H. B. 3246
(By Delegate Canterbury)
[Introduced March 25, 2005; referred to the
Committee on the Judiciary.]
A BILL to amend and reenact §61-3C-3, §61-3C-4, §61-3C-7, §61-3C-8
and §61-3C-12
of the Code of West Virginia, 1931, as amended;
and to amend said code by adding thereto a new section,
designated §61-3C-22
, all relating to adding language
regarding spyware to the West Virginia Computer Crime and
Abuse Act; defining spyware; and requiring that persons or
entities providing computer software which contains spyware to
disclose certain information about the spyware and imposing
criminal penalties for failure to disclose.
Be it enacted by the Legislature of West Virginia:
That §61-3C-3, §61-3C-4, §61-3C-7, §61-3C-8 and §61-3C-12
of
the Code of West Virginia, 1931, as amended, be amended and
reenacted; and that said code be amended by adding thereto a new
section, designated §61-3C-22
, all to read as follows:
ARTICLE 3C. WEST VIRGINIA COMPUTER CRIME AND ABUSE ACT.
§61-3C-3. Definitions.
As used in this article, unless the context clearly indicates
otherwise:
(a) "Access" means to instruct, communicate with, store data
in, retrieve data from, intercept data from or otherwise make use
of any computer, computer network, computer program, computer
software, computer data or other computer resources.
(b) "Authorization" means the express or implied consent given
by a person to another to access or use said person's computer,
computer network, computer program, computer software, computer
system, password, identifying code or personal identification
number.
(c) "Computer" means an electronic, magnetic, optical,
electrochemical or other high speed data processing device
performing logical, arithmetic or storage functions and includes
any data storage facility or communication facility directly
related to or operating in conjunction with such device. The term
"computer" includes any connected or directly related device,
equipment or facility which enables the computer to store, retrieve
or communicate computer programs, computer data or the results of
computer operations to or from a person, another computer or
another device, but such term does not include an automated
typewriter or typesetter, a portable hand-held calculator or other
similar device.
(d) "Computer contaminant" means any set of computer
instructions that are designed to damage or destroy information
within a computer, computer system or computer network without the
consent or permission of the owner of the information. They
include, but are not limited to, a group of computer instructions
commonly called viruses or worms that are self-replicating or
self-propagating and are designed to contaminate other computer
programs or computer data, consume computer resources or damage or
destroy the normal operation of the computer.
(e) "Computer data" means any representation of knowledge,
facts, concepts, instruction or other information computed,
classified, processed, transmitted, received, retrieved,
originated, stored, manifested, measured, detected, recorded,
reproduced, handled or utilized by a computer, computer network,
computer program or computer software and may be in any medium,
including, but not limited to, computer print-outs, microfilm,
microfiche, magnetic storage media, optical storage media, punch
paper tape or punch cards, or it may be stored internally in
read-only memory or random access memory of a computer or any other
peripheral device.
(f) "Computer network" means a set of connected devices and
communication facilities, including more than one computer, with
the capability to transmit computer data among them through such
communication facilities.
(g) "Computer operations" means arithmetic, logical, storage,
display, monitoring or retrieval functions or any combination
thereof and includes, but is not limited to, communication with,
storage of data in or to, or retrieval of data from any device and
the human manual manipulation of electronic magnetic impulses. A
"computer operation" for a particular computer shall also mean any
function for which that computer was designed.
(h) "Computer program" means an ordered set of computer data
representing instructions or statements, in a form readable by a
computer, which controls, directs or otherwise influences the
functioning of a computer or computer network.
(i) "Computer software" means a set of computer programs,
procedures and associated documentation concerned with computer
data or with the operation of a computer, computer program or
computer network.
(j) "Computer services" means computer access time, computer
data processing or computer data storage and the computer data
processed or stored in connection therewith.
(k) "Computer supplies" means punch cards, paper tape,
magnetic tape, magnetic disks or diskettes, optical disks or
diskettes, disk or diskette packs, paper, microfilm and any other
tangible input, output or storage medium used in connection with a
computer, computer network, computer data, computer software or
computer program.
(l) "Computer resources" includes, but is not limited to,
information retrieval; computer data processing, transmission and
storage; and any other functions performed, in whole or in part, by
the use of a computer, computer network, computer software or
computer program.
(m) "Owner" means any person who owns or leases or is a
licensee of a computer, computer network, computer data, computer
program, computer software, computer resources or computer
supplies.
(n) "Person" means any natural person, general partnership,
limited partnership, trust, association, corporation, joint venture
or any state, county or municipal government and any subdivision,
branch, department or agency thereof.
(o) "Property" includes:
(1) Real property;
(2) Computers and computer networks;
(3) Financial instruments, computer data, computer programs,
computer software and all other personal property regardless of
whether they are:
(i) Tangible or intangible;
(ii) In a format readable by humans or by a computer;
(iii) In transit between computers or within a computer
network or between any devices which comprise a computer; or
(iv) Located on any paper or in any device on which it is stored by a computer or by a human; and
(4) Computer services.
(p) "Value" means having any potential to provide any direct
or indirect gain or advantage to any person.
(q) "Financial instrument" includes, but is not limited to,
any check, draft, warrant, money order, note, certificate of
deposit, letter of credit, bill of exchange, credit or debit card,
transaction authorization mechanism, marketable security or any
computerized representation thereof.
(r) "Value of property or computer services" shall be: (1)
The market value of the property or computer services at the time
of a violation of this article; or (2) if the property or computer
services are unrecoverable, damaged or destroyed as a result of a
violation of section six or seven of this article, the cost of
reproducing or replacing the property or computer services at the
time of the violation.
(s) "Spyware" means an executable program that automatically,
and without the control of a computer user, gathers and transmits
to the provider of the program or to a third party either of the
following types of information:
(1) Personal information or data of a user;
(2) Data regarding computer usage, including, but not limited
to, which Internet sites are or have been visited by a user.
§61-3C-4. Computer fraud; access to Legislature computer; criminal penalties.
(a) Any person who, knowingly and willfully, directly or
indirectly, accesses, or causes to be accessed or causes spyware to
be installed on any computer, computer services or computer network
for the purpose of (1) executing any scheme or artifice to defraud
or (2) obtaining money, property or services by means of fraudulent
pretenses, representations or promises is guilty of a felony, and,
upon conviction thereof, shall be fined not more than ten thousand
dollars or imprisoned in the penitentiary a correctional facility
for not more than ten years, or both fined and imprisoned.
(b)(1) Any person who, knowingly and willfully, directly or
indirectly, accesses, attempts to access, or causes to be accessed,
or causes spyware to be installed on any computer which accesses
any data stored in a computer owned by the Legislature without
authorization is guilty of a felony, and, upon conviction thereof,
shall be fined not more than five thousand dollars or imprisoned in
the penitentiary a correctional facility for not more than five
years, or both fined and imprisoned.
(2) Notwithstanding the provisions of section seventeen of
this article to the contrary, in any criminal prosecution under
this subsection against an employee or member of the Legislature,
it shall not be a defense (A) that the defendant had reasonable
grounds to believe that he or she had authorization to access the
data merely because of his or her employment or membership, or (B) that the defendant could not have reasonably known he or she did
not have authorization to access the data: Provided, That the
joint committee on government and finance shall promulgate rules
for the respective houses of the Legislature regarding appropriate
access of members and staff and others to the legislative computer
system.
§61-3C-7. Alteration, destruction, etc., of computer equipment.
(a) Misdemeanor offenses. -- Any person who knowingly,
willfully and without authorization, directly or indirectly,
tampers with, deletes, alters, damages or destroys or attempts to
tamper with, delete, alter, damage or destroy or causes spyware to
be installed which tampers with, deletes, alters, damages or
destroys any computer, computer network, computer software,
computer resources, computer program or computer data or who
knowingly introduces, directly or indirectly, a computer
contaminant into any computer, computer program or computer network
which results in a loss of value of property or computer services
up to one thousand dollars, is guilty of a misdemeanor and, upon
conviction thereof, shall be fined not more than one thousand
dollars or confined in the county or regional jail not more than
six months, or both.
(b) Felony offenses. -- Any person who knowingly, willfully
and without authorization, directly or indirectly, damages or
destroys or attempts to damage or destroy or causes spyware to be installed which tampers with, deletes, alters, damages or destroys
any computer, computer network, computer software, computer
resources, computer program or computer data by knowingly
introducing, directly or indirectly, a computer contaminant into
any computer, computer program or computer network which results in
a loss of value of property or computer services more than one
thousand dollars is guilty of a felony and, upon conviction
thereof, shall be fined not less than two hundred dollars and not
more than ten thousand dollars or confined in a state correctional
facility not more than ten years, or both, or, in the discretion of
the court, be fined not less than two hundred nor more than one
thousand dollars and confined in the county or regional jail not
more than one year.
§61-3C-8. Disruption of computer services.
Any person who knowingly, willfully and without authorization,
directly or indirectly, or causes spyware to be installed which
disrupts or degrades or causes the disruption or degradation of
computer services or denies or causes the denial of computer
services to an authorized recipient or user of such computer
services, shall be guilty of a misdemeanor, and, upon conviction
thereof, shall be fined not less than two hundred nor more than one
thousand dollars or confined in the county jail not more than one
year, or both.
§61-3C-12. Computer invasion of privacy.
Any person who knowingly, willfully and without authorization
accesses a computer or computer network and examines any
employment, salary, credit or any other financial or personal
information relating to any other person, after the time at which
the offender knows or reasonably should know, that he or she is
without authorization to view the information displayed, or causes
spyware to be installed which collects such information, including
information regarding which websites a person visits, shall be
guilty of a misdemeanor, and, upon conviction thereof, shall be
fined not more than five hundred dollars or confined in the county
jail for not more than six months, or both.
§61-3C-22. Mandatory disclosure of spyware.
(a) A person or entity that provides computer software
containing spyware to a computer in this state shall disclose the
following information to the recipient of the software:
(1) That the software contains spyware.
(2) What the spyware does.
(b) The statement required by subsection (a) shall be in at
least eighteen-point type and shall be included in the first
appearing of the following:
(1) The software's opening download;
(2) The website of the provider of the software;
(3) The initial installation screen for the software.
(c) Any person or entity which violates this section is guilty of a misdemeanor and, upon conviction thereof, shall be fined not
more than five hundred dollars or confined in jail for not more
than six months, or both fined and confined.
NOTE: The purpose of this bill is to add language regarding
spyware to the West Virginia Computer Crime and Abuse Act; defining
spyware; and requiring that persons or entities providing software
which contains spyware to disclose information about the spyware
and imposing criminal penalties for failure to disclose.
Strike-throughs indicate language that would be stricken from
the present law, and underscoring indicates new language that would
be added.
§61-3C-22 is new; therefore, strike-throughs and underscoring
have been omitted.