJECTIVES.
S 10. The penal law is amended by adding a new section 490.28 to read
as follows:
S 490.28 CYBERTERRORISM.
A PERSON IS GUILTY OF CYBERTERRORISM WHEN, WITH THE INTENT TO INTIM-
IDATE A CIVILIAN POPULATION, INFLUENCE THE POLICY OF A UNIT OF GOVERN-
MENT BY INTIMIDATION OR COERCION, OR AFFECT THE CONDUCT OF A UNIT OF
GOVERNMENT, HE OR SHE COMMITS ANY OF THE CRIMES CONTAINED WITHIN ARTICLE
ONE HUNDRED FIFTY-SIX OF THIS CHAPTER DIRECTED AGAINST ANY COMPUTER,
S. 5083 5
COMPUTER SYSTEM OR DATA NETWORK OWNED OR OPERATED BY A LOCAL, STATE OR
FEDERAL GOVERNMENT ENTITY, ANY UTILITY INCLUDING BUT NOT LIMITED TO, ANY
ELECTRIC OR WATER UTILITY, OR A FINANCIAL INSTITUTION.
CYBERTERRORISM IS A CLASS B FELONY.
S 11. Paragraphs (j) and (k) of subdivision 1 of section 240.20 of the
criminal procedure law, paragraph (j) as added by chapter 514 of the
laws of 1986 and paragraph (k) as added by chapter 536 of the laws of
1989, are amended to read as follows:
(j) In [any prosecution under penal law section 156.05 or 156.10, the
time, place and manner of notice given pursuant to subdivision six of
section 156.00 of such law.
(k) in] any prosecution commenced in a manner set forth in this subdi-
vision alleging a violation of the vehicle and traffic law, in addition
to any material required to be disclosed pursuant to this article, any
other provision of law, or the constitution of this state or of the
United States, any written report or document, or portion thereof,
concerning a physical examination, a scientific test or experiment,
including the most recent record of inspection, or calibration or repair
of machines or instruments utilized to perform such scientific tests or
experiments and the certification certificate, if any, held by the oper-
ator of the machine or instrument, which tests or examinations were made
by or at the request or direction of a public servant engaged in law
enforcement activity or which was made by a person whom the prosecutor
intends to call as a witness at trial, or which the people intend to
introduce at trial.
S 12. Section 250.30 of the criminal procedure law is REPEALED.
S 13. This act shall take effect on the first of November next
succeeding the date on which it shall have become a law.