AB 32: Computer crimes.
- Session Year: 2015-2016
- House: Assembly
- Latest Version Date: 2015-10-08
Existing law establishes various crimes relating to computer services and systems, including to knowingly and without permission disrupt or cause the disruption of computer services including government computer services or public safety infrastructure computer system computer services, add, alter, damage, delete, or destroy any computer data, software, or program, introduce a computer contaminant, use the Internet domain name or profile of another. Existing law makes a violation of these provisions punishable by specified fines or terms of imprisonment, or by both those fines and imprisonment.
This bill would clarify the criminal penalties for specified computer crimes by making a person who violates those provisions guilty of a felony, punishable by imprisonment in a county jail for 16 months, or 2 or 3 years and a fine not exceeding $10,000, or a misdemeanor, punishable by imprisonment in a county jail not exceeding one year, by a fine not exceeding $5,000, or by both that fine and imprisonment.
Existing law establishes various crimes relating to computer services and systems, including to knowingly and without permission disrupt or cause the disruption of computer services including government computer services or public safety infrastructure computer system computer services, add, alter, damage, delete, or destroy any computer data, software, or program, introduce a computer contaminant, use the Internet domain name or profile of another. Existing law makes a violation of these provisions punishable by specified fines or terms of imprisonment, or by both those fines and imprisonment.
This bill would clarify the criminal penalties for specified computer crimes by making a person who violates those provisions guilty of a felony, punishable by imprisonment in a county jail for 16 months, or 2 or 3 years and a fine not exceeding $10,000, or a misdemeanor, punishable by imprisonment in a county jail not exceeding one year, by a fine not exceeding $5,000, or by both that fine and imprisonment.
Existing law establishes various crimes relating to computer services and systems, including to knowingly and without permission disrupt or cause the disruption of computer services including government computer services or public safety infrastructure computer system computer services, add, alter, damage, delete, or destroy any computer data, software, or program, introduce a computer contaminant, use the Internet domain name or profile of another. Existing law makes a violation of these provisions punishable by specified fines or terms of imprisonment, or by both those fines and imprisonment. Existing law establishes the time limitation during which a criminal complaint for a violation of these provisions may be filed.
This bill would increase the fine for a misdemeanor violation of those crimes from a fine not exceeding $5,000 to a fine not exceeding $10,000. The bill would toll, until discovery of the offense, the time for filing a criminal complaint for a violation of those provisions when it is alleged that the defendant acquired, copied, or distributed a digital image of an intimate body part, as defined, of a person. clarify the criminal penalties for specified computer crimes by making a person who violates those provisions guilty of a felony, punishable by imprisonment in a county jail for 16 months, or 2 or 3 years and a fine not exceeding $10,000, or a misdemeanor, punishable by imprisonment in a county jail not exceeding one year, by a fine not exceeding $5,000, or by both that fine and imprisonment.
Existing law establishes various crimes relating to computer services and systems, including to knowingly and without permission disrupt or cause the disruption of computer services including government computer services or public safety infrastructure computer system computer services, add, alter, damage, delete, or destroy any computer data, software, or program, introduce a computer contaminant, use the Internet domain name or profile of another. Existing law makes a violation of these provisions punishable by specified fines or terms of imprisonment, or by both those fines and imprisonment. Existing law establishes the time limitations limitation during which a criminal complaint for a violation of these provisions may be filed.
This bill would make the commission of any of those crimes that involves acquiring, copying, or distributing a digital image of a person that displays an intimate body part, as defined, of the person additionally punishable by a fine not exceeding $10,000 per each digital image acquired, copied, or distributed. The bill would, notwithstanding any of those other time limitations, permit a criminal complaint alleging a violation described in the bill to be filed within one year of the date on which that violation was discovered.
This bill would increase the fine for a misdemeanor violation of those crimes from a fine not exceeding $5,000 to a fine not exceeding $10,000. The bill would toll, until discovery of the offense, the time for filing a criminal complaint for a violation of those provisions when it is alleged that the defendant acquired, copied, or distributed a digital image of an intimate body part, as defined, of a person.
Existing law establishes various crimes relating to computer services and systems, including to knowingly and without permission disrupt or cause the disruption of computer services including government computer services or public safety infrastructure computer system computer services, add, alter, damage, delete, or destroy any computer data, software, or program, introduce a computer contaminant, use the Internet domain name or profile of another. Existing law makes a violation of these provisions punishable by specified fines or terms of imprisonment, or by both those fines and imprisonment. Existing law establishes the time limitations during which a criminal complaint may be filed.
This bill would make the commission of any of those crimes that involves acquiring, copying, or distributing a digital image of a person that displays an intimate body part, as defined, of the person additionally punishable by a fine not exceeding $10,000 per each digital image acquired, copied, or distributed. The bill would, notwithstanding any of those other time limitations, permit a criminal complaint alleging a violation described in the bill to be filed within one year of the date on which that violation was discovered.
(a)It is the intent of the Legislature in enacting this section to expand the degree of protection afforded to individuals, businesses, and governmental agencies from tampering, interference, damage, and unauthorized access to lawfully created computer data and computer systems. The Legislature finds and declares that the proliferation of computer technology has resulted in a concomitant proliferation of computer crime and other forms of unauthorized access to computers, computer systems, and computer data.
The Legislature further finds and declares that protection of the integrity of all types and forms of lawfully created computers, computer systems, and computer data is vital to the protection of the privacy of individuals as well as to the well-being of financial institutions, business concerns, governmental agencies, and others within this state that lawfully utilize those computers, computer systems, and data.
(b)For the purposes of this section, the following terms have the following meanings:
(1)Access means to gain entry to, instruct, cause input to, cause output from, cause data processing with, or communicate with, the logical, arithmetical, or memory function resources of a computer, computer system, or computer network.
(2)Computer network means any system that provides communications between one or more computer systems and input/output devices, including, but not limited to, display terminals, remote systems, mobile devices, and printers connected by telecommunication facilities.
(3)Computer program or software means a set of instructions or statements, and related data, that when executed in actual or modified form, cause a computer, computer system, or computer network to perform specified functions.
(4)Computer services includes, but is not limited to, computer time, data processing, or storage functions, Internet services, electronic mail services, electronic message services, or other uses of a computer, computer system, or computer network.
(5)Computer system means a device or collection of devices, including support devices and excluding calculators that are not programmable and capable of being used in conjunction with external files, one or more of which contain computer programs, electronic instructions, input data, and output data, that performs functions, including, but not limited to, logic, arithmetic, data storage and retrieval, communication, and control.
(6)Government computer system means any computer system, or part thereof, that is owned, operated, or used by any federal, state, or local governmental entity.
(7)Public safety infrastructure computer system means any computer system, or part thereof, that is necessary for the health and safety of the public including computer systems owned, operated, or used by drinking water and wastewater treatment facilities, hospitals, emergency service providers, telecommunication companies, and gas and electric utility companies.
(8)Data means a representation of information, knowledge, facts, concepts, computer software, or computer programs or instructions. Data may be in any form, in storage media, or as stored in the memory of the computer or in transit or presented on a display device.
(9)Supporting documentation includes, but is not limited to, all information, in any form, pertaining to the design, construction, classification, implementation, use, or modification of a computer, computer system, computer network, computer program, or computer software, which information is not generally available to the public and is necessary for the operation of a computer, computer system, computer network, computer program, or computer software.
(10)Injury means any alteration, deletion, damage, or destruction of a computer system, computer network, computer program, or data caused by the access, or the denial of access to legitimate users of a computer system, network, or program.
(11)Victim expenditure means any expenditure reasonably and necessarily incurred by the owner or lessee to verify that a computer system, computer network, computer program, or data was or was not altered, deleted, damaged, or destroyed by the access.
(12)Computer contaminant means any set of computer instructions that are designed to modify, damage, destroy, record, or transmit information within a computer, computer system, or computer network without the intent or permission of the owner of the information. They include, but are not limited to, a group of computer instructions commonly called viruses or worms, that are self-replicating or self-propagating and are designed to contaminate other computer programs or computer data, consume computer resources, modify, destroy, record, or transmit data, or in some other fashion usurp the normal operation of the computer, computer system, or computer network.
(13)Internet domain name means a globally unique, hierarchical reference to an Internet host or service, assigned through centralized Internet naming authorities, comprising a series of character strings separated by periods, with the rightmost character string specifying the top of the hierarchy.
(14)Electronic mail means an electronic message or computer file that is transmitted between two or more telecommunications devices; computers; computer networks, regardless of whether the network is a local, regional, or global network; or electronic devices capable of receiving electronic messages, regardless of whether the message is converted to hard copy format after receipt, viewed upon transmission, or stored for later retrieval.
(15)Profile means either of the following:
(A)A configuration of user data required by a computer so that the user may access programs or services and have the desired functionality on that computer.
(B)An Internet Web site users personal page or section of a page that is made up of data, in text or graphical form, that displays significant, unique, or identifying information, including, but not limited to, listing acquaintances, interests, associations, activities, or personal statements.
(c)Except as provided in subdivision (h), any person who commits any of the following acts is guilty of a public offense:
(1)Knowingly accesses and without permission alters, damages, deletes, destroys, or otherwise uses any data, computer, computer system, or computer network in order to either (A) devise or execute any scheme or artifice to defraud, deceive, or extort, or (B) wrongfully control or obtain money, property, or data.
(2)Knowingly accesses and without permission takes, copies, or makes use of any data from a computer, computer system, or computer network, or takes or copies any supporting documentation, whether existing or residing internal or external to a computer, computer system, or computer network.
(3)Knowingly and without permission uses or causes to be used computer services.
(4)Knowingly accesses and without permission adds, alters, damages, deletes, or destroys any data, computer software, or computer programs which reside or exist internal or external to a computer, computer system, or computer network.
(5)Knowingly and without permission disrupts or causes the disruption of computer services or denies or causes the denial of computer services to an authorized user of a computer, computer system, or computer network.
(6)Knowingly and without permission provides or assists in providing a means of accessing a computer, computer system, or computer network in violation of this section.
(7)Knowingly and without permission accesses or causes to be accessed any computer, computer system, or computer network.
(8)Knowingly introduces any computer contaminant into any computer, computer system, or computer network.
(9)Knowingly and without permission uses the Internet domain name or profile of another individual, corporation, or entity in connection with the sending of one or more electronic mail messages or posts and thereby damages or causes damage to a computer, computer data, computer system, or computer network.
(10)Knowingly and without permission disrupts or causes the disruption of government computer services or denies or causes the denial of government computer services to an authorized user of a government computer, computer system, or computer network.
(11)Knowingly accesses and without permission adds, alters, damages, deletes, or destroys any data, computer software, or computer programs which reside or exist internal or external to a public safety infrastructure computer system computer, computer system, or computer network.
(12)Knowingly and without permission disrupts or causes the disruption of public safety infrastructure computer system computer services or denies or causes the denial of computer services to an authorized user of a public safety infrastructure computer system computer, computer system, or computer network.
(13)Knowingly and without permission provides or assists in providing a means of accessing a computer, computer system, or public safety infrastructure computer system computer, computer system, or computer network in violation of this section.
(14)Knowingly introduces any computer contaminant into any public safety infrastructure computer system computer, computer system, or computer network.
(d)(1)Any person who violates any of the provisions of paragraph (1), (2), (4), (5), (10), (11), or (12) of subdivision (c) is guilty of a felony, punishable by imprisonment pursuant to subdivision (h) of Section 1170 for 16 months, or two or three years and a fine not exceeding ten thousand dollars ($10,000), or a misdemeanor, punishable by imprisonment in a county jail not exceeding one year, by a fine not exceeding five thousand dollars ($5,000), or by both that fine and imprisonment.
(2)Any person who violates paragraph (3) of subdivision (c) is punishable as follows:
(A)For the first violation that does not result in injury, and where the value of the computer services used does not exceed nine hundred fifty dollars ($950), by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
(B)For any violation that results in a victim expenditure in an amount greater than five thousand dollars ($5,000) or in an injury, or if the value of the computer services used exceeds nine hundred fifty dollars ($950), or for any second or subsequent violation, by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment pursuant to subdivision (h) of Section 1170 for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
(3)Any person who violates paragraph (6), (7), or (13) of subdivision (c) is punishable as follows:
(A)For a first violation that does not result in injury, an infraction punishable by a fine not exceeding one thousand dollars ($1,000).
(B)For any violation that results in a victim expenditure in an amount not greater than five thousand dollars ($5,000), or for a second or subsequent violation, by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
(C)For any violation that results in a victim expenditure in an amount greater than five thousand dollars ($5,000), by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment pursuant to subdivision (h) of Section 1170 for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
(4)Any person who violates paragraph (8) or (14) of subdivision (c) is punishable as follows:
(A)For a first violation that does not result in injury, a misdemeanor punishable by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
(B)For any violation that results in injury, or for a second or subsequent violation, by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment in a county jail not exceeding one year, or by imprisonment pursuant to subdivision (h) of Section 1170, or by both that fine and imprisonment.
(5)Any person who violates paragraph (9) of subdivision (c) is punishable as follows:
(A)For a first violation that does not result in injury, an infraction punishable by a fine not exceeding one thousand dollars ($1,000).
(B)For any violation that results in injury, or for a second or subsequent violation, by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
(e)(1)In addition to any other civil remedy available, the owner or lessee of the computer, computer system, computer network, computer program, or data who suffers damage or loss by reason of a violation of any of the provisions of subdivision (c) may bring a civil action against the violator for compensatory damages and injunctive relief or other equitable relief. Compensatory damages shall include any expenditure reasonably and necessarily incurred by the owner or lessee to verify that a computer system, computer network, computer program, or data was or was not altered, damaged, or deleted by the access. For the purposes of actions authorized by this subdivision, the conduct of an unemancipated minor shall be imputed to the parent or legal guardian having control or custody of the minor, pursuant to the provisions of Section 1714.1 of the Civil Code.
(2)In any action brought pursuant to this subdivision the court may award reasonable attorneys fees.
(3)A community college, state university, or academic institution accredited in this state is required to include computer-related crimes as a specific violation of college or university student conduct policies and regulations that may subject a student to disciplinary sanctions up to and including dismissal from the academic institution. This paragraph shall not apply to the University of California unless the Board of Regents adopts a resolution to that effect.
(4)In any action brought pursuant to this subdivision for a willful violation of the provisions of subdivision (c), where it is proved by clear and convincing evidence that a defendant has been guilty of oppression, fraud, or malice as defined in subdivision (c) of Section 3294 of the Civil Code, the court may additionally award punitive or exemplary damages.
(5)No action may be brought pursuant to this subdivision unless it is initiated within three years of the date of the act complained of, or the date of the discovery of the damage, whichever is later.
(f)This section shall not be construed to preclude the applicability of any other provision of the criminal law of this state which applies or may apply to any transaction, nor shall it make illegal any employee labor relations activities that are within the scope and protection of state or federal labor laws.
(g)Any computer, computer system, computer network, or any software or data, owned by the defendant, that is used during the commission of any public offense described in subdivision (c) or any computer, owned by the defendant, which is used as a repository for the storage of software or data illegally obtained in violation of subdivision (c) shall be subject to forfeiture, as specified in Section 502.01.
(h)(1)Subdivision (c) does not apply to punish any acts which are committed by a person within the scope of his or her lawful employment. For purposes of this section, a person acts within the scope of his or her employment when he or she performs acts which are reasonably necessary to the performance of his or her work assignment.
(2)Paragraph (3) of subdivision (c) does not apply to penalize any acts committed by a person acting outside of his or her lawful employment, provided that the employees activities do not cause an injury, to the employer or another, or provided that the value of supplies or computer services which are used does not exceed an accumulated total of two hundred fifty dollars ($250).
(i)No activity exempted from prosecution under paragraph (2) of subdivision (h) which incidentally violates paragraph (2), (4), or (7) of subdivision (c) shall be prosecuted under those paragraphs.
(j)For purposes of bringing a civil or a criminal action under this section, a person who causes, by any means, the access of a computer, computer system, or computer network in one jurisdiction from another jurisdiction is deemed to have personally accessed the computer, computer system, or computer network in each jurisdiction.
(k)In determining the terms and conditions applicable to a person convicted of a violation of this section the court shall consider the following:
(1)The court shall consider prohibitions on access to and use of computers.
(2)Except as otherwise required by law, the court shall consider alternate sentencing, including community service, if the defendant shows remorse and recognition of the wrongdoing, and an inclination not to repeat the offense.
(a)It is the intent of the Legislature in enacting this section to expand the degree of protection afforded to individuals, businesses, and governmental agencies from tampering, interference, damage, and unauthorized access to lawfully created computer data and computer systems. The Legislature finds and declares that the proliferation of computer technology has resulted in a concomitant proliferation of computer crime and other forms of unauthorized access to computers, computer systems, and computer data.
The Legislature further finds and declares that protection of the integrity of all types and forms of lawfully created computers, computer systems, and computer data is vital to the protection of the privacy of individuals as well as to the well-being of financial institutions, business concerns, governmental agencies, and others within this state that lawfully utilize those computers, computer systems, and data.
(b)For the purposes of this section, the following terms have the following meanings:
(1)Access means to gain entry to, instruct, cause input to, cause output from, cause data processing with, or communicate with, the logical, arithmetical, or memory function resources of a computer, computer system, or computer network.
(2)Computer network means any system that provides communications between one or more computer systems and input/output devices, including, but not limited to, display terminals, remote systems, mobile devices, and printers connected by telecommunication facilities.
(3)Computer program or software means a set of instructions or statements, and related data, that when executed in actual or modified form, cause a computer, computer system, or computer network to perform specified functions.
(4)Computer services includes, but is not limited to, computer time, data processing, or storage functions, Internet services, electronic mail services, electronic message services, or other uses of a computer, computer system, or computer network.
(5)Computer system means a device or collection of devices, including support devices and excluding calculators that are not programmable and capable of being used in conjunction with external files, one or more of which contain computer programs, electronic instructions, input data, and output data, that performs functions, including, but not limited to, logic, arithmetic, data storage and retrieval, communication, and control.
(6)Government computer system means any computer system, or part thereof, that is owned, operated, or used by any federal, state, or local governmental entity.
(7)Public safety infrastructure computer system means any computer system, or part thereof, that is necessary for the health and safety of the public including computer systems owned, operated, or used by drinking water and wastewater treatment facilities, hospitals, emergency service providers, telecommunication companies, and gas and electric utility companies.
(8)Data means a representation of information, knowledge, facts, concepts, computer software, or computer programs or instructions. Data may be in any form, in storage media, or as stored in the memory of the computer or in transit or presented on a display device.
(9)Supporting documentation includes, but is not limited to, all information, in any form, pertaining to the design, construction, classification, implementation, use, or modification of a computer, computer system, computer network, computer program, or computer software, which information is not generally available to the public and is necessary for the operation of a computer, computer system, computer network, computer program, or computer software.
(10)Injury means any alteration, deletion, damage, or destruction of a computer system, computer network, computer program, or data caused by the access, or the denial of access to legitimate users of a computer system, network, or program.
(11)Victim expenditure means any expenditure reasonably and necessarily incurred by the owner or lessee to verify that a computer system, computer network, computer program, or data was or was not altered, deleted, damaged, or destroyed by the access.
(12)Computer contaminant means any set of computer instructions that are designed to modify, damage, destroy, record, or transmit information within a computer, computer system, or computer network without the intent or permission of the owner of the information. They include, but are not limited to, a group of computer instructions commonly called viruses or worms, that are self-replicating or self-propagating and are designed to contaminate other computer programs or computer data, consume computer resources, modify, destroy, record, or transmit data, or in some other fashion usurp the normal operation of the computer, computer system, or computer network.
(13)Internet domain name means a globally unique, hierarchical reference to an Internet host or service, assigned through centralized Internet naming authorities, comprising a series of character strings separated by periods, with the rightmost character string specifying the top of the hierarchy.
(14)Electronic mail means an electronic message or computer file that is transmitted between two or more telecommunications devices; computers; computer networks, regardless of whether the network is a local, regional, or global network; or electronic devices capable of receiving electronic messages, regardless of whether the message is converted to hard copy format after receipt, viewed upon transmission, or stored for later retrieval.
(15)Profile means either of the following:
(A)A configuration of user data required by a computer so that the user may access programs or services and have the desired functionality on that computer.
(B)An Internet Web site users personal page or section of a page that is made up of data, in text or graphical form, that displays significant, unique, or identifying information, including, but not limited to, listing acquaintances, interests, associations, activities, or personal statements.
(c)Except as provided in subdivision (h), any person who commits any of the following acts is guilty of a public offense:
(1)Knowingly accesses and without permission alters, damages, deletes, destroys, or otherwise uses any data, computer, computer system, or computer network in order to either (A) devise or execute any scheme or artifice to defraud, deceive, or extort, or (B) wrongfully control or obtain money, property, or data.
(2)Knowingly accesses and without permission takes, copies, or makes use of any data from a computer, computer system, or computer network, or takes or copies any supporting documentation, whether existing or residing internal or external to a computer, computer system, or computer network.
(3)Knowingly and without permission uses or causes to be used computer services.
(4)Knowingly accesses and without permission adds, alters, damages, deletes, or destroys any data, computer software, or computer programs which reside or exist internal or external to a computer, computer system, or computer network.
(5)Knowingly and without permission disrupts or causes the disruption of computer services or denies or causes the denial of computer services to an authorized user of a computer, computer system, or computer network.
(6)Knowingly and without permission provides or assists in providing a means of accessing a computer, computer system, or computer network in violation of this section.
(7)Knowingly and without permission accesses or causes to be accessed any computer, computer system, or computer network.
(8)Knowingly introduces any computer contaminant into any computer, computer system, or computer network.
(9)Knowingly and without permission uses the Internet domain name or profile of another individual, corporation, or entity in connection with the sending of one or more electronic mail messages or posts and thereby damages or causes damage to a computer, computer data, computer system, or computer network.
(10)Knowingly and without permission disrupts or causes the disruption of government computer services or denies or causes the denial of government computer services to an authorized user of a government computer, computer system, or computer network.
(11)Knowingly accesses and without permission adds, alters, damages, deletes, or destroys any data, computer software, or computer programs which reside or exist internal or external to a public safety infrastructure computer system computer, computer system, or computer network.
(12)Knowingly and without permission disrupts or causes the disruption of public safety infrastructure computer system computer services or denies or causes the denial of computer services to an authorized user of a public safety infrastructure computer system computer, computer system, or computer network.
(13)Knowingly and without permission provides or assists in providing a means of accessing a computer, computer system, or public safety infrastructure computer system computer, computer system, or computer network in violation of this section.
(14)Knowingly introduces any computer contaminant into any public safety infrastructure computer system computer, computer system, or computer network.
(d)(1)Any person who violates any of the provisions of paragraph (1), (2), (4), (5), (10), (11), or (12) of subdivision (c) is guilty of a felony, punishable by imprisonment pursuant to subdivision (h) of Section 1170 for 16 months, or two or three years and a fine not exceeding ten thousand dollars ($10,000), or a misdemeanor, punishable by imprisonment in a county jail not exceeding one year, by a fine not exceeding five thousand dollars ($5,000), or by both that fine and imprisonment.
(2)Any person who violates paragraph (3) of subdivision (c) is punishable as follows:
(A)For the first violation that does not result in injury, and where the value of the computer services used does not exceed nine hundred fifty dollars ($950), by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
(B)For any violation that results in a victim expenditure in an amount greater than five thousand dollars ($5,000) or in an injury, or if the value of the computer services used exceeds nine hundred fifty dollars ($950), or for any second or subsequent violation, by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment pursuant to subdivision (h) of Section 1170 for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
(3)Any person who violates paragraph (6), (7), or (13) of subdivision (c) is punishable as follows:
(A)For a first violation that does not result in injury, an infraction punishable by a fine not exceeding one thousand dollars ($1,000).
(B)For any violation that results in a victim expenditure in an amount not greater than five thousand dollars ($5,000), or for a second or subsequent violation, by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
(C)For any violation that results in a victim expenditure in an amount greater than five thousand dollars ($5,000), by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment pursuant to subdivision (h) of Section 1170 for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
(4)Any person who violates paragraph (8) or (14) of subdivision (c) is punishable as follows:
(A)For a first violation that does not result in injury, a misdemeanor punishable by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
(B)For any violation that results in injury, or for a second or subsequent violation, by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment in a county jail not exceeding one year, or by imprisonment pursuant to subdivision (h) of Section 1170, or by both that fine and imprisonment.
(5)Any person who violates paragraph (9) of subdivision (c) is punishable as follows:
(A)For a first violation that does not result in injury, an infraction punishable by a fine not exceeding one thousand dollars ($1,000).
(B)For any violation that results in injury, or for a second or subsequent violation, by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
(e)(1)In addition to any other civil remedy available, the owner or lessee of the computer, computer system, computer network, computer program, or data who suffers damage or loss by reason of a violation of any of the provisions of subdivision (c) may bring a civil action against the violator for compensatory damages and injunctive relief or other equitable relief. Compensatory damages shall include any expenditure reasonably and necessarily incurred by the owner or lessee to verify that a computer system, computer network, computer program, or data was or was not altered, damaged, or deleted by the access. For the purposes of actions authorized by this subdivision, the conduct of an unemancipated minor shall be imputed to the parent or legal guardian having control or custody of the minor, pursuant to the provisions of Section 1714.1 of the Civil Code.
(2)In any action brought pursuant to this subdivision the court may award reasonable attorneys fees.
(3)A community college, state university, or academic institution accredited in this state is required to include computer-related crimes as a specific violation of college or university student conduct policies and regulations that may subject a student to disciplinary sanctions up to and including dismissal from the academic institution. This paragraph shall not apply to the University of California unless the Board of Regents adopts a resolution to that effect.
(4)In any action brought pursuant to this subdivision for a willful violation of the provisions of subdivision (c), where it is proved by clear and convincing evidence that a defendant has been guilty of oppression, fraud, or malice as defined in subdivision (c) of Section 3294 of the Civil Code, the court may additionally award punitive or exemplary damages.
(5)No action may be brought pursuant to this subdivision unless it is initiated within three years of the date of the act complained of, or the date of the discovery of the damage, whichever is later.
(f)This section shall not be construed to preclude the applicability of any other provision of the criminal law of this state which applies or may apply to any transaction, nor shall it make illegal any employee labor relations activities that are within the scope and protection of state or federal labor laws.
(g)Any computer, computer system, computer network, or any software or data, owned by the defendant, that is used during the commission of any public offense described in subdivision (c) or any computer, owned by the defendant, which is used as a repository for the storage of software or data illegally obtained in violation of subdivision (c) shall be subject to forfeiture, as specified in Section 502.01.
(h)(1)Subdivision (c) does not apply to punish any acts which are committed by a person within the scope of his or her lawful employment. For purposes of this section, a person acts within the scope of his or her employment when he or she performs acts which are reasonably necessary to the performance of his or her work assignment.
(2)Paragraph (3) of subdivision (c) does not apply to penalize any acts committed by a person acting outside of his or her lawful employment, provided that the employees activities do not cause an injury, to the employer or another, or provided that the value of supplies or computer services which are used does not exceed an accumulated total of two hundred fifty dollars ($250).
(i)No activity exempted from prosecution under paragraph (2) of subdivision (h) which incidentally violates paragraph (2), (4), or (7) of subdivision (c) shall be prosecuted under those paragraphs.
(j)For purposes of bringing a civil or a criminal action under this section, a person who causes, by any means, the access of a computer, computer system, or computer network in one jurisdiction from another jurisdiction is deemed to have personally accessed the computer, computer system, or computer network in each jurisdiction.
(k)In determining the terms and conditions applicable to a person convicted of a violation of this section the court shall consider the following:
(1)The court shall consider prohibitions on access to and use of computers.
(2)Except as otherwise required by law, the court shall consider alternate sentencing, including community service, if the defendant shows remorse and recognition of the wrongdoing, and an inclination not to repeat the offense.
(a)It is the intent of the Legislature in enacting this section to expand the degree of protection afforded to individuals, businesses, and governmental agencies from tampering, interference, damage, and unauthorized access to lawfully created computer data and computer systems. The Legislature finds and declares that the proliferation of computer technology has resulted in a concomitant proliferation of computer crime and other forms of unauthorized access to computers, computer systems, and computer data.
The Legislature further finds and declares that protection of the integrity of all types and forms of lawfully created computers, computer systems, and computer data is vital to the protection of the privacy of individuals as well as to the well-being of financial institutions, business concerns, governmental agencies, and others within this state that lawfully utilize those computers, computer systems, and data.
(b)For the purposes of this section, the following terms have the following meanings:
(1)Access means to gain entry to, instruct, cause input to, cause output from, cause data processing with, or communicate with, the logical, arithmetical, or memory function resources of a computer, computer system, or computer network.
(2)Computer network means any system that provides communications between one or more computer systems and input/output devices, including, but not limited to, display terminals, remote systems, mobile devices, and printers connected by telecommunication facilities.
(3)Computer program or software means a set of instructions or statements, and related data, that when executed in actual or modified form, cause a computer, computer system, or computer network to perform specified functions.
(4)Computer services includes, but is not limited to, computer time, data processing, or storage functions, Internet services, electronic mail services, electronic message services, or other uses of a computer, computer system, or computer network.
(5)Computer system means a device or collection of devices, including support devices and excluding calculators that are not programmable and capable of being used in conjunction with external files, one or more of which contain computer programs, electronic instructions, input data, and output data, that performs functions, including, but not limited to, logic, arithmetic, data storage and retrieval, communication, and control.
(6)Government computer system means any computer system, or part thereof, that is owned, operated, or used by any federal, state, or local governmental entity.
(7)Public safety infrastructure computer system means any computer system, or part thereof, that is necessary for the health and safety of the public including computer systems owned, operated, or used by drinking water and wastewater treatment facilities, hospitals, emergency service providers, telecommunication companies, and gas and electric utility companies.
(8)Data means a representation of information, knowledge, facts, concepts, computer software, or computer programs or instructions. Data may be in any form, in storage media, or as stored in the memory of the computer or in transit or presented on a display device.
(9)Supporting documentation includes, but is not limited to, all information, in any form, pertaining to the design, construction, classification, implementation, use, or modification of a computer, computer system, computer network, computer program, or computer software, which information is not generally available to the public and is necessary for the operation of a computer, computer system, computer network, computer program, or computer software.
(10)Injury means any alteration, deletion, damage, or destruction of a computer system, computer network, computer program, or data caused by the access, or the denial of access to legitimate users of a computer system, network, or program.
(11)Victim expenditure means any expenditure reasonably and necessarily incurred by the owner or lessee to verify that a computer system, computer network, computer program, or data was or was not altered, deleted, damaged, or destroyed by the access.
(12)Computer contaminant means any set of computer instructions that are designed to modify, damage, destroy, record, or transmit information within a computer, computer system, or computer network without the intent or permission of the owner of the information. They include, but are not limited to, a group of computer instructions commonly called viruses or worms, that are self-replicating or self-propagating and are designed to contaminate other computer programs or computer data, consume computer resources, modify, destroy, record, or transmit data, or in some other fashion usurp the normal operation of the computer, computer system, or computer network.
(13)Internet domain name means a globally unique, hierarchical reference to an Internet host or service, assigned through centralized Internet naming authorities, comprising a series of character strings separated by periods, with the rightmost character string specifying the top of the hierarchy.
(14)Electronic mail means an electronic message or computer file that is transmitted between two or more telecommunications devices; computers; computer networks, regardless of whether the network is a local, regional, or global network; or electronic devices capable of receiving electronic messages, regardless of whether the message is converted to hard copy format after receipt, viewed upon transmission, or stored for later retrieval.
(15)Profile means either of the following:
(A)A configuration of user data required by a computer so that the user may access programs or services and have the desired functionality on that computer.
(B)An Internet Web site users personal page or section of a page that is made up of data, in text or graphical form, that displays significant, unique, or identifying information, including, but not limited to, listing acquaintances, interests, associations, activities, or personal statements.
(c)Except as provided in subdivision (h), any person who commits any of the following acts is guilty of a public offense:
(1)Knowingly accesses and without permission alters, damages, deletes, destroys, or otherwise uses any data, computer, computer system, or computer network in order to either (A) devise or execute any scheme or artifice to defraud, deceive, or extort, or (B) wrongfully control or obtain money, property, or data.
(2)Knowingly accesses and without permission takes, copies, or makes use of any data from a computer, computer system, or computer network, or takes or copies any supporting documentation, whether existing or residing internal or external to a computer, computer system, or computer network.
(3)Knowingly and without permission uses or causes to be used computer services.
(4)Knowingly accesses and without permission adds, alters, damages, deletes, or destroys any data, computer software, or computer programs which reside or exist internal or external to a computer, computer system, or computer network.
(5)Knowingly and without permission disrupts or causes the disruption of computer services or denies or causes the denial of computer services to an authorized user of a computer, computer system, or computer network.
(6)Knowingly and without permission provides or assists in providing a means of accessing a computer, computer system, or computer network in violation of this section.
(7)Knowingly and without permission accesses or causes to be accessed any computer, computer system, or computer network.
(8)Knowingly introduces any computer contaminant into any computer, computer system, or computer network.
(9)Knowingly and without permission uses the Internet domain name or profile of another individual, corporation, or entity in connection with the sending of one or more electronic mail messages or posts and thereby damages or causes damage to a computer, computer data, computer system, or computer network.
(10)Knowingly and without permission disrupts or causes the disruption of government computer services or denies or causes the denial of government computer services to an authorized user of a government computer, computer system, or computer network.
(11)Knowingly accesses and without permission adds, alters, damages, deletes, or destroys any data, computer software, or computer programs which reside or exist internal or external to a public safety infrastructure computer system computer, computer system, or computer network.
(12)Knowingly and without permission disrupts or causes the disruption of public safety infrastructure computer system computer services or denies or causes the denial of computer services to an authorized user of a public safety infrastructure computer system computer, computer system, or computer network.
(13)Knowingly and without permission provides or assists in providing a means of accessing a computer, computer system, or public safety infrastructure computer system computer, computer system, or computer network in violation of this section.
(14)Knowingly introduces any computer contaminant into any public safety infrastructure computer system computer, computer system, or computer network.
(d)(1)Any person who violates any of the provisions of paragraph (1), (2), (4), (5), (10), (11), or (12) of subdivision (c) is guilty of a felony, punishable by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment pursuant to subdivision (h) of Section 1170 for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding ten thousand dollars ($10,000), or years and a fine not exceeding ten thousand dollars ($10,000), or a misdemeanor, punishable by imprisonment in a county jail not exceeding one year, by a fine not exceeding five thousand dollars ($5,000), or by both that fine and imprisonment.
(2)Any person who violates paragraph (3) of subdivision (c) is punishable as follows:
(A)For the first violation that does not result in injury, and where the value of the computer services used does not exceed nine hundred fifty dollars ($950), by a fine not exceeding ten five thousand dollars ($10,000), ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
(B)For any violation that results in a victim expenditure in an amount greater than five thousand dollars ($5,000) or in an injury, or if the value of the computer services used exceeds nine hundred fifty dollars ($950), or for any second or subsequent violation, by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment pursuant to subdivision (h) of Section 1170 for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding ten five thousand dollars ($10,000), ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
(3)Any person who violates paragraph (6), (7), or (13) of subdivision (c) is punishable as follows:
(A)For a first violation that does not result in injury, an infraction punishable by a fine not exceeding one thousand dollars ($1,000).
(B)For any violation that results in a victim expenditure in an amount not greater than five thousand dollars ($5,000), or for a second or subsequent violation, by a fine not exceeding ten five thousand dollars ($10,000), ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
(C)For any violation that results in a victim expenditure in an amount greater than five thousand dollars ($5,000), by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment pursuant to subdivision (h) of Section 1170 for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding ten five thousand dollars ($10,000), ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
(4)Any person who violates paragraph (8) or (14) of subdivision (c) is punishable as follows:
(A)For a first violation that does not result in injury, a misdemeanor punishable by a fine not exceeding ten five thousand dollars ($10,000), ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
(B)For any violation that results in injury, or for a second or subsequent violation, by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment in a county jail not exceeding one year, or by imprisonment pursuant to subdivision (h) of Section 1170, or by both that fine and imprisonment.
(5)Any person who violates paragraph (9) of subdivision (c) is punishable as follows:
(A)For a first violation that does not result in injury, an infraction punishable by a fine not exceeding one thousand dollars ($1,000).
(B)For any violation that results in injury, or for a second or subsequent violation, by a fine not exceeding ten five thousand dollars ($10,000), ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
(e)(1)In addition to any other civil remedy available, the owner or lessee of the computer, computer system, computer network, computer program, or data who suffers damage or loss by reason of a violation of any of the provisions of subdivision (c) may bring a civil action against the violator for compensatory damages and injunctive relief or other equitable relief. Compensatory damages shall include any expenditure reasonably and necessarily incurred by the owner or lessee to verify that a computer system, computer network, computer program, or data was or was not altered, damaged, or deleted by the access. For the purposes of actions authorized by this subdivision, the conduct of an unemancipated minor shall be imputed to the parent or legal guardian having control or custody of the minor, pursuant to the provisions of Section 1714.1 of the Civil Code.
(2)In any action brought pursuant to this subdivision the court may award reasonable attorneys fees.
(3)A community college, state university, or academic institution accredited in this state is required to include computer-related crimes as a specific violation of college or university student conduct policies and regulations that may subject a student to disciplinary sanctions up to and including dismissal from the academic institution. This paragraph shall not apply to the University of California unless the Board of Regents adopts a resolution to that effect.
(4)In any action brought pursuant to this subdivision for a willful violation of the provisions of subdivision (c), where it is proved by clear and convincing evidence that a defendant has been guilty of oppression, fraud, or malice as defined in subdivision (c) of Section 3294 of the Civil Code, the court may additionally award punitive or exemplary damages.
(5)No action may be brought pursuant to this subdivision unless it is initiated within three years of the date of the act complained of, or the date of the discovery of the damage, whichever is later.
(f)This section shall not be construed to preclude the applicability of any other provision of the criminal law of this state which applies or may apply to any transaction, nor shall it make illegal any employee labor relations activities that are within the scope and protection of state or federal labor laws.
(g)Any computer, computer system, computer network, or any software or data, owned by the defendant, that is used during the commission of any public offense described in subdivision (c) or any computer, owned by the defendant, which is used as a repository for the storage of software or data illegally obtained in violation of subdivision (c) shall be subject to forfeiture, as specified in Section 502.01.
(h)(1)Subdivision (c) does not apply to punish any acts which are committed by a person within the scope of his or her lawful employment. For purposes of this section, a person acts within the scope of his or her employment when he or she performs acts which are reasonably necessary to the performance of his or her work assignment.
(2)Paragraph (3) of subdivision (c) does not apply to penalize any acts committed by a person acting outside of his or her lawful employment, provided that the employees activities do not cause an injury, to the employer or another, or provided that the value of supplies or computer services which are used does not exceed an accumulated total of two hundred fifty dollars ($250).
(i)No activity exempted from prosecution under paragraph (2) of subdivision (h) which incidentally violates paragraph (2), (4), or (7) of subdivision (c) shall be prosecuted under those paragraphs.
(j)For purposes of bringing a civil or a criminal action under this section, a person who causes, by any means, the access of a computer, computer system, or computer network in one jurisdiction from another jurisdiction is deemed to have personally accessed the computer, computer system, or computer network in each jurisdiction.
(k)In determining the terms and conditions applicable to a person convicted of a violation of this section the court shall consider the following:
(1)The court shall consider prohibitions on access to and use of computers.
(2)Except as otherwise required by law, the court shall consider alternate sentencing, including community service, if the defendant shows remorse and recognition of the wrongdoing, and an inclination not to repeat the offense.
SEC. 2.Section 803 of the Penal Code is amended to read:803.(a)Except as provided in this section, a limitation of time prescribed in this chapter is not tolled or extended for any reason.
(b)No time during which prosecution of the same person for the same conduct is pending in a court of this state is a part of a limitation of time prescribed in this chapter.
(c)A limitation of time prescribed in this chapter does not commence to run until the discovery of an offense described in this subdivision. This subdivision applies to an offense punishable by imprisonment in the state prison or imprisonment pursuant to subdivision (h) of Section 1170, a material element of which is fraud or breach of a fiduciary obligation, the commission of the crimes of theft or embezzlement upon an elder or dependent adult, or the basis of which is misconduct in office by a public officer, employee, or appointee, including, but not limited to, the following offenses:
(1)Grand theft of any type, forgery, falsification of public records, or acceptance of a bribe by a public official or a public employee.
(2)A violation of Section 72, 118, 118a, 132, 134, or 186.10.
(3)A violation of Section 25540, of any type, or Section 25541 of the Corporations Code.
(4)A violation of Section 1090 or 27443 of the Government Code.
(5)Felony welfare fraud or Medi-Cal fraud in violation of Section 11483 or 14107 of the Welfare and Institutions Code.
(6)Felony insurance fraud in violation of Section 548 or 550 of this code or former Section 1871.1, or Section 1871.4 of the Insurance Code.
(7)A violation of Section 580, 581, 582, 583, or 584 of the Business and Professions Code.
(8)A violation of Section 22430 of the Business and Professions Code.
(9)A violation of Section 103800 of the Health and Safety Code.
(10)A violation of Section 529a.
(11)A violation of subdivision (d) or (e) of Section 368.
(d)If the defendant is out of the state when or after the offense is committed, the prosecution may be commenced as provided in Section 804 within the limitations of time prescribed by this chapter, and no time up to a maximum of three years during which the defendant is not within the state shall be a part of those limitations.
(e)A limitation of time prescribed in this chapter does not commence to run until the offense has been discovered, or could have reasonably been discovered, with regard to offenses under Division 7 (commencing with Section 13000) of the Water Code, under Chapter 6.5 (commencing with Section 25100) of, Chapter 6.7 (commencing with Section 25280) of, or Chapter 6.8 (commencing with Section 25300) of, Division 20 of, or Part 4 (commencing with Section 41500) of Division 26 of, the Health and Safety Code, or under Section 386, or offenses under Chapter 5 (commencing with Section 2000) of Division 2 of, Chapter 9 (commencing with Section 4000) of Division 2 of, Section 6126 of, Chapter 10 (commencing with Section 7301) of Division 3 of, or Chapter 19.5 (commencing with Section 22440) of Division 8 of, the Business and Professions Code.
(f)(1)Notwithstanding any other limitation of time described in this chapter, a criminal complaint may be filed within one year of the date of a report to a California law enforcement agency by a person of any age alleging that he or she, while under the age of 18 years, was the victim of a crime described in Section 261, 286, 288, 288a, 288.5, or 289, or Section 289.5 as enacted by Chapter 293 of the Statutes of 1991 relating to penetration by an unknown object.
(2)This subdivision applies only if all of the following occur:
(A)The limitation period specified in Section 800, 801, or 801.1, whichever is later, has expired.
(B)The crime involved substantial sexual conduct, as described in subdivision (b) of Section 1203.066, excluding masturbation that is not mutual.
(C)There is independent evidence that corroborates the victims allegation. If the victim was 21 years of age or older at the time of the report, the independent evidence shall clearly and convincingly corroborate the victims allegation.
(3)No evidence may be used to corroborate the victims allegation that otherwise would be inadmissible during trial. Independent evidence does not include the opinions of mental health professionals.
(4)(A)In a criminal investigation involving any of the crimes listed in paragraph (1) committed against a child, when the applicable limitations period has not expired, that period shall be tolled from the time a party initiates litigation challenging a grand jury subpoena until the end of the litigation, including any associated writ or appellate proceeding, or until the final disclosure of evidence to the investigating or prosecuting agency, if that disclosure is ordered pursuant to the subpoena after the litigation.
(B)Nothing in this subdivision affects the definition or applicability of any evidentiary privilege.
(C)This subdivision shall not apply where a court finds that the grand jury subpoena was issued or caused to be issued in bad faith.
(g)(1)Notwithstanding any other limitation of time described in this chapter, a criminal complaint may be filed within one year of the date on which the identity of the suspect is conclusively established by DNA testing, if both of the following conditions are met:
(A)The crime is one that is described in subdivision (c) of Section 290.
(B)The offense was committed prior to January 1, 2001, and biological evidence collected in connection with the offense is analyzed for DNA type no later than January 1, 2004, or the offense was committed on or after January 1, 2001, and biological evidence collected in connection with the offense is analyzed for DNA type no later than two years from the date of the offense.
(2)For purposes of this section, DNA means deoxyribonucleic acid.
(h)For any crime, the proof of which depends substantially upon evidence that was seized under a warrant, but which is unavailable to the prosecuting authority under the procedures described in People v. Superior Court (Laff) (2001) 25 Cal.4th 703, People v. Superior Court (Bauman & Rose) (1995) 37 Cal.App.4th 1757, or subdivision (c) of Section 1524, relating to claims of evidentiary privilege or attorney work product, the limitation of time prescribed in this chapter shall be tolled from the time of the seizure until final disclosure of the evidence to the prosecuting authority. Nothing in this section otherwise affects the definition or applicability of any evidentiary privilege or attorney work product.
(i)Notwithstanding any other limitation of time described in this chapter, a criminal complaint may be filed within one year of the date on which a hidden recording is discovered related to a violation of paragraph (2) or (3) of subdivision (j) of Section 647.
(j)Notwithstanding any other limitation of time described in this chapter, if a person flees the scene of an accident that caused death or permanent, serious injury, as defined in subdivision (d) of Section 20001 of the Vehicle Code, a criminal complaint brought pursuant to paragraph (2) of subdivision (b) of Section 20001 of the Vehicle Code may be filed within the applicable time period described in Section 801 or 802 or one year after the person is initially identified by law enforcement as a suspect in the commission of the offense, whichever is later, but in no case later than six years after the commission of the offense.
(k)(1)A limitation of time prescribed in this chapter for an offense described in subdivision (c) of Section 502 for which it is alleged the defendant acquired, copied, or distributed one or more digital images of a person that displays an intimate body part of the person shall not commence to run until the discovery of the offense.
(2)As used in this subdivision, intimate body part means any portion of the genitals, the anus, and in the case of a female also includes any portion of the breasts below the top of the areola, that is either uncovered or clearly visible through clothing.
(3)As used in this subdivision, digital images of a person do not include representational images, artwork, or cartoon drawings.
(a)It is the intent of the Legislature in enacting this section to expand the degree of protection afforded to individuals, businesses, and governmental agencies from tampering, interference, damage, and unauthorized access to lawfully created computer data and computer systems. The Legislature finds and declares that the proliferation of computer technology has resulted in a concomitant proliferation of computer crime and other forms of unauthorized access to computers, computer systems, and computer data.
The Legislature further finds and declares that protection of the integrity of all types and forms of lawfully created computers, computer systems, and computer data is vital to the protection of the privacy of individuals as well as to the well-being of financial institutions, business concerns, governmental agencies, and others within this state that lawfully utilize those computers, computer systems, and data.
(b)For the purposes of this section, the following terms have the following meanings:
(1)Access means to gain entry to, instruct, cause input to, cause output from, cause data processing with, or communicate with, the logical, arithmetical, or memory function resources of a computer, computer system, or computer network.
(2)Computer network means any system that provides communications between one or more computer systems and input/output devices devices, including, but not limited to, display terminals, remote systems, mobile devices, and printers connected by telecommunication facilities.
(3)Computer program or software means a set of instructions or statements, and related data, that when executed in actual or modified form, cause a computer, computer system, or computer network to perform specified functions.
(4)Computer services includes, but is not limited to, computer time, data processing, or storage functions, Internet services, electronic mail services, electronic message services, or other uses of a computer, computer system, or computer network.
(5)Computer system means a device or collection of devices, including support devices and excluding calculators that are not programmable and capable of being used in conjunction with external files, one or more of which contain computer programs, electronic instructions, input data, and output data, that performs functions functions, including, but not limited to, logic, arithmetic, data storage and retrieval, communication, and control.
(6)Government computer system means any computer system, or part thereof, that is owned, operated, or used by any federal, state, or local governmental entity.
(7)Public safety infrastructure computer system means any computer system, or part thereof, that is necessary for the health and safety of the public including computer systems owned, operated, or used by drinking water and wastewater treatment facilities, hospitals, emergency service providers, telecommunication companies, and gas and electric utility companies.
(8)Data means a representation of information, knowledge, facts, concepts, computer software, computer programs or instructions. Data may be in any form, in storage media, or as stored in the memory of the computer or in transit or presented on a display device.
(9)Supporting documentation includes, but is not limited to, all information, in any form, pertaining to the design, construction, classification, implementation, use, or modification of a computer, computer system, computer network, computer program, or computer software, which information is not generally available to the public and is necessary for the operation of a computer, computer system, computer network, computer program, or computer software.
(10)Injury means any alteration, deletion, damage, or destruction of a computer system, computer network, computer program, or data caused by the access, or the denial of access to legitimate users of a computer system, network, or program.
(11)Victim expenditure means any expenditure reasonably and necessarily incurred by the owner or lessee to verify that a computer system, computer network, computer program, or data was or was not altered, deleted, damaged, or destroyed by the access.
(12)Computer contaminant means any set of computer instructions that are designed to modify, damage, destroy, record, or transmit information within a computer, computer system, or computer network without the intent or permission of the owner of the information. They include, but are not limited to, a group of computer instructions commonly called viruses or worms, that are self-replicating or self-propagating and are designed to contaminate other computer programs or computer data, consume computer resources, modify, destroy, record, or transmit data, or in some other fashion usurp the normal operation of the computer, computer system, or computer network.
(13)Internet domain name means a globally unique, hierarchical reference to an Internet host or service, assigned through centralized Internet naming authorities, comprising a series of character strings separated by periods, with the rightmost character string specifying the top of the hierarchy.
(14)Electronic mail means an electronic message or computer file that is transmitted between two or more telecommunications devices; computers; computer networks, regardless of whether the network is a local, regional, or global network; or electronic devices capable or of receiving electronic messages, regardless of whether the message is converted to hard copy format after receipt, viewed upon transmission, or stored for later retrieval.
(15)Profile means either of the following:
(A)A configuration of user data required by a computer so that the user may access programs or services and have the desired functionality on that computer.
(B)An Internet Web site users personal page or section of a page that is made up of data, in text of or graphical form, that displays significant, unique, or identifying information, including, but not limited to, listing acquaintances, interests, associations, activities, or personal statements.
(c)Except as provided in subdivision (h), any person who commits any of the following acts is guilty of a public offense:
(1)Knowingly accesses and without permission alters, damages, deletes, destroys, or otherwise uses any data, computer, computer system, or computer network in order to either (A) devise or execute any scheme or artifice to defraud, deceive, or extort, or (B) wrongfully control or obtain money, property, or data.
(2)Knowingly accesses and without permission takes, copies, or makes use of any data from a computer, computer system, or computer network, or takes or copies any supporting documentation, whether existing or residing internal or external to a computer, computer system, or computer network.
(3)Knowingly and without permission uses or causes to be used computer services.
(4)Knowingly accesses and without permission adds, alters, damages, deletes, or destroys any data, computer software, or computer programs which reside or exist internal or external to a computer, computer system, or computer network.
(5)Knowingly and without permission disrupts or causes the disruption of computer services or denies or causes the denial of computer services to an authorized user of a computer, computer system, or computer network.
(6)Knowingly and without permission provides or assists in providing a means of accessing a computer, computer system, or computer network in violation of this section.
(7)Knowingly and without permission accesses or causes to be accessed any computer, computer system, or computer network.
(8)Knowingly introduces any computer contaminant into any computer, computer system, or computer network.
(9)Knowingly and without permission uses the Internet domain name or profile of another individual, corporation, or entity in connection with the sending of one or more electronic mail messages or posts and thereby damages or causes damage to a computer, computer data, computer system, or computer network.
(10)Knowingly and without permission disrupts or causes the disruption of government computer services or denies or causes the denial of government computer services to an authorized user of a government computer, computer system, or computer network.
(11)Knowingly accesses and without permission adds, alters, damages, deletes, or destroys any data, computer software, or computer programs which reside or exist internal or external to a public safety infrastructure computer system computer, computer system, or computer network.
(12)Knowingly and without permission disrupts or causes the disruption of public safety infrastructure computer system computer services or denies or causes the denial of computer services to an authorized user of a public safety infrastructure computer system computer, computer system, or computer network.
(13)Knowingly and without permission provides or assists in providing a means of accessing a computer, computer system, or public safety infrastructure computer system computer, computer system, or computer network in violation of this section.
(14)Knowingly introduces any computer contaminant into any public safety infrastructure computer system computer, computer system, or computer network.
(d)(1)Any person who violates any of the provisions of paragraph (1), (2), (4), (5), (10), (11), or (12) of subdivision (c) is punishable by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment pursuant to subdivision (h) of Section 1170 for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding five thousand dollars ($5,000), ten thousand dollars ($10,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
(2)Any person who violates paragraph (3) of subdivision (c) is punishable as follows:
(A)For the first violation that does not result in injury, and where the value of the computer services used does not exceed nine hundred fifty dollars ($950), by a fine not exceeding five thousand dollars ($5,000), ten thousand dollars ($10,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
(B)For any violation that results in a victim expenditure in an amount greater than five thousand dollars ($5,000) or in an injury, or if the value of the computer services used exceeds nine hundred fifty dollars ($950), or for any second or subsequent violation, by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment pursuant to subdivision (h) of Section 1170 for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding five thousand dollars ($5,000), ten thousand dollars ($10,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
(3)Any person who violates paragraph (6), (7), or (13) of subdivision (c) is punishable as follows:
(A)For a first violation that does not result in injury, an infraction punishable by a fine not exceeding one thousand dollars ($1,000).
(B)For any violation that results in a victim expenditure in an amount not greater than five thousand dollars ($5,000), or for a second or subsequent violation, by a fine not exceeding five thousand dollars ($5,000), ten thousand dollars ($10,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
(C)For any violation that results in a victim expenditure in an amount greater than five thousand dollars ($5,000), by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment pursuant to subdivision (h) of Section 1170 for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding five thousand dollars ($5,000), ten thousand dollars ($10,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
(4)Any person who violates paragraph (8) or (14) of subdivision (c) is punishable as follows:
(A)For a first violation that does not result in injury, a misdemeanor punishable by a fine not exceeding five thousand dollars ($5,000), ten thousand dollars ($10,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
(B)For any violation that results in injury, or for a second or subsequent violation, by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment in a county jail not exceeding one year, or by imprisonment pursuant to subdivision (h) of Section 1170, or by both that fine and imprisonment.
(5)Any person who violates paragraph (9) of subdivision (c) is punishable as follows:
(A)For a first violation that does not result in injury, an infraction punishable by a fine not exceeding one thousand dollars ($1,000).
(B)For any violation that results in injury, or for a second or subsequent violation, by a fine not exceeding five thousand dollars ($5,000), ten thousand dollars ($10,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
(e)(1)In addition to any other civil remedy available, the owner or lessee of the computer, computer system, computer network, computer program, or data who suffers damage or loss by reason of a violation of any of the provisions of subdivision (c) may bring a civil action against the violator for compensatory damages and injunctive relief or other equitable relief. Compensatory damages shall include any expenditure reasonably and necessarily incurred by the owner or lessee to verify that a computer system, computer network, computer program, or data was or was not altered, damaged, or deleted by the access. For the purposes of actions authorized by this subdivision, the conduct of an unemancipated minor shall be imputed to the parent or legal guardian having control or custody of the minor, pursuant to the provisions of Section 1714.1 of the Civil Code.
(2)In any action brought pursuant to this subdivision the court may award reasonable attorneys fees.
(3)A community college, state university, or academic institution accredited in this state is required to include computer-related crimes as a specific violation of college or university student conduct policies and regulations that may subject a student to disciplinary sanctions up to and including dismissal from the academic institution. This paragraph shall not apply to the University of California unless the Board of Regents adopts a resolution to that effect.
(4)In any action brought pursuant to this subdivision for a willful violation of the provisions of subdivision (c), where it is proved by clear and convincing evidence that a defendant has been guilty of oppression, fraud, or malice as defined in subdivision (c) of Section 3294 of the Civil Code, the court may additionally award punitive or exemplary damages.
(5)No action may be brought pursuant to this subdivision unless it is initiated within three years of the date of the act complained of, or the date of the discovery of the damage, whichever is later.
(f)This section shall not be construed to preclude the applicability of any other provision of the criminal law of this state which applies or may apply to any transaction, nor shall it make illegal any employee labor relations activities that are within the scope and protection of state or federal labor laws.
(g)Any computer, computer system, computer network, or any software or data, owned by the defendant, that is used during the commission of any public offense described in subdivision (c) or any computer, owned by the defendant, which is used as a repository for the storage of software or data illegally obtained in violation of subdivision (c) shall be subject to forfeiture, as specified in Section 502.01.
(h)(1)Subdivision (c) does not apply to punish any acts which are committed by a person within the scope of his or her lawful employment. For purposes of this section, a person acts within the scope of his or her employment when he or she performs acts which are reasonably necessary to the performance of his or her work assignment.
(2)Paragraph (3) of subdivision (c) does not apply to penalize any acts committed by a person acting outside of his or her lawful employment, provided that the employees activities do not cause an injury, to the employer or another, or provided that the value of supplies or computer services which are used does not exceed an accumulated total of two hundred fifty dollars ($250).
(i)No activity exempted from prosecution under paragraph (2) of subdivision (h) which incidentally violates paragraph (2), (4), or (7) of subdivision (c) shall be prosecuted under those paragraphs.
(j)For purposes of bringing a civil or a criminal action under this section, a person who causes, by any means, the access of a computer, computer system, or computer network in one jurisdiction from another jurisdiction is deemed to have personally accessed the computer, computer system, or computer network in each jurisdiction.
(k)In determining the terms and conditions applicable to a person convicted of a violation of this section the court shall consider the following:
(1)The court shall consider prohibitions on access to and use of computers.
(2)Except as otherwise required by law, the court shall consider alternate sentencing, including community service, if the defendant shows remorse and recognition of the wrongdoing, and an inclination not to repeat the offense.
(l)(1)A person who commits a violation of this section that involves acquiring, copying, or distributing one or more digital images of a person that displays an intimate body part of the person is subject to a fine not exceeding ten thousand dollars ($10,000) per each image acquired, copied, or distributed.
(2)A fine imposed pursuant to this subdivision is in addition to any other penalty or punishment provided for conduct that violates this subdivision.
(3)A fine pursuant to this subdivision may be imposed only pursuant to an action brought by a district attorney.
(4)As used in this subdivision, intimate body part means any portion of the genitals, the anus, and in the case of a female also includes any portion of the breasts below the top of the areola, that is either uncovered or clearly visible through clothing.
SEC. 2.Section 803 of the Penal Code is amended to read:803.(a)Except as provided in this section, a limitation of time prescribed in this chapter is not tolled or extended for any reason.
(b)No time during which prosecution of the same person for the same conduct is pending in a court of this state is a part of a limitation of time prescribed in this chapter.
(c)A limitation of time prescribed in this chapter does not commence to run until the discovery of an offense described in this subdivision. This subdivision applies to an offense punishable by imprisonment in the state prison or imprisonment pursuant to subdivision (h) of Section 1170, a material element of which is fraud or breach of a fiduciary obligation, the commission of the crimes of theft or embezzlement upon an elder or dependent adult, or the basis of which is misconduct in office by a public officer, employee, or appointee, including, but not limited to, the following offenses:
(1)Grand theft of any type, forgery, falsification of public records, or acceptance of a bribe by a public official or a public employee.
(2)A violation of Section 72, 118, 118a, 132, 134, or 186.10.
(3)A violation of Section 25540, of any type, or Section 25541 of the Corporations Code.
(4)A violation of Section 1090 or 27443 of the Government Code.
(5)Felony welfare fraud or Medi-Cal fraud in violation of Section 11483 or 14107 of the Welfare and Institutions Code.
(6)Felony insurance fraud in violation of Section 548 or 550 of this code or former Section 1871.1, or Section 1871.4 of the Insurance Code.
(7)A violation of Section 580, 581, 582, 583, or 584 of the Business and Professions Code.
(8)A violation of Section 22430 of the Business and Professions Code.
(9)A violation of Section 103800 of the Health and Safety Code.
(10)A violation of Section 529a.
(11)A violation of subdivision (d) or (e) of Section 368.
(d)If the defendant is out of the state when or after the offense is committed, the prosecution may be commenced as provided in Section 804 within the limitations of time prescribed by this chapter, and no time up to a maximum of three years during which the defendant is not within the state shall be a part of those limitations.
(e)A limitation of time prescribed in this chapter does not commence to run until the offense has been discovered, or could have reasonably been discovered, with regard to offenses under Division 7 (commencing with Section 13000) of the Water Code, under Chapter 6.5 (commencing with Section 25100) of, Chapter 6.7 (commencing with Section 25280) of, or Chapter 6.8 (commencing with Section 25300) of, Division 20 of, or Part 4 (commencing with Section 41500) of Division 26 of, the Health and Safety Code, or under Section 386, or offenses under Chapter 5 (commencing with Section 2000) of Division 2 of, Chapter 9 (commencing with Section 4000) of Division 2 of, Section 6126 of, Chapter 10 (commencing with Section 7301) of Division 3 of, or Chapter 19.5 (commencing with Section 22440) of Division 8 of, the Business and Professions Code.
(f)(1)Notwithstanding any other limitation of time described in this chapter, a criminal complaint may be filed within one year of the date of a report to a California law enforcement agency by a person of any age alleging that he or she, while under the age of 18 years, was the victim of a crime described in Section 261, 286, 288, 288a, 288.5, or 289. 289, or Section 289.5 as enacted by Chapter 293 of the Statutes of 1991 relating to penetration by an unknown object.
(2)This subdivision applies only if all of the following occur:
(A)The limitation period specified in Section 800, 801, or 801.1, whichever is later, has expired.
(B)The crime involved substantial sexual conduct, as described in subdivision (b) of Section 1203.066, excluding masturbation that is not mutual.
(C)There is independent evidence that corroborates the victims allegation. If the victim was 21 years of age or older at the time of the report, the independent evidence shall clearly and convincingly corroborate the victims allegation.
(3)No evidence may be used to corroborate the victims allegation that otherwise would be inadmissible during trial. Independent evidence does not include the opinions of mental health professionals.
(4)(A)In a criminal investigation involving any of the crimes listed in paragraph (1) committed against a child, when the applicable limitations period has not expired, that period shall be tolled from the time a party initiates litigation challenging a grand jury subpoena until the end of the litigation, including any associated writ or appellate proceeding, or until the final disclosure of evidence to the investigating or prosecuting agency, if that disclosure is ordered pursuant to the subpoena after the litigation.
(B)Nothing in this subdivision affects the definition or applicability of any evidentiary privilege.
(C)This subdivision shall not apply where a court finds that the grand jury subpoena was issued or caused to be issued in bad faith.
(g)(1)Notwithstanding any other limitation of time described in this chapter, a criminal complaint may be filed within one year of the date on which the identity of the suspect is conclusively established by DNA testing, if both of the following conditions are met:
(A)The crime is one that is described in subdivision (c) of Section 290.
(B)The offense was committed prior to January 1, 2001, and biological evidence collected in connection with the offense is analyzed for DNA type no later than January 1, 2004, or the offense was committed on or after January 1, 2001, and biological evidence collected in connection with the offense is analyzed for DNA type no later than two years from the date of the offense.
(2)For purposes of this section, DNA means deoxyribonucleic acid.
(h)For any crime, the proof of which depends substantially upon evidence that was seized under a warrant, but which is unavailable to the prosecuting authority under the procedures described in People v. Superior Court (Laff) (2001) 25 Cal.4th 703, People v. Superior Court (Bauman & Rose) (1995) 37 Cal.App.4th 1757, or subdivision (c) of Section 1524, relating to claims of evidentiary privilege or attorney work product, the limitation of time prescribed in this chapter shall be tolled from the time of the seizure until final disclosure of the evidence to the prosecuting authority. Nothing in this section otherwise affects the definition or applicability of any evidentiary privilege or attorney work product.
(i)Notwithstanding any other limitation of time described in this chapter, a criminal complaint may be filed within one year of the date on which a hidden recording is discovered related to a violation of paragraph (2) or (3) of subdivision (j) of Section 647.
(j)Notwithstanding any other limitation of time described in this chapter, if a person flees the scene of an accident that caused death or permanent, serious injury, as defined in subdivision (d) of Section 20001 of the Vehicle Code, a criminal complaint brought pursuant to paragraph (2) of subdivision (b) of Section 20001 of the Vehicle Code may be filed within the applicable time period described in Section 801 or 802 or one year after the person is initially identified by law enforcement as a suspect in the commission of the offense, whichever is later, but in no case later than six years after the commission of the offense.
(k)Notwithstanding any other limitation of time described in this chapter, a criminal complaint alleging a violation described in subdivision (l) of Section 502 may be filed within one year of the date on which the alleged violation is discovered.
(k)(1)A limitation of time prescribed in this chapter for an offense described in subdivision (c) of Section 502 for which it is alleged the defendant acquired, copied, or distributed one or more digital images of a person that displays an intimate body part of the person shall not commence to run until the discovery of the offense.
(2)As used in this subdivision, intimate body part means any portion of the genitals, the anus, and in the case of a female also includes any portion of the breasts below the top of the areola, that is either uncovered or clearly visible through clothing.
(3)As used in this subdivision, digital images of a person do not include representational images, artwork, or cartoon drawings.
(a)It is the intent of the Legislature in enacting this section to expand the degree of protection afforded to individuals, businesses, and governmental agencies from tampering, interference, damage, and unauthorized access to lawfully created computer data and computer systems. The Legislature finds and declares that the proliferation of computer technology has resulted in a concomitant proliferation of computer crime and other forms of unauthorized access to computers, computer systems, and computer data.
The Legislature further finds and declares that protection of the integrity of all types and forms of lawfully created computers, computer systems, and computer data is vital to the protection of the privacy of individuals as well as to the well-being of financial institutions, business concerns, governmental agencies, and others within this state that lawfully utilize those computers, computer systems, and data.
(b)For the purposes of this section, the following terms have the following meanings:
(1)Access means to gain entry to, instruct, cause input to, cause output from, cause data processing with, or communicate with, the logical, arithmetical, or memory function resources of a computer, computer system, or computer network.
(2)Computer network means any system that provides communications between one or more computer systems and input/output devices including, but not limited to, display terminals, remote systems, mobile devices, and printers connected by telecommunication facilities.
(3)Computer program or software means a set of instructions or statements, and related data, that when executed in actual or modified form, cause a computer, computer system, or computer network to perform specified functions.
(4)Computer services includes, but is not limited to, computer time, data processing, or storage functions, Internet services, electronic mail services, electronic message services, or other uses of a computer, computer system, or computer network.
(5)Computer system means a device or collection of devices, including support devices and excluding calculators that are not programmable and capable of being used in conjunction with external files, one or more of which contain computer programs, electronic instructions, input data, and output data, that performs functions including, but not limited to, logic, arithmetic, data storage and retrieval, communication, and control.
(6)Government computer system means any computer system, or part thereof, that is owned, operated, or used by any federal, state, or local governmental entity.
(7)Public safety infrastructure computer system means any computer system, or part thereof, that is necessary for the health and safety of the public including computer systems owned, operated, or used by drinking water and wastewater treatment facilities, hospitals, emergency service providers, telecommunication companies, and gas and electric utility companies.
(8)Data means a representation of information, knowledge, facts, concepts, computer software, computer programs or instructions. Data may be in any form, in storage media, or as stored in the memory of the computer or in transit or presented on a display device.
(9)Supporting documentation includes, but is not limited to, all information, in any form, pertaining to the design, construction, classification, implementation, use, or modification of a computer, computer system, computer network, computer program, or computer software, which information is not generally available to the public and is necessary for the operation of a computer, computer system, computer network, computer program, or computer software.
(10)Injury means any alteration, deletion, damage, or destruction of a computer system, computer network, computer program, or data caused by the access, or the denial of access to legitimate users of a computer system, network, or program.
(11)Victim expenditure means any expenditure reasonably and necessarily incurred by the owner or lessee to verify that a computer system, computer network, computer program, or data was or was not altered, deleted, damaged, or destroyed by the access.
(12)Computer contaminant means any set of computer instructions that are designed to modify, damage, destroy, record, or transmit information within a computer, computer system, or computer network without the intent or permission of the owner of the information. They include, but are not limited to, a group of computer instructions commonly called viruses or worms, that are self-replicating or self-propagating and are designed to contaminate other computer programs or computer data, consume computer resources, modify, destroy, record, or transmit data, or in some other fashion usurp the normal operation of the computer, computer system, or computer network.
(13)Internet domain name means a globally unique, hierarchical reference to an Internet host or service, assigned through centralized Internet naming authorities, comprising a series of character strings separated by periods, with the rightmost character string specifying the top of the hierarchy.
(14)Electronic mail means an electronic message or computer file that is transmitted between two or more telecommunications devices; computers; computer networks, regardless of whether the network is a local, regional, or global network; or electronic devices capable or receiving electronic messages, regardless of whether the message is converted to hard copy format after receipt, viewed upon transmission, or stored for later retrieval.
(15)Profile means either of the following:
(A)A configuration of user data required by a computer so that the user may access programs or services and have the desired functionality on that computer.
(B)An Internet Web site users personal page or section of a page that is made up of data, in text of graphical form, that displays significant, unique, or identifying information, including, but not limited to, listing acquaintances, interests, associations, activities, or personal statements.
(c)Except as provided in subdivision (h), any person who commits any of the following acts is guilty of a public offense:
(1)Knowingly accesses and without permission alters, damages, deletes, destroys, or otherwise uses any data, computer, computer system, or computer network in order to either (A) devise or execute any scheme or artifice to defraud, deceive, or extort, or (B) wrongfully control or obtain money, property, or data.
(2)Knowingly accesses and without permission takes, copies, or makes use of any data from a computer, computer system, or computer network, or takes or copies any supporting documentation, whether existing or residing internal or external to a computer, computer system, or computer network.
(3)Knowingly and without permission uses or causes to be used computer services.
(4)Knowingly accesses and without permission adds, alters, damages, deletes, or destroys any data, computer software, or computer programs which reside or exist internal or external to a computer, computer system, or computer network.
(5)Knowingly and without permission disrupts or causes the disruption of computer services or denies or causes the denial of computer services to an authorized user of a computer, computer system, or computer network.
(6)Knowingly and without permission provides or assists in providing a means of accessing a computer, computer system, or computer network in violation of this section.
(7)Knowingly and without permission accesses or causes to be accessed any computer, computer system, or computer network.
(8)Knowingly introduces any computer contaminant into any computer, computer system, or computer network.
(9)Knowingly and without permission uses the Internet domain name or profile of another individual, corporation, or entity in connection with the sending of one or more electronic mail messages or posts and thereby damages or causes damage to a computer, computer data, computer system, or computer network.
(10)Knowingly and without permission disrupts or causes the disruption of government computer services or denies or causes the denial of government computer services to an authorized user of a government computer, computer system, or computer network.
(11)Knowingly accesses and without permission adds, alters, damages, deletes, or destroys any data, computer software, or computer programs which reside or exist internal or external to a public safety infrastructure computer system computer, computer system, or computer network.
(12)Knowingly and without permission disrupts or causes the disruption of public safety infrastructure computer system computer services or denies or causes the denial of computer services to an authorized user of a public safety infrastructure computer system computer, computer system, or computer network.
(13)Knowingly and without permission provides or assists in providing a means of accessing a computer, computer system, or public safety infrastructure computer system computer, computer system, or computer network in violation of this section.
(14)Knowingly introduces any computer contaminant into any public safety infrastructure computer system computer, computer system, or computer network.
(d)(1)Any person who violates any of the provisions of paragraph (1), (2), (4), (5), (10), (11), or (12) of subdivision (c) is punishable by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment pursuant to subdivision (h) of Section 1170 for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
(2)Any person who violates paragraph (3) of subdivision (c) is punishable as follows:
(A)For the first violation that does not result in injury, and where the value of the computer services used does not exceed nine hundred fifty dollars ($950), by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
(B)For any violation that results in a victim expenditure in an amount greater than five thousand dollars ($5,000) or in an injury, or if the value of the computer services used exceeds nine hundred fifty dollars ($950), or for any second or subsequent violation, by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment pursuant to subdivision (h) of Section 1170 for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
(3)Any person who violates paragraph (6), (7), or (13) of subdivision (c) is punishable as follows:
(A)For a first violation that does not result in injury, an infraction punishable by a fine not exceeding one thousand dollars ($1,000).
(B)For any violation that results in a victim expenditure in an amount not greater than five thousand dollars ($5,000), or for a second or subsequent violation, by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
(C)For any violation that results in a victim expenditure in an amount greater than five thousand dollars ($5,000), by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment pursuant to subdivision (h) of Section 1170 for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
(4)Any person who violates paragraph (8) or (14) of subdivision (c) is punishable as follows:
(A)For a first violation that does not result in injury, a misdemeanor punishable by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
(B)For any violation that results in injury, or for a second or subsequent violation, by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment in a county jail not exceeding one year, or by imprisonment pursuant to subdivision (h) of Section 1170, or by both that fine and imprisonment.
(5)Any person who violates paragraph (9) of subdivision (c) is punishable as follows:
(A)For a first violation that does not result in injury, an infraction punishable by a fine not exceeding one thousand dollars ($1,000).
(B)For any violation that results in injury, or for a second or subsequent violation, by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
(e)(1)In addition to any other civil remedy available, the owner or lessee of the computer, computer system, computer network, computer program, or data who suffers damage or loss by reason of a violation of any of the provisions of subdivision (c) may bring a civil action against the violator for compensatory damages and injunctive relief or other equitable relief. Compensatory damages shall include any expenditure reasonably and necessarily incurred by the owner or lessee to verify that a computer system, computer network, computer program, or data was or was not altered, damaged, or deleted by the access. For the purposes of actions authorized by this subdivision, the conduct of an unemancipated minor shall be imputed to the parent or legal guardian having control or custody of the minor, pursuant to the provisions of Section 1714.1 of the Civil Code.
(2)In any action brought pursuant to this subdivision the court may award reasonable attorneys fees.
(3)A community college, state university, or academic institution accredited in this state is required to include computer-related crimes as a specific violation of college or university student conduct policies and regulations that may subject a student to disciplinary sanctions up to and including dismissal from the academic institution. This paragraph shall not apply to the University of California unless the Board of Regents adopts a resolution to that effect.
(4)In any action brought pursuant to this subdivision for a willful violation of the provisions of subdivision (c), where it is proved by clear and convincing evidence that a defendant has been guilty of oppression, fraud, or malice as defined in subdivision (c) of Section 3294 of the Civil Code, the court may additionally award punitive or exemplary damages.
(5)No action may be brought pursuant to this subdivision unless it is initiated within three years of the date of the act complained of, or the date of the discovery of the damage, whichever is later.
(f)This section shall not be construed to preclude the applicability of any other provision of the criminal law of this state which applies or may apply to any transaction, nor shall it make illegal any employee labor relations activities that are within the scope and protection of state or federal labor laws.
(g)Any computer, computer system, computer network, or any software or data, owned by the defendant, that is used during the commission of any public offense described in subdivision (c) or any computer, owned by the defendant, which is used as a repository for the storage of software or data illegally obtained in violation of subdivision (c) shall be subject to forfeiture, as specified in Section 502.01.
(h)(1)Subdivision (c) does not apply to punish any acts which are committed by a person within the scope of his or her lawful employment. For purposes of this section, a person acts within the scope of his or her employment when he or she performs acts which are reasonably necessary to the performance of his or her work assignment.
(2)Paragraph (3) of subdivision (c) does not apply to penalize any acts committed by a person acting outside of his or her lawful employment, provided that the employees activities do not cause an injury, to the employer or another, or provided that the value of supplies or computer services which are used does not exceed an accumulated total of two hundred fifty dollars ($250).
(i)No activity exempted from prosecution under paragraph (2) of subdivision (h) which incidentally violates paragraph (2), (4), or (7) of subdivision (c) shall be prosecuted under those paragraphs.
(j)For purposes of bringing a civil or a criminal action under this section, a person who causes, by any means, the access of a computer, computer system, or computer network in one jurisdiction from another jurisdiction is deemed to have personally accessed the computer, computer system, or computer network in each jurisdiction.
(k)In determining the terms and conditions applicable to a person convicted of a violation of this section the court shall consider the following:
(1)The court shall consider prohibitions on access to and use of computers.
(2)Except as otherwise required by law, the court shall consider alternate sentencing, including community service, if the defendant shows remorse and recognition of the wrongdoing, and an inclination not to repeat the offense.
(l)(1)A person who commits a violation of this section that involves acquiring, copying, or distributing one or more digital images of a person that displays an intimate body part of the person is subject to a fine not exceeding ten thousand dollars ($10,000) per each image acquired, copied, or distributed.
(2)A fine imposed pursuant to this subdivision is in addition to any other penalty or punishment provided for conduct that violates this subdivision.
(3)A fine pursuant to this subdivision may be imposed only pursuant to an action brought by a district attorney.
(4)As used in this subdivision, intimate body part means any portion of the genitals, the anus, and in the case of a female also includes any portion of the breasts below the top of the areola, that is either uncovered or clearly visible through clothing.
SEC. 2.Section 803 of the Penal Code is amended to read:803.(a)Except as provided in this section, a limitation of time prescribed in this chapter is not tolled or extended for any reason.
(b)No time during which prosecution of the same person for the same conduct is pending in a court of this state is a part of a limitation of time prescribed in this chapter.
(c)A limitation of time prescribed in this chapter does not commence to run until the discovery of an offense described in this subdivision. This subdivision applies to an offense punishable by imprisonment in the state prison or imprisonment pursuant to subdivision (h) of Section 1170, a material element of which is fraud or breach of a fiduciary obligation, the commission of the crimes of theft or embezzlement upon an elder or dependent adult, or the basis of which is misconduct in office by a public officer, employee, or appointee, including, but not limited to, the following offenses:
(1)Grand theft of any type, forgery, falsification of public records, or acceptance of a bribe by a public official or a public employee.
(2)A violation of Section 72, 118, 118a, 132, 134, or 186.10.
(3)A violation of Section 25540, of any type, or Section 25541 of the Corporations Code.
(4)A violation of Section 1090 or 27443 of the Government Code.
(5)Felony welfare fraud or Medi-Cal fraud in violation of Section 11483 or 14107 of the Welfare and Institutions Code.
(6)Felony insurance fraud in violation of Section 548 or 550 of this code or former Section 1871.1, or Section 1871.4, Section 1871.4 of the Insurance Code.
(7)A violation of Section 580, 581, 582, 583, or 584 of the Business and Professions Code.
(8)A violation of Section 22430 of the Business and Professions Code.
(9)A violation of Section 103800 of the Health and Safety Code.
(10)A violation of Section 529a.
(11)A violation of subdivision (d) or (e) of Section 368.
(d)If the defendant is out of the state when or after the offense is committed, the prosecution may be commenced as provided in Section 804 within the limitations of time prescribed by this chapter, and no time up to a maximum of three years during which the defendant is not within the state shall be a part of those limitations.
(e)A limitation of time prescribed in this chapter does not commence to run until the offense has been discovered, or could have reasonably been discovered, with regard to offenses under Division 7 (commencing with Section 13000) of the Water Code, under Chapter 6.5 (commencing with Section 25100) of, Chapter 6.7 (commencing with Section 25280) of, or Chapter 6.8 (commencing with Section 25300) of, Division 20 of, or Part 4 (commencing with Section 41500) of Division 26 of, the Health and Safety Code, or under Section 386, or offenses under Chapter 5 (commencing with Section 2000) of Division 2 of, Chapter 9 (commencing with Section 4000) of Division 2 of, Section 6126 of, Chapter 10 (commencing with Section 7301) of Division 3 of, or Chapter 19.5 (commencing with Section 22440) of Division 8 of, the Business and Professions Code.
(f)(1)Notwithstanding any other limitation of time described in this chapter, a criminal complaint may be filed within one year of the date of a report to a California law enforcement agency by a person of any age alleging that he or she, while under the age of 18 years, was the victim of a crime described in Section 261, 286, 288, 288a, 288.5, or 289, or Section 289.5, as enacted by Chapter 293 of the Statutes of 1991 relating to penetration by an unknown object. 289.
(2)This subdivision applies only if all of the following occur:
(A)The limitation period specified in Section 800, 801, or 801.1, whichever is later, has expired.
(B)The crime involved substantial sexual conduct, as described in subdivision (b) of Section 1203.066, excluding masturbation that is not mutual.
(C)There is independent evidence that corroborates the victims allegation. If the victim was 21 years of age or older at the time of the report, the independent evidence shall clearly and convincingly corroborate the victims allegation.
(3)No evidence may be used to corroborate the victims allegation that otherwise would be inadmissible during trial. Independent evidence does not include the opinions of mental health professionals.
(4)(A)In a criminal investigation involving any of the crimes listed in paragraph (1) committed against a child, when the applicable limitations period has not expired, that period shall be tolled from the time a party initiates litigation challenging a grand jury subpoena until the end of the litigation, including any associated writ or appellate proceeding, or until the final disclosure of evidence to the investigating or prosecuting agency, if that disclosure is ordered pursuant to the subpoena after the litigation.
(B)Nothing in this subdivision affects the definition or applicability of any evidentiary privilege.
(C)This subdivision shall not apply where a court finds that the grand jury subpoena was issued or caused to be issued in bad faith.
(g)(1)Notwithstanding any other limitation of time described in this chapter, a criminal complaint may be filed within one year of the date on which the identity of the suspect is conclusively established by DNA testing, if both of the following conditions are met:
(A)The crime is one that is described in subdivision (c) of Section 290.
(B)The offense was committed prior to January 1, 2001, and biological evidence collected in connection with the offense is analyzed for DNA type no later than January 1, 2004, or the offense was committed on or after January 1, 2001, and biological evidence collected in connection with the offense is analyzed for DNA type no later than two years from the date of the offense.
(2)For purposes of this section, DNA means deoxyribonucleic acid.
(h)For any crime, the proof of which depends substantially upon evidence that was seized under a warrant, but which is unavailable to the prosecuting authority under the procedures described in People v. Superior Court (Laff) (2001) 25 Cal.4th 703, People v. Superior Court (Bauman & Rose) (1995) 37 Cal.App.4th 1757, or subdivision (c) of Section 1524, relating to claims of evidentiary privilege or attorney work product, the limitation of time prescribed in this chapter shall be tolled from the time of the seizure until final disclosure of the evidence to the prosecuting authority. Nothing in this section otherwise affects the definition or applicability of any evidentiary privilege or attorney work product.
(i)Notwithstanding any other limitation of time described in this chapter, a criminal complaint may be filed within one year of the date on which a hidden recording is discovered related to a violation of paragraph (2) or (3) of subdivision (j) of Section 647.
(j)Notwithstanding any other limitation of time described in this chapter, if a person flees the scene of an accident that caused death or permanent, serious injury, as defined in subdivision (d) of Section 20001 of the Vehicle Code, a criminal complaint brought pursuant to paragraph (2) of subdivision (b) of Section 20001 of the Vehicle Code may be filed within the applicable time period described in Section 801 or 802 or one year after the person is initially identified by law enforcement as a suspect in the commission of the offense, whichever is later, but in no case later than six years after the commission of the offense.
(k)Notwithstanding any other limitation of time described in this chapter, a criminal complaint alleging a violation described in subdivision (l) of Section 502 may be filed within one year of the date on which the alleged violation is discovered.
|
Date
|
Status
|
|---|---|
| Aug 17, 2015 | Ordered to second reading. |
| Oct 8, 2015 | Chaptered by Secretary of State - Chapter 614, Statutes of 2015. |
| Oct 8, 2015 | Approved by the Governor. |
| Sep 9, 2015 | Enrolled and presented to the Governor at 4 p.m. |
| Sep 1, 2015 | Senate amendments concurred in. To Engrossing and Enrolling. (Ayes 79. Noes 0.). |
| Sep 1, 2015 | Senate amendments concurred in. To Engrossing and Enrolling. (Ayes 79. Noes 0. Page 2745.). |
| Sep 1, 2015 | Assembly Rule 77 suspended. (Page 2729.) |
| Sep 1, 2015 | Assembly Rule 77 suspended. |
| Aug 31, 2015 | Read third time. Passed. Ordered to the Assembly. (Ayes 40. Noes 0. Page 2311.). |
| Aug 31, 2015 | Read third time. Passed. Ordered to the Assembly. |
| Aug 31, 2015 | In Assembly. Concurrence in Senate amendments pending. May be considered on or after September 2 pursuant to Assembly Rule 77. |
| Aug 26, 2015 | Ordered to special consent calendar. |
| Aug 18, 2015 | Read second time. Ordered to third reading. |
| Aug 17, 2015 | Withdrawn from committee. |
| Dec 1, 2014 | Read first time. To print. |
| Aug 17, 2015 | In committee: Hearing postponed by committee. |
| Jul 15, 2015 | Read second time and amended. Re-referred to Com. on APPR. |
| Jul 14, 2015 | From committee: Amend, and do pass as amended and re-refer to Com. on APPR. (Ayes 6. Noes 0.) (July 7). |
| May 7, 2015 | Referred to Coms. on PUB. S. and APPR. |
| Apr 9, 2015 | Read third time. Passed. Ordered to the Senate. (Ayes 78. Noes 0.) |
| Apr 9, 2015 | Read third time. Passed. Ordered to the Senate. (Ayes 78. Noes 0. Page 854.) |
| Apr 9, 2015 | In Senate. Read first time. To Com. on RLS. for assignment. |
| Apr 8, 2015 | Read second time. Ordered to third reading. |
| Apr 7, 2015 | Read second time and amended. Ordered returned to second reading. |
| Apr 6, 2015 | From committee: Amend, and do pass as amended. (Ayes 7. Noes 0.) (March 24). |
| Mar 17, 2015 | In committee: Set, first hearing. Hearing canceled at the request of author. |
| Jan 22, 2015 | Referred to Com. on PUB. S. |
| Dec 2, 2014 | From printer. May be heard in committee January 1. |
|
Date
|
Description
|
Location
|
Votes
|
|
|---|---|---|---|---|
| Sep 1, 2015 | AB 32 WALDRON Concurrence in Senate Amendments | Assembly Floor |
Passed |
|
| Aug 31, 2015 | Special Consent #8 AB32 Waldron By Glazer | Senate Floor |
Passed |
|
| Jul 7, 2015 | Do pass as amended, but first amend, and re-refer to the Committee on [Appropriations] | Senate Standing Committee on Public Safety |
Passed |
|
| Apr 9, 2015 | AB 32 WALDRON Assembly Third Reading | Assembly Floor |
Passed |
|
| Mar 24, 2015 | Do pass as amended. | Assembly Standing Committee on Public Safety |
Passed |
This list shows positions taken on this bill by organizations on the date displayed, which is linked to the original source.
Positions by individuals are not included.
|
Organization
|
Position
|
Date
|
|---|---|---|
| Association For Los Angeles Deputy Sheriffs | ** Support | Sep 1, 2015 |
| Association of Deputy District Attorneys | ** Support | Sep 1, 2015 |
| California Attorneys For Criminal Justice | ** Against | Mar 24, 2015 |
| California College and University Police Chiefs | ** Support | Sep 1, 2015 |
| California Communities United Institute | ** Support | Sep 1, 2015 |
| California District Attorneys Association | ** Support | Sep 1, 2015 |
| California Police Chiefs Association | ** Support | Sep 1, 2015 |
| Los Angeles Police Protective League | ** Support | Sep 1, 2015 |
AB 32
Page 5
CONCURRENCE IN SENATE AMENDMENTS
AB 32
(Waldron)
As Amended July 15, 2015
Majority vote
ASSEMBLY: |
78-0 |
(April 9, 2015) |
SENATE: |
40-0 |
(August 31, 2015) |
Original Committee Reference: PUB. S.
SUMMARY: Increases fines for felony convictions of specified computer crimes from a maximum of $5,000, to a maximum of $10,000.
The Senate amendments:
Eliminate the increased fine for misdemeanor violations of the specified computer offenses.
Strike provisions relating to the tolling of the statute of limitations.
EXISTING LAW:
Punishes any person who knowingly and without permission uses or causes to be used computer services as follows:
For the first violation that does not result in injury, and where the value of the computer services used does not exceed $950, by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
For any violation that results in a victim expenditure in an amount greater than $5,000 or in an injury, or if the value of the computer services used exceeds $950, or for any second or subsequent violation, by a fine not exceeding $10,000, or by imprisonment for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
Punishes any person who knowingly and without permission provides or assists in providing a means of accessing a computer, computer system, or computer network as follows:
For a first violation that does not result in injury, an infraction punishable by a fine not exceeding $1,000.
For any violation that results in a victim expenditure in an amount not greater than $5,000, or for a second or subsequent violation, by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
For any violation that results in a victim expenditure in an amount greater than $5,000, by a fine not exceeding $10,000, or by imprisonment pursuant to Penal Code Section 1170 subdivision (h) for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
Punishes any person who knowingly and without permission accesses or causes to be accessed any computer, computer system, or computer network as follows:
For a first violation that does not result in injury, an infraction punishable by a fine not exceeding $1,000.
For any violation that results in a victim expenditure in an amount not greater than $5,000, or for a second or subsequent violation, by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
For any violation that results in a victim expenditure in an amount greater than $5,000, by a fine not exceeding $10,000, or by imprisonment pursuant to Penal Code Section 1170 subdivision (h) for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
Punishes any person who knowingly and without permission provides or assists in providing a means of accessing a computer, computer system, or public safety infrastructure computer system computer, computer system, or computer network as follows:
For a first violation that does not result in injury, an infraction punishable by a fine not exceeding $1,000.
For any violation that results in a victim expenditure in an amount not greater than $5,000, or for a second or subsequent violation, by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
For any violation that results in a victim expenditure in an amount greater than $5,000, by a fine not exceeding $10,000, or by imprisonment pursuant to Penal Code Section 1170 subdivision (h) for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
Punishes any person who knowingly introduces any computer contaminant into any computer, computer system, or computer network as follows:
For a first violation that does not result in injury, a misdemeanor punishable by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
For any violation that results in injury, or for a second or subsequent violation, by a fine not exceeding $10,000, or by imprisonment in a county jail not exceeding one year, or by imprisonment, or by both that fine and imprisonment.
Punishes any person who knowingly introduces any computer contaminant into any public safety infrastructure computer system computer, computer system, or computer network as follows:
For a first violation that does not result in injury, a misdemeanor punishable by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
For any violation that results in injury, or for a second or subsequent violation, by a fine not exceeding $10,000, or by imprisonment in a county jail not exceeding one year, or by imprisonment, or by both that fine and imprisonment.
Punishes any person who knowingly and without permission uses the Internet domain name or profile of another individual, corporation, or entity in connection with the sending of one or more electronic mail messages or posts and thereby damages or causes damage to a computer, computer data, computer system, or computer network.
For a first violation that does not result in injury, an infraction punishable by a fine not exceeding $1,000.
For any violation that results in injury, or for a second or subsequent violation, by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
AS PASSED BY THE ASSEMBLY, this bill:
Increased fines from a fine of up to $5,000 to a fine of up to $10,000 for the following offenses:
Knowingly access and without permission alter, damage, delete, destroy, or otherwise use any data, computer, computer system, or computer network in order to either i) devise or execute any scheme or artifice to defraud, deceive, or extort, or ii) wrongfully control or obtain money, property, or data.
Knowingly access and without permission take, copy, or make use of any data from a computer, computer system, or computer network, or take or copy any supporting documentation, whether existing or residing internal or external to a computer, computer system, or computer network.
Knowingly access and without permission add, alter, damage, delete, or destroy any data, computer software, or computer programs which reside or exist internal or external to a computer, computer system, or computer network.
Knowingly and without permission disrupt or cause the disruption of computer services or deny or cause the denial of computer services to an authorized user of a computer, computer system, or computer network.
Second or subsequent violations of knowingly and without permission provides or assists in providing a means of accessing a computer, computer system, or computer network in violation of this section.
Second or subsequent violations of knowingly and without permission accessing or causing to be accessed any computer, computer system, or computer network.
Knowingly introducing any computer contaminant into any computer, computer system, or computer network.
Second or subsequent violations of knowingly and without permission using the Internet domain name or profile of another individual, corporation, or entity in connection with the sending of one or more electronic mail messages or posts and thereby damaging or causing damage to a computer, computer data, computer system, or computer network.
Knowingly and without permission disrupting or causing the disruption of government computer services or denying or causing the denial of government computer services to an authorized user of a government computer, computer system, or computer network.
Knowingly access and without permission add, alter, damage, delete, or destroy any data, computer software, or computer programs which reside or exist internal or external to a public safety infrastructure computer system computer, computer system, or computer network.
Knowingly and without permission disrupting or causing the disruption of public safety infrastructure computer system computer services or denying or causing the denial of computer services to an authorized user of a public safety infrastructure computer system computer, computer system, or computer network.
Second or subsequent violations of knowingly and without permission providing or assisting in providing a means of accessing a computer, computer system, or public safety infrastructure computer system computer, computer system, or computer network in violation of this section.
Knowingly introducing any computer contaminant into any public safety infrastructure computer system computer, computer system, or computer network.
Provided that the statute of limitations does not commence to run until the discovery of specified computer hacking offenses in which it is alleged that the defendant acquired, copied, or distributed one or more digital images of a person that displays an intimate body part of the person. Includes the following definitions:
Defines "intimate body part" as any portion of the genitals, the anus, and in the case of a female also includes any portion of the breasts below the top of the areola, that is either uncovered or clearly visible through clothing; and
Defines "digital images of a person" as not including representational images, artwork, or cartoon drawings.
FISCAL EFFECT: Unknown. This bill is keyed non-fiscal by the Legislative Counsel.
COMMENTS: According to the author, "Cyber criminals compromise personal information for individual gain or to merely cause a disruption. This year, The California Department of Motor Vehicles computer system was hacked causing a data security breach in its credit card processing services. Existing fines are just a small sum compared to the dollar who have been violated. Ordinary computer hacking penalties do not sufficiently capture the emotional trauma and hardship that such data breach can cause. AB 32 will make crimes involving computer hacking punishable by up to $10,000 for misdemeanor offenses. It is important to keep up with the new emerging computer crimes to make sure that the violators do not go unpunished and to prevent future crimes in such circumstances."
Analysis Prepared by: Gabriel Caswell / PUB. S. / (916) 319-3744 FN: 0001577
AB 32
Page 6
|
Office of Senate Floor Analyses (916) 651-1520 Fax: (916) 327-4478 |
THIRD READING
Bill No: AB 32
Amended: 7/15/15 in Senate
SENATE PUBLIC SAFETY COMMITTEE: 6-0, 7/7/15
AYES: Hancock, Glazer, Leno, Liu, Monning, Stone
NO VOTE RECORDED: Anderson
ASSEMBLY FLOOR: 78-0, 4/9/15 - See last page for vote
DIGEST: This bill clarifies the penalty provisions for the alternate felony-misdemeanor of improperly accessing and disrupting, denying service from or taking data from a computer system.
Existing law:
Defines numerous computer or electronic data offenses and imposes a wide range of penalties based on the seriousness of the offense or extent of harm caused by the defendant, including by a fine not exceeding $10,000, by felony imprisonment pursuant to Penal Code Section 1170, subdivision (h) for a term of term of 16 months, two years or three years, or both, or by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year. These penalties apply where any person knowingly:
Accesses and without permission alters, damages, deletes, destroys, or otherwise uses any data, computer, computer system, or computer network in order to devise or execute any scheme or artifice to defraud, deceive, or extort, or wrongfully control or obtain money, property or data.
Accesses and without permission takes, copies or makes use of any data from a computer, computer system, or computer network, or takes or copies any supporting documentation, whether existing or residing internal or external to a computer, computer system, or computer network.
Accesses and without permission adds, alters, damages, deletes, or destroys any data, computer software, or computer programs which reside or exist internal or external to a computer, computer system, or computer network
Without permission, disrupts or causes the disruption of computer services or denies or causes the denial of computer services, or denies or causes the denial of computer services to an authorized user of a computer, computer system, or computer network.
Disrupts or improperly accesses a government or public safety computer system. (Pen. Code § 502, subds. (c) 1), (2), (4), (5), (10), (11), or (12); and (d)(1).)
Provides that any person who knowingly and without permission uses or causes to be used computer services shall be punished as follows:
For the first violation that does not result in injury, and where the value of the computer services used does not exceed $950, by a fine not exceeding $5,000, by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment; and
For any violation that results in a victim expenditure in an amount more than $5,000 or in an injury, if the value of the computer services used exceeds $950, or for any second or subsequent violation, by a fine not exceeding $10,000, by imprisonment pursuant to realignment for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding $5,000, by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment. (Pen. Code § 502, subds. (c)(3); and (d)(2).)
Punishes any person who knowingly and without permission provides or assists in providing a means of accessing, accesses, or causes to be accessed a computer, computer system, or computer network as follows:
A first violation that does not result in injury is an infraction punishable by a fine not exceeding $1,000.
Any violation that results in a victim expenditure in an amount not more than $5,000, or for a second or subsequent violation, is a misdemeanor, punishable by a fine not exceeding $5,000, by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment; and
Any violation that results in a victim expenditure above $5,000 is punishable by a fine not exceeding ten thousand dollars $10,000, by felony imprisonment pursuant to Penal Code Section 1170, subdivision (h), for 16 months, two or three years, or both, or by a fine not exceeding $5,000, by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment. (Pen. Code § 502, subds. (c) and (d)(3).)
Punishes any person who knowingly introduces any computer contaminant into any computer, or computer system, or computer network as follows:
A first violation that does not result in injury is a misdemeanor punishable by a fine not exceeding $5,000, by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment; and
A violation that results in injury, or a subsequent violation, is punishable by a fine not exceeding $10,000, by imprisonment in a county jail not exceeding one year, or by imprisonment pursuant Penal Code Section 1170, subdivision (h), or both that fine and imprisonment. (Pen. Code § 502 subds. (c)(14) and (d)(4).)
Punishes any person who knowingly and without permission uses the Internet domain name of another individual, corporation, or entity in connection with the sending of one or more electronic mail messages, and thereby damages or causes damage to a computer, computer system, or computer network as follows:
For a first violation that does not result in injury, an infraction punishable by a fine not more than $1,000; and
For any violation that results in injury, or for a second or subsequent violation, by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment. (Pen. Code § 502, subds. (c)(9) and (d)(5).)
This bill defines specified computer and data access and harm crimes as standard alternate-felony misdemeanors, with a maximum misdemeanor fine of $5,000. Specifically, the bill provides that these offenses are punishable as a felony for a term of 16 months, two years or three years and a fine of up to $10,000; and punishable as a misdemeanor by a jail term of up to one year, a fine of up to $5,000, or both a jail term and the fine.
Background
The existing fine structure for crimes involving unauthorized access and harm to computers and data is unusual and confusing. The following is a representative example:
(C) For any violation that results in a victim expenditure in an amount greater than five thousand dollars ($5,000), by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment pursuant to subdivision (h) of Section 1170 for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding five ten thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment. (Pen. Code § 502, subd. (d)(3)(C).)
This appears to describe an alternate felony-misdemeanor (wobbler) in two ways: 1) by including two separate maximum fines ($10,000 or $5,000) as stand-alone penalties, and 2) providing that the court can sentence the defendant to a felony sentence pursuant to Penal Code 1170, subdivision (h) or impose a misdemeanor jail term of up to a year.
Penal Code Section 17, subdivision (b), defines an alternate felony-misdemeanor, or wobbler. In relevant part, Section 17 provides:
(b) When a crime is punishable, in the discretion of the court, either by imprisonment in the state prison or imprisonment in a county jail under the provisions of subdivision (h) of Section 1170, or by fine or imprisonment in the county jail, it is a misdemeanor for all purposes under the following circumstances:
(1) After a judgment imposing a punishment other than imprisonment in the state prison or imprisonment in a county jail under the provisions of subdivision (h) of Section 1170.
Applying Penal Code Section 17, subdivision (b), to the computer crimes covered by this bill, the sentencing court could impose a fine of up to $10,000, with no felony jail or prison term and the offense would, by definition, be a misdemeanor.
The court could impose a felony jail or prison sentence and no fine, and the offense would be a felony. The court could impose a felony jail or prison term and a fine of up to $10,000 and the offense would be a felony. Simply stating that a crime is a felony punishable pursuant to Section 1170, subdivision (h), means that the defendant is subject to a sentence of16 months, two years or three years and a fine of up to $10,000. There is thus no need to specify that the maximum felony fine for a violation of Section 502 is $10,000.
It is most likely that an appellate court would find that the maximum fine for a misdemeanor under existing law $5,000, as the misdemeanor jail term is described in conjunction with a fine of up to $5,000. However, it can also be argued that the court could impose a fine of up to $10,000 and a misdemeanor jail term. As noted above, if a crime is punishable by a fine alone, it is a wobbler. If the court punishes the defendant by a county jail term, but not pursuant to Section 1170, subdivision (h), the offense is a misdemeanor
Senate Public Safety Committee staff has found no appellate cases discussing the fine structure in Penal Code Section 502. This bill clarifies the confusing the penalty provisions in Penal Code Section 502, subdivision (d). The bill, however, does not address similar or equivalent penalty provisions in other subdivisions of Penal Code Section 502. The application of these provisions by the courts will allow the Legislature to compare both penalty provision forms in practice.
FISCAL EFFECT: Appropriation: No Fiscal Com.: No Local: No
Association of Deputy District Attorneys
Association for Los Angeles Deputy Sheriffs
California College and University Police Chiefs
California Communities United Institute
California District Attorneys Association
California Police Chiefs Association
Los Angeles Police Protective League
Riverside Sheriffs Association
OPPOSITION: (Verified 8/18/15)
None received
ASSEMBLY FLOOR: 78-0, 4/9/15
AYES: Achadjian, Alejo, Travis Allen, Baker, Bigelow, Bloom, Bonilla, Bonta, Brough, Brown, Burke, Campos, Chang, Chau, Chávez, Chiu, Chu, Cooley, Cooper, Dababneh, Dahle, Daly, Dodd, Eggman, Frazier, Beth Gaines, Gallagher, Cristina Garcia, Eduardo Garcia, Gatto, Gipson, Gomez, Gonzalez, Gordon, Gray, Grove, Hadley, Harper, Roger Hernández, Holden, Irwin, Jones, Jones-Sawyer, Kim, Lackey, Levine, Linder, Lopez, Low, Maienschein, Mathis, Mayes, McCarty, Medina, Melendez, Mullin, Nazarian, Obernolte, Olsen, Patterson, Perea, Quirk, Rendon, Ridley-Thomas, Rodriguez, Salas, Santiago, Steinorth, Mark Stone, Thurmond, Ting, Wagner, Waldron, Weber, Wilk, Williams, Wood, Atkins
NO VOTE RECORDED: Calderon, O'Donnell
Prepared by: Jerome McGuire / PUB. S. /
8/19/15 20:54:40
**** END ****
AB 32 (Waldron ) Page 10 of 10
SENATE COMMITTEE ON PUBLIC SAFETY
Senator Loni Hancock, Chair
2015 - 2016 Regular
Bill No: AB 32 Hearing Date: July 7, 2015
Author: |
Waldron |
||
Version: |
April 7, 2015 |
||
Urgency: |
No |
Fiscal: |
No |
Consultant: |
JM |
||
Subject: Computer Crimes
HISTORY
Source: Author
Prior Legislation: SB 1255
(Cannella) – Ch. 863, Stats. 2014
AB 1649 (Waldron) – Ch.
379, Statutes of 2014
SB 255 (Canella) – Ch. 466, Statutes of
2013
Support: Association of Deputy District Attorneys; Association for Los Angeles Deputy Sheriffs; California College and University Police Chiefs; California Communities United Institute; California District Attorneys Association; California Police Chiefs Association; Los Angeles Police Protective League; Riverside Sheriffs Association
Opposition: California Attorneys for Criminal Justice
Assembly Floor Vote: 78 - 0
PURPOSE
The purpose of this bill is to: 1) raise the maximum misdemeanor fines for computer access, use and damage crimes from $5,000 to $10,000; and 2) provide that the statute of limitations for any computer access, use or damage crime runs from the date of discovery if it is alleged that the defendant acquired, copied or distributed an image of sexual or intimate nature.
Existing law:
Defines numerous computer or electronic data offenses and imposes a wide range of penalties based on the seriousness of the offense or extent of harm caused by the defendant, including by a fine not exceeding $10,000, by felony imprisonment pursuant to Penal Code Section 1170, subdivision (h) for a term of term of 16 months, two years or three years, or both, or by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year. These penalties apply where any person knowingly:
Accesses and without permission alters, damages, deletes, destroys, or otherwise uses any data, computer, computer system, or computer network in order to devise or execute any scheme or artifice to defraud, deceive, or extort, or wrongfully control or obtain money, property or data.
Accesses and without permission takes, copies or makes use of any data from a computer, computer system, or computer network, or takes or copies any supporting documentation, whether existing or residing internal or external to a computer, computer system, or computer network.
Accesses and without permission adds, alters, damages, deletes, or destroys any data, computer software, or computer programs which reside or exist internal or external to a computer, computer system, or computer network
Without permission, disrupts or causes the disruption of computer services or denies or causes the denial of computer services, or denies or causes the denial of computer services to an authorized user of a computer, computer system, or computer network.
Disrupts or improperly accesses a government or public safety computer system. (Pen. Code § 502, subds. (c) 1), (2), (4), (5), (10), (11), or (12); and (d)(1).)
Provides that any person who knowingly and without permission uses or causes to be used computer services shall be punished as follows:
For the first violation that does not result in injury, and where the value of the computer services used does not exceed $950, by a fine not exceeding $5,000, by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment; and
For any violation that results in a victim expenditure in an amount more than $5,000 or in an injury, if the value of the computer services used exceeds $950, or for any second or subsequent violation, by a fine not exceeding $10,000, by imprisonment pursuant to realignment for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding $5,000, by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment. (Pen. Code § 502, subds. (c)(3); and (d)(2).)
Punishes any person who knowingly and without permission provides or assists in providing a means of accessing, accesses, or causes to be accessed a computer, computer system, or computer network as follows:
A first violation that does not result in injury is an infraction punishable by a fine not exceeding $1,000.
Any violation that results in a victim expenditure in an amount not more than $5,000, or for a second or subsequent violation, is a misdemeanor, punishable by a fine not exceeding $5,000, by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment; and
Any violation that results in a victim expenditure above $5,000 is punishable by a fine not exceeding ten thousand dollars $10,000, by felony imprisonment pursuant to Penal Code Section 1170, subdivision (h), for 16 months, two or three years, or both, or by a fine not exceeding $5,000, by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment. (Pen. Code § 502, subds. (c) and (d)(3).)
Punishes any person who knowingly introduces any computer contaminant into any computer, or computer system, or computer network as follows:
A first violation that does not result in injury is a misdemeanor punishable by a fine not exceeding $5,000, by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment; and
A violation that results in injury, or a subsequent violation, is punishable by a fine not exceeding $10,000, by imprisonment in a county jail not exceeding one year, or by imprisonment pursuant Penal Code Section 1170, subdivision (h), or both that fine and imprisonment. (Pen. Code § 502 subds. (c)(14) and (d)(4).)
Punishes any person who knowingly and without permission uses the Internet domain name of another individual, corporation, or entity in connection with the sending of one or more electronic mail messages, and thereby damages or causes damage to a computer, computer system, or computer network as follows:
For a first violation that does not result in injury, an infraction punishable by a fine not more than $1,000; and
For any violation that results in injury, or for a second or subsequent violation, by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment. (Pen. Code § 502, subds. (c)(9) and (d)(5).)
Requires that prosecution for a felony - an offense punishable by imprisonment in the state prison or county jail pursuant to Penal Code Section 1170, subdivision (h) - be commenced within three years after commission of the offense, except as specified. (Penal Code, § 801.)
Requires that prosecution for an offense punishable by imprisonment in the state prison or county jail pursuant to realignment be commenced within three years after commission of the offense, except as specified. (Penal Code, § 801.)
States that, unless specified, prosecution for an offense not punishable by death or imprisonment in state prison shall be commenced within one year after commission of the offense. (Penal Code § 802.)
Provides that the statute of limitations for identity theft (Pen. Code § 530.5) or procuring or offering false instruments to be filed in a public officer (Pen. Code § 115) does not commence to run until the discovery of the offense. (Pen. Code § 803.5.)
Provides that unless provided, as specified, a limitation of time is not tolled or extended for any reason. (Penal Code § 803, subd. (a).)
Provides that if more than statute of limitations period applies to a crime, the time for commencing an action shall be governed by the period that expires later in time. (Penal Code § 803.6, subd. (a).)
This bill:
Increases the maximum fines from $5,000 to $10,000 in the misdemeanor crimes described above in “Existing law” involving computer and computer system access, use, disruption, damage or alteration, unless the current misdemeanor fine is $10,000.
Provides where it is alleged that in the commission of a computer access, use, damage or alteration crime (Pen. Code § 502), the defendant acquired, copied, or distributed at least one digital image that displays a person’s intimate body part, the statute of limitations does not begin
to run until the discovery of the crime involving access, use, disruption, damage or alteration to or of a computer or computer system.
Provides the following definitions for the purpose of this special statute tolling the statute of limitations until the crime is discovered
“Intimate body part” means any portion of the genitals, the anus, and in the case of a female also includes any portion of the breasts below the top of the areola, that is either uncovered or clearly visible through clothing; and
“Digital images of a person” do not include representational images, artwork, or cartoon drawings.
RECEIVERSHIP/OVERCROWDING CRISIS AGGRAVATION
For the past eight years, this Committee has scrutinized legislation referred to its jurisdiction for any potential impact on prison overcrowding. Mindful of the United States Supreme Court ruling and federal court orders relating to the state’s ability to provide a constitutional level of health care to its inmate population and the related issue of prison overcrowding, this Committee has applied its “ROCA” policy as a content-neutral, provisional measure necessary to ensure that the Legislature does not erode progress in reducing prison overcrowding.
On February 10, 2014, the federal court ordered California to reduce its in-state adult institution population to 137.5% of design capacity by February 28, 2016, as follows:
143% of design bed capacity by June 30, 2014;
141.5% of design bed capacity by February 28, 2015; and,
137.5% of design bed capacity by February 28, 2016.
In February of this year the administration reported that as “of February 11, 2015, 112,993 inmates were housed in the State’s 34 adult institutions, which amounts to 136.6% of design bed capacity, and 8,828 inmates were housed in out-of-state facilities. This current population is now below the court-ordered reduction to 137.5% of design bed capacity.”( Defendants’ February 2015 Status Report In Response To February 10, 2014 Order, 2:90-cv-00520 KJM DAD PC, 3-Judge Court, Coleman v. Brown, Plata v. Brown (fn. omitted).
While significant gains have been made in reducing the prison population, the state now must stabilize these advances and demonstrate to the federal court that California has in place the “durable solution” to prison overcrowding “consistently demanded” by the court. (Opinion Re: Order Granting in Part and Denying in Part Defendants’ Request For Extension of December 31, 2013 Deadline, NO. 2:90-cv-0520 LKK DAD (PC), 3-Judge Court, Coleman v. Brown, Plata v. Brown (2-10-14). The Committee’s consideration of bills that may impact the prison population therefore will be informed by the following questions:
Whether a proposal erodes a measure which has contributed to reducing the prison population;
Whether a proposal addresses a major area of public safety or criminal activity for which there is no other reasonable, appropriate remedy;
Whether a proposal addresses a crime which is directly dangerous to the physical safety of others for which there is no other reasonably appropriate sanction;
Whether a proposal corrects a constitutional problem or legislative drafting error; and
Whether a proposal proposes penalties which are proportionate, and cannot be achieved through any other reasonably appropriate remedy.
COMMENTS
Need for This Bill
According to the author:
Recent media has highlighted the increasing number of computer crimes that involve stealing intimate photos and also publishing them on the internet which emphasizes the public’s vulnerability to this kind of exploitation. Conventional computer hacking penalties do not sufficiently capture the emotional trauma that crimes including acquiring, copying, or distributing unauthorized intimate images can cause. AB 32 will make such crimes punishable by a fine of up to $10,000 per image. The bill will establish that a person who commits such offense will not be able to evade prosecution by delaying release of the stolen images. AB 32 will also allow for a criminal prosecution within one year of when the crime was discovered. It is important to keep up with the new emerging computer crimes to make sure that the violators do not go unpunished and to prevent future crimes in such circumstances.
Penalty Assessments Effectively Quadruple any Criminal Fine
With very limited exceptions, all criminal fines are subject to “penalty assessments” that effectively quadruple the amount the defendant must actually pay. Simply put, if a criminal statute provides that the fine for the offense is $100, the defendant will pay more than $400. The court cannot relieve a defendant of the obligation to pay penalty assessments. Further, a defendant in every criminal case must pay a restitution fine that is deposited into the Restitution Fund that is used to reimburse victims of violent crime for specified expenses. The restitution fine for a misdemeanor is from $150 to $1,000. The fine for a felony is $300 to $10,000. The court cannot relieve a defendant of the obligation to pay a restitution fine.
The following chart breaks down the distribution of a Base Fine (the Fine stated in the Statute) and Penalty Assessments
-
Base Fine:
$10,000.00
Penal Code § 1464 assessment ($10 for every $10):
$10,000.00
Penal Code § 1465.7 assessment (20% surcharge):
$2,000.00
Penal Code § 1465.8 assessment ($40 per criminal offense):
$40.00
Government Code § 70372 assessment ($5 for every $10):
$5,000.00
Government Code § 70373 assessment ($30 for felony or misdemeanor offense):
$30.00
Government Code § 76000 assessment ($7 for every $10):
$7,000.00
Government Code § 76000.5 assessment ($2 for every $10):
$2,000.00
Government Code § 76104.6 assessment ($1 for every $10):
$1,000.00
Government Code § 76104.7 assessment ($4 for every $10):
$4,000.00
Fine with Assessments:
$41,070.00
Other fees and costs apply, including reimbursement to the county for court-appointed counsel. Large criminal fines may be difficult to collect, as collection could take years of effort and expense. The estimated amount of uncollected court ordered debt in 2011 was $10.2 billion.1
Confusing Fine Structure in This Bill and Existing Law
The purpose of this bill is to increase the maximum misdemeanor fines for unauthorized use or alteration of, or unauthorized access or damage to a computer or computer services from $5,000 to $10,000. The existing fine structure is unusual and confusing. The following is a representative example:
(C) For any violation that results in a victim expenditure in an amount greater than five thousand dollars ($5,000), by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment pursuant to subdivision (h) of Section 1170 for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding five ten thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment. (Pen. Code § 502, subd. (d)(3)(C).)
This appears to describe an alternate felony-misdemeanor (wobbler) in two ways: 1) by including two separate maximum fines ($10,000 or $5,000) as stand-alone penalties, and 2) providing that the court can sentence the defendant to a felony sentence pursuant to Penal Code 1170, subdivision (h) or impose a misdemeanor jail term of up to a year.
Penal Code Section 17, subdivision (b). defines an alternate felony-misdemeanor, or wobbler. In relevant part, Section 17 provides:
(b) When a crime is punishable, in the discretion of the court, either by imprisonment in the state prison or imprisonment in a county jail under the provisions of subdivision (h) of Section 1170, or by fine or imprisonment in the county jail, it is a misdemeanor for all purposes under the following circumstances:
(1) After a judgment imposing a punishment other than imprisonment in the state prison or imprisonment in a county jail under the provisions of subdivision (h) of Section 1170.
Applying Penal Code Section 17, subdivision (b), to the computer crimes covered by this bill, the sentencing court could impose a fine of up to $10,000, with no felony jail or prison term and the offense would, by definition, be a misdemeanor. The court could impose a felony jail or prison sentence and no fine, and the offense would be a felony. The court could impose a felony jail or prison term and a fine of up to $10,000 and the offense would be a felony. Simply stating that a crime is a felony punishable pursuant to Section 1170, subdivision (h), means that the defendant is subject to a sentence of16 months, two years or three years and a fine of up to $10,000. There is thus no need to specify that the maximum felony fine for a violation of Section 502 is $10,000.
It is most likely that an appellate court would find that the maximum fine for a misdemeanor under existing law $5,000, as the misdemeanor jail term is described in conjunction with a fine of up to $5,000. However, it can also be argued that the court could impose a fine of up to $10,000 and a misdemeanor jail term. As noted above, if a crime is punishable by a fine alone, it is a wobbler. If the court punishes the defendant by a county jail term, but not pursuant to Section 1170, subdivision (h), the offense is a misdemeanor. If the court can impose a fine of up to $10,000 and county jail term, the bill is not necessary. If the court cannot impose a fine of up to $10,000 and a misdemeanor jail term under existing law, the author's intent can be realized by simply striking the reference in the existing statutes to a $5,000 fine. That would provide that the maximum fine for either a misdemeanor or a felony is $10,000.
Committee staff has found no appellate cases discussing the fine structure in Penal Code Section 502. In any event, the penalty provisions in Penal Code Section 502 is confusing and should be clarified.
4. The Statute of Limitations Generally; Law Revision Commission Report
The statute of limitations requires commencement of a prosecution within a certain period of time after the commission of a crime. A prosecution is initiated by filing an indictment or information, filing a complaint, certifying a case to superior court, or issuing an arrest or bench warrant. (Pen. Code § 804.) The failure of a prosecution to be commenced within the applicable period of limitation is a complete defense to the charge. The statute of limitations is jurisdictional and may be raised as a defense at any time, before or after judgment. People v. Morris (1988) 46 Cal.3d 1, 13. The defense may only be waived under limited circumstances. (See Cowan v. Superior Court (1996) 14 Cal.4th 367.)
The Legislature enacted the current statutory scheme regarding statutes of limitations for crimes in 1984 in response to a report of the California Law Revision Commission:
The Commission identified various factors to be considered in drafting a limitations statute. These factors include: (a) The staleness factor. A person accused of crime should be protected from having to face charges based on possibly unreliable evidence and from losing access to the evidentiary means to defend. (b) The repose factor. This reflects society's lack of a desire to prosecute for crimes committed in the distant past. (c) The motivation factor. This aspect of the statute imposes a priority among crimes for investigation and prosecution. (d) The seriousness factor. The statute of limitations is a grant of amnesty to a defendant; the more serious the crime, the less willing society is to grant that amnesty. (e) The concealment factor. Detection of certain concealed crimes may be quite difficult and may require long investigations to identify and prosecute the perpetrators.
The Commission concluded that a felony limitations statute generally should be based on the seriousness of the crime. Seriousness is easily determined based on classification of a crime as felony or misdemeanor and the punishment specified, and a scheme based on seriousness generally will accommodate the other factors as well. Also, the simplicity of a limitations period based on seriousness provides predictability and promotes uniformity of treatment.2
The Statute of Limitations Exception in this Bill
This bill extends the statute of limitation in prosecutions under Penal Code Section 502, subdivision (c). That subdivision is very broad. It includes many separate crimes for accessing, harming or using a computer, computer system or data in the computer or computer system. Specifically, the bill extends the statute of limitations if it is alleged that the defendant, in committing one of these crimes, “acquired, copied or distributed” a digital image in which a an intimate - sexual - body part is displayed.
The bill does not require that the intimate image itself be illegal or that it be used in the commission of a crime. There is no requirement that the image be of an identifiable person. It can be argued that the image need not include a person’s face. The image could be in the public domain or previously and intentionally distributed by the person depicted. It also appears that the defendant need not even know that he or she “acquired, copied or distributed” an image of an intimate body part.
Further, it is not clear when or why a prosecutor would allege that a person “acquired, copied or distributed” an intimate or sexual image in the commission of a computer or compute system offense. Generally, prosecutor’s charge a crime and allege facts that support an enhancements or a sentencing limit or requirement. Acquiring, copying or distributing a sexual image is not an element of, or inherent in, any of the crimes in subdivision (c) of Section 502, although that conduct might be an element or inherently part of another crime, such as cyber porn revenge, or surreptitious filming of a person in a place where the person has a reasonable expectation of privacy.
The bill thus extends the statute of limitations for a crime because of a fact that is not directly related to the crime. The bill could extend the statute of limitations for one defendant, but not for another charged with the same crime, based on factors that could be essentially random or accidental, or extraneous to the offense. There are statutes of limitations that are based on factors that are not elements of the crime or inherent in the crime. However, those factors generally concern the fact that the victim was a minor at the time a sex crime occurred. While it appears that the statute is extended for crimes that do not include an element that the victim was a minor, sexual conduct with a minor is criminal and the age of the victim would typically be an element of a crime that is included in a greater offense, such as forced oral copulation.
Arguably, tolling of the statute of limitations for a computer crime based on the fact that the defendant “acquired, copied or distributed” an intimate digital image should also include a requirement that the acquisition, copying or distribution of the images constitutes criminal conduct, or at least an element of a crime.
6. Tolling the Statute of Limitation in Cases of Identity Theft - Application to Computer Hacking to Obtain Intimate Images of Another Person
It appears that many instances of the use of another person’s image - especially where the image was stolen from the depicted person’s computer - would constitute identity theft. Identity theft is a very broadly defined offense. It is essentially the unauthorized use of another person’s identifying information for any unlawful purpose. Identifying information is defined very broadly as well, including name, address, place of employment, biometric data, mother’s maiden name and many others. It appears that the unlawful purpose need not be a crime itself. The statute of limitations for identity theft does not begin to run until the crime has been discovered. In many situations where it appears that the author intends the statute of limitations in the bill to apply, the tolling provisions applicable to identity theft would apply.
The most infamous purveyor of non-consensual personal sexual images on the Internet is Hunter Moore. Moore ran a website on which he and others posted nude photos that were often described as “revenge porn,” because posters were often men eager to humiliate former partners. Moore went far beyond simply posting images provided to him by others. He employed a man named Charles Evens to hack into e-mail accounts to obtain the images. Moore and Evens recently pleaded guilty in federal court to computer hacking crimes and identity theft.3
In addition to hacking issues, using the images of actors and other celebrities can constitute a violation of a celebrity’s copyright or publicity rights. Under California law an actor, singer or other celebrity generally has a right to control and gain from the commercial value of his or her image, voice and other characteristics. (Cal. Civ. Code § 3344.1.) Unauthorized use of a celebrity’s image could perhaps be the basis of an identity theft prosecution.
Prior Legislation
AB 1649 (Waldron) - Ch. 379, Stats. of 2014, specified the penalties for any person who disrupts or causes the disruption of, adds, alters, damages, destroys, provides or assists in providing a means of accessing, or introduces any computer contaminant into a "government computer system" or a "public safety infrastructure computer system," as specified, and changed and added the definition of specified terms.
SB 255 (Canella) - Ch. 466, Stats. of 2013 and SB 1255 (Cannella) - Ch. 863, Stats. of 2014 created and expanded a new misdemeanor for the distribution of a sexual or intimate image of an identifiable person where the distributor and the person depicted have agreed the images shall remain private. The offense includes the elements of serious emotional distress to the depicted person, which the distributor knew or should have known would have occurred.
-- END –
1 http://www.lao.ca.gov/reports/2014/criminal-justice/debt-collection/court-ordered-debt-collection-111014.pdf
2 1 Witkin Cal. Crim. Law Defenses, Section 214 (3rd Ed. 2004), citing 17 Cal. Law Rev. Com. Reports, pp.308-314.
3 http://www.nytimes.com/aponline/2015/02/18/us/ap-us-revenge-porn.html
AB 32
Page 5
ASSEMBLY THIRD READING
AB 32
(Waldron)
As Amended April 7, 2015
Majority vote
Committee |
Votes |
Ayes |
Noes |
Public Safety |
7-0 |
Quirk, Melendez, Gonzalez, Jones-Sawyer, Lackey, Low, Santiago |
|
SUMMARY:
Increases specified fines related to computer crimes from a maximum of $5,000, to a maximum of $10,000, and tolls the statute of limitations for illegally acquiring digital images of a person that display an intimate body part of a person. Specifically, this bill:
Increases fines from a fine of up to $5,000 to a fine of up to $10,000 for the following offenses:
Knowingly access and without permission alter, damage, delete, destroy, or otherwise use any data, computer, computer system, or computer network in order to either i) devise or execute any scheme or artifice to defraud, deceive, or extort, or ii) wrongfully control or obtain money, property, or data.
Knowingly access and without permission take, copy, or make use of any data from a computer, computer system, or computer network, or take or copy any supporting documentation, whether existing or residing internal or external to a computer, computer system, or computer network.
Knowingly and without permission use or cause to be used computer services.
Knowingly access and without permission add, alter, damage, delete, or destroy any data, computer software, or computer programs which reside or exist internal or external to a computer, computer system, or computer network.
Knowingly and without permission disrupt or cause the disruption of computer services or deny or cause the denial of computer services to an authorized user of a computer, computer system, or computer network.
Second or subsequent violations of knowingly and without permission provides or assists in providing a means of accessing a computer, computer system, or computer network in violation of this section.
Second or subsequent violations of knowingly and without permission accessing or causing to be accessed any computer, computer system, or computer network.
Knowingly introducing any computer contaminant into any computer, computer system, or computer network.
Second or subsequent violations of knowingly and without permission using the Internet domain name or profile of another individual, corporation, or entity in connection with the sending of one or more electronic mail messages or posts and thereby damaging or causing damage to a computer, computer data, computer system, or computer network.
Knowingly and without permission disrupting or causing the disruption of government computer services or denying or causing the denial of government computer services to an authorized user of a government computer, computer system, or computer network.
Knowingly access and without permission add, alter, damage, delete, or destroy any data, computer software, or computer programs which reside or exist internal or external to a public safety infrastructure computer system computer, computer system, or computer network.
Knowingly and without permission disrupting or causing the disruption of public safety infrastructure computer system computer services or denying or causing the denial of computer services to an authorized user of a public safety infrastructure computer system computer, computer system, or computer network.
Second or subsequent violations of knowingly and without permission providing or assisting in providing a means of accessing a computer, computer system, or public safety infrastructure computer system computer, computer system, or computer network in violation of this section.
Knowingly introducing any computer contaminant into any public safety infrastructure computer system computer, computer system, or computer network.
Provides that the statute of limitations does not commence to run until the discovery of specified computer hacking offenses in which it is alleged that the defendant acquired, copied, or distributed one or more digital images of a person that displays an intimate body part of the person. Includes the following definitions:
Defines "intimate body part" as any portion of the genitals, the anus, and in the case of a female also includes any portion of the breasts below the top of the areola, that is either uncovered or clearly visible through clothing; and
Defines "digital images of a person" as not including representational images, artwork, or cartoon drawings.
EXISTING LAW:
Punishes any person who knowingly and without permission uses or causes to be used computer services as follows:
For the first violation that does not result in injury, and where the value of the computer services used does not exceed $950, by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
For any violation that results in a victim expenditure in an amount greater than $5,000 or in an injury, or if the value of the computer services used exceeds $950, or for any second or subsequent violation, by a fine not exceeding $10,000, or by imprisonment for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
Punishes any person who knowingly and without permission provides or assists in providing a means of accessing a computer, computer system, or computer network as follows:
For a first violation that does not result in injury, an infraction punishable by a fine not exceeding $1,000.
For any violation that results in a victim expenditure in an amount not greater than $5,000, or for a second or subsequent violation, by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
For any violation that results in a victim expenditure in an amount greater than $5,000, by a fine not exceeding $10,000, or by imprisonment pursuant to Penal Code Section 1170 subdivision (h) for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
Punishes any person who knowingly and without permission accesses or causes to be accessed any computer, computer system, or computer network as follows:
For a first violation that does not result in injury, an infraction punishable by a fine not exceeding $1,000.
For any violation that results in a victim expenditure in an amount not greater than $5,000, or for a second or subsequent violation, by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
For any violation that results in a victim expenditure in an amount greater than $5,000, by a fine not exceeding $10,000, or by imprisonment pursuant to Penal Code Section 1170 subdivision (h) for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
Punishes any person who knowingly and without permission provides or assists in providing a means of accessing a computer, computer system, or public safety infrastructure computer system computer, computer system, or computer network as follows:
For a first violation that does not result in injury, an infraction punishable by a fine not exceeding $1,000.
For any violation that results in a victim expenditure in an amount not greater than $5,000, or for a second or subsequent violation, by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
For any violation that results in a victim expenditure in an amount greater than $5,000, by a fine not exceeding $10,000, or by imprisonment pursuant to Penal Code Section 1170 subdivision (h) for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
Punishes any person who knowingly introduces any computer contaminant into any computer, computer system, or computer network as follows:
For a first violation that does not result in injury, a misdemeanor punishable by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
For any violation that results in injury, or for a second or subsequent violation, by a fine not exceeding $10,000, or by imprisonment in a county jail not exceeding one year, or by imprisonment, or by both that fine and imprisonment.
Punishes any person who knowingly introduces any computer contaminant into any public safety infrastructure computer system computer, computer system, or computer network as follows:
For a first violation that does not result in injury, a misdemeanor punishable by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
For any violation that results in injury, or for a second or subsequent violation, by a fine not exceeding $10,000, or by imprisonment in a county jail not exceeding one year, or by imprisonment, or by both that fine and imprisonment.
Punishes any person who knowingly and without permission uses the Internet domain name or profile of another individual, corporation, or entity in connection with the sending of one or more electronic mail messages or posts and thereby damages or causes damage to a computer, computer data, computer system, or computer network.
For a first violation that does not result in injury, an infraction punishable by a fine not exceeding $1,000.
For any violation that results in injury, or for a second or subsequent violation, by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
FISCAL EFFECT:
Unknown. This bill is keyed non-fiscal by the Legislative Counsel.
COMMENTS:
According to the author, "Cyber criminals compromise personal information for individual gain or to merely cause a disruption. This year, The California Department of Motor Vehicles computer system was hacked causing a data security breach in its credit card processing services. Existing fines are just a small sum compared to the dollar who have been violated. Ordinary computer hacking penalties do not sufficiently capture the emotional trauma and hardship that such data breach can cause. AB 32 will make crimes involving computer hacking punishable by up to $10,000 for misdemeanor offenses. It is important to keep up with the new emerging computer crimes to make sure that the violators do not go unpunished and to prevent future crimes in such circumstances."
Analysis Prepared by: Gabriel Caswell / PUB. S. / (916) 319-3744 FN: 0000111
AB 32
Page 11
Date of Hearing: March 24, 2015
Counsel: Gabriel Caswell
ASSEMBLY COMMITTEE ON PUBLIC SAFETY
Bill Quirk, Chair
AB 32
(Waldron) – As Introduced December 1, 2014
As Proposed to be Amended in Committee
SUMMARY:
Increases specified fines related to computer crimes from a maximum of five thousand dollars ($5,000), to a maximum of ten thousand dollars ($10,000), and tolls the statute of limitations for illegally acquiring digital images of a person that displays an intimate body part of a person. Specifically, this bill:
Increases fines from a fine of up to five thousand dollars ($5,000) to a fine of up to ten thousand dollars ($10,000) for the following offenses:
Knowingly access and without permission altering, damaging, deleting, destroying, or otherwise use any data, computer, computer system, or computer network in order to either (A) devise or execute any scheme or artifice to defraud, deceive, or extort, or (B) wrongfully control or obtain money, property, or data.
Knowingly access and without permission take, copy, or make use of any data from a computer, computer system, or computer network, or take or copy any supporting documentation, whether existing or residing internal or external to a computer, computer system, or computer network.
Knowingly and without permission use or cause to be used computer services.
Knowingly access and without permission add, alter, damage, delete, or destroy any data, computer software, or computer programs which reside or exist internal or external to a computer, computer system, or computer network.
Knowingly and without permission disrupt or cause the disruption of computer services or deny or cause the denial of computer services to an authorized user of a computer, computer system, or computer network.
Second or subsequent violations of knowingly and without permission provides or assists in providing a means of accessing a computer, computer system, or computer network in violation of this section.
Second or subsequent violations of knowingly and without permission accessing or causing to be accessed any computer, computer system, or computer network.
Knowingly introducing any computer contaminant into any computer, computer system, or computer network.
Second or subsequent violations of knowingly and without permission using the Internet domain name or profile of another individual, corporation, or entity in connection with the sending of one or more electronic mail messages or posts and thereby damaging or causing damage to a computer, computer data, computer system, or computer network.
Knowingly and without permission disrupting or causing the disruption of government computer services or denying or causing the denial of government computer services to an authorized user of a government computer, computer system, or computer network.
Knowingly accessing and without permission adding, altering, damaging, deleting, or destroying any data, computer software, or computer programs which reside or exist internal or external to a public safety infrastructure computer system computer, computer system, or computer network.
Knowingly and without permission disrupting or causing the disruption of public safety infrastructure computer system computer services or denying or causing the denial of computer services to an authorized user of a public safety infrastructure computer system computer, computer system, or computer network.
Second or subsequent violations of knowingly and without permission providing or assisting in providing a means of accessing a computer, computer system, or public safety infrastructure computer system computer, computer system, or computer network in violation of this section.
Knowingly introducing any computer contaminant into any public safety infrastructure computer system computer, computer system, or computer network.
Provides that the statute of limitations does not commence to run until the discovery of specified computer hacking offenses in which it is alleged that the defendant acquired, copied, or distributed one or more digital images of a person that displays an intimate body part of the person. Includes the following definitions:
Defines “intimate body part” as any portion of the genitals, the anus, and in the case of a female also includes any portion of the breasts below the top of the areola, that is either uncovered or clearly visible through clothing; and
Defines “digital images of a person” as not including representational images, artwork, or cartoon drawings.
EXISTING LAW:
Punishes the following offenses by a fine not exceeding $10,000, by a sentenced felony jail term of 16 months, two years or three years, or both, or as a misdemeanor by a fine not exceeding $5,000, by imprisonment in a county jail not exceeding one year, or both: (Pen. Code, § 502(d)(1).)
Any person who knowingly accesses and without permission alters, damages, deletes, destroys, or otherwise uses any data, computer, computer system, or computer network in order to either devise or execute any scheme or artifice to defraud, deceive, or extort, or wrongfully control or obtain money, property, or data. (Pen. Code, § 502(c)(1).)
Any person who knowingly accesses and without permission takes, copies, or makes use of any data from a computer, computer system, or computer network, or takes or copies any supporting documentation, whether existing or residing internal or external to a computer, computer system, or computer network. (Pen. Code, § 502(c)(2).)
Any person who knowingly accesses and without permission adds, alters, damages, deletes, or destroys any data, computer software, or computer programs which reside or exist internal or external to a computer, computer system, or computer network. (Pen. Code, § 502(c)(4).)
Any person who knowingly and without permission disrupts or causes the disruption of computer services or denies or causes the denial of computer services to an authorized user of a computer, computer system, or computer network. (Pen. Code, § 502(c)(5).)
Any person who knowingly and without permission disrupts or causes the disruption of government computer services or denies or causes the denial of government computer services to an authorized user of a government computer, computer system, or computer network. (Pen. Code, § 502(c)(10).)
Any person who knowingly accesses and without permission adds, alters, damages, deletes, or destroys any data, computer software, or computer programs which reside or exist internal or external to a public safety infrastructure computer system computer, computer system, or computer network. (Pen. Code, § 502(c)(11).)
Any person who knowingly and without permission disrupts or causes the disruption of public safety infrastructure computer system computer services or denies or causes the denial of computer services to an authorized user of a public safety infrastructure computer system computer, computer system, or computer network. (Pen. Code, § 502(c)(12).)
Punishes any person who knowingly and without permission uses or causes to be used computer services as follows: (Pen Code, § 502(c)(3).)
For the first violation that does not result in injury, and where the value of the computer services used does not exceed nine hundred fifty dollars ($950), by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment. (Pen. Code, § 502(d)(2).)
For any violation that results in a victim expenditure in an amount greater than five thousand dollars ($5,000) or in an injury, or if the value of the computer services used exceeds nine hundred fifty dollars ($950), or for any second or subsequent violation, by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment. (Pen. Code, § 502(d)(2).)
Punishes any person who knowingly and without permission provides or assists in providing a means of accessing a computer, computer system, or computer network as follows: (Pen. Code, § 502(c)(6).)
For a first violation that does not result in injury, an infraction punishable by a fine not exceeding one thousand dollars ($1,000).
For any violation that results in a victim expenditure in an amount not greater than five thousand dollars ($5,000), or for a second or subsequent violation, by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
For any violation that results in a victim expenditure in an amount greater than five thousand dollars ($5,000), by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment pursuant to subdivision (h) of Section 1170 for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment. (Pen. Code, § 502(d)(3).)
Punishes any person who knowingly and without permission accesses or causes to be accessed any computer, computer system, or computer network as follows: (Pen. Code, § 502(c)(7).)
For a first violation that does not result in injury, an infraction punishable by a fine not exceeding one thousand dollars ($1,000).
For any violation that results in a victim expenditure in an amount not greater than five thousand dollars ($5,000), or for a second or subsequent violation, by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
For any violation that results in a victim expenditure in an amount greater than five thousand dollars ($5,000), by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment pursuant to subdivision (h) of Section 1170 for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment. (Pen. Code, § 502(d)(3).)
Punishes any person who knowingly and without permission provides or assists in providing a means of accessing a computer, computer system, or public safety infrastructure computer system computer, computer system, or computer network as follows: (Pen. Code, § 502(c)(11).)
For a first violation that does not result in injury, an infraction punishable by a fine not exceeding one thousand dollars ($1,000).
For any violation that results in a victim expenditure in an amount not greater than five thousand dollars ($5,000), or for a second or subsequent violation, by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
For any violation that results in a victim expenditure in an amount greater than five thousand dollars ($5,000), by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment pursuant to subdivision (h) of Section 1170 for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment. (Pen. Code, § 502(d)(3).)
Punishes any person who knowingly introduces any computer contaminant into any computer, computer system, or computer network as follows: (Pen. Code, § 502(c)(8).)
For a first violation that does not result in injury, a misdemeanor punishable by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
For any violation that results in injury, or for a second or subsequent violation, by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment in a county jail not exceeding one year, or by imprisonment, or by both that fine and imprisonment. (Pen. Code, § 502(d)(4).)
Punishes any person who knowingly introduces any computer contaminant into any public safety infrastructure computer system computer, computer system, or computer network as follows: (Pen. Code, § 502(c)(14).)
For a first violation that does not result in injury, a misdemeanor punishable by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.
For any violation that results in injury, or for a second or subsequent violation, by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment in a county jail not exceeding one year, or by imprisonment, or by both that fine and imprisonment. (Pen. Code, § 502(d)(4).)
Punishes any person who knowingly and without permission uses the Internet domain name or profile of another individual, corporation, or entity in connection with the sending of one or more electronic mail messages or posts and thereby damages or causes damage to a computer, computer data, computer system, or computer network. (Pen. Code, § 502(c)(9).)
For a first violation that does not result in injury, an infraction punishable by a fine not exceeding one thousand dollars ($1,000).
For any violation that results in injury, or for a second or subsequent violation, by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment. (Pen. Code, § 502(d)(5).)
Defines the following terms as follows:
"Access" means to gain entry to, instruct, cause input to, cause output from, cause data processing with, or communicate with, the logical, arithmetical, or memory function resources of a computer, computer system, or computer network. (Pen. Code, § 502(b)(1).)
"Computer network" means any system that provides communications between one or more computer systems and input/output devices including, but not limited to, display terminals, remote systems, mobile devices, and printers connected by telecommunication facilities. (Pen. Code, § 502(b)(2).)
"Computer program or software" means a set of instructions or statements, and related data, that when executed in actual or modified form, cause a computer, computer system, or computer network to perform specified functions. (Pen. Code, § 502(b)(3).)
"Computer services" includes, but is not limited to, computer time, data processing, or storage functions, Internet services, electronic mail services, electronic message services, or other uses of a computer, computer system, or computer network. (Pen. Code, § 502(b)(4).)
"Computer system" means a device or collection of devices, including support devices and excluding calculators that are not programmable and capable of being used in conjunction with external files, one or more of which contain computer programs, electronic instructions, input data, and output data, that performs functions including, but not limited to, logic, arithmetic, data storage and retrieval, communication, and control. (Pen. Code, § 502(b)(5).)
"Government computer system" means any computer system, or part thereof, that is owned, operated, or used by any federal, state, or local governmental entity. (Pen. Code, § 502(b)(6).)
"Public safety infrastructure computer system" means any computer system, or part thereof, that is necessary for the health and safety of the public including computer systems owned, operated, or used by drinking water and wastewater treatment facilities, hospitals, emergency service providers, telecommunication companies, and gas and electric utility companies. (Pen. Code, § 502(b)(7).)
"Data" means a representation of information, knowledge, facts, concepts, computer software, computer programs or instructions. Data may be in any form, in storage media, or as stored in the memory of the computer or in transit or presented on a display device. (Pen. Code, § 502(b)(8).)
"Supporting documentation" includes, but is not limited to, all information, in any form, pertaining to the design, construction, classification, implementation, use, or modification of a computer, computer system, computer network, computer program, or computer software, which information is not generally available to the public and is necessary for the operation of a computer, computer system, computer network, computer program, or computer software. (Pen. Code, § 502(b)(9).)
"Injury" means any alteration, deletion, damage, or destruction of a computer system, computer network, computer program, or data caused by the access, or the denial of access to legitimate users of a computer system, network, or program. (Pen. Code, § 502(b)(10).)
"Victim expenditure" means any expenditure reasonably and necessarily incurred by the owner or lessee to verify that a computer system, computer network, computer program, or data was or was not altered, deleted, damaged, or destroyed by the access. (Pen. Code, § 502(b)(11).)
"Computer contaminant" means any set of computer instructions that are designed to modify, damage, destroy, record, or transmit information within a computer, computer system, or computer network without the intent or permission of the owner of the information. They include, but are not limited to, a group of computer instructions commonly called viruses or worms, that are self-replicating or self-propagating and are designed to contaminate other computer programs or computer data, consume computer resources, modify, destroy, record, or transmit data, or in some other fashion usurp the normal operation of the computer, computer system, or computer network. (Pen. Code, § 502(b)(12).)
"Internet domain name" means a globally unique, hierarchical reference to an Internet host or service, assigned through centralized Internet naming authorities, comprising a series of character strings separated by periods, with the rightmost character string specifying the top of the hierarchy. (Pen. Code, § 502(b)(13).)
"Electronic mail" means an electronic message or computer file that is transmitted between two or more telecommunications devices; computers; computer networks, regardless of whether the network is a local, regional, or global network; or electronic devices capable or receiving electronic messages, regardless of whether the message is converted to hard copy format after receipt, viewed upon transmission, or stored for later retrieval. (Pen. Code, § 502(b)(14).)
"Profile" means either of the following:
A configuration of user data required by a computer so that the user may access programs or services and have the desired functionality on that computer; or
An Internet website user's personal page or section of a page that is made up of data, in text of graphical form, that displays significant, unique, or identifying information, including, but not limited to, listing acquaintances, interests, associations, activities, or personal statements. (Pen. Code, § 502(b)(15).)
FISCAL EFFECT:
Unknown
COMMENTS:
Author's Statement: According to the author, "Cyber criminals compromise personal information for individual gain or to merely cause a disruption. This year, The California Department of Motor Vehicles computer system was hacked causing a data security breach in its credit card processing services. Existing fines are just a small sum compared to the dollar who have been violated. Ordinary computer hacking penalties do not sufficiently capture the emotional trauma and hardship that such data breach can cause. AB 32 will make crimes involving computer hacking punishable by up to $10,000 for misdemeanor offenses. It is important to keep up with the new emerging computer crimes to make sure that the violators do not go unpunished and to prevent future crimes in such circumstances.
Growing Concerns Regarding Privacy of Personal Images and the Internet: In recent years the attention of the media and policymakers has turned to privacy concerns raised by the sheer volume of data shared over internet connections. With the advent of wireless internet, more data is being transmitted than ever before through cyberspace. Over the last couple of years several serious incidents of the invasion of privacy have come to the forefront of national attention. (Opinion: the Biggest Privacy Outrages in 2014, Los Angeles Times, by Jon Healey).
In August and September of 2014, dozens of women (including Jennifer Lawrence) had revealing photos misappropriated from Apple's iCloud storage site and they were posted on the "4chan" bulletin board for the public to view. Apple represents that the site was not hacked, but others believe that the photos were obtained by guessing the passwords of the victims. The incident alerted the public to the fact that many people's phones may be copying material automatically to the internet.
In October of 2014 an unknown hacker assembled a gallery of more than
100,000 images and videos that people had sent via Snapchat.
Snapchat markets itself as a web based mobile application that allows
users to send photos and videos to one another in a format that can
only be viewed by the recipient, not copied or saved by the
recipient. As it turns out, other web developers have created
systems that enable users to make permanent copies of the temporary
Snapchat files and store them in "the cloud" wherein they
can be obtained by knowledgeable hackers.
Penalty Assessments: The amount spelled out in statute as a fine for violating a criminal offense are base figures, as these amounts are subject to statutorily-imposed penalty assessments, such as fees and surcharges. Assuming a defendant is fined the maximum fine of $10,000 under Penal Code Section 502, the following penalty assessments would be imposed pursuant to the Government and Penal codes:
-
Base Fine:
$10,000.00
Penal Code § 1464 assessment ($10 for every $10):
$10,000.00
Penal Code § 1465.7 assessment (20% surcharge):
$2,000.00
Penal Code § 1465.8 assessment ($40 per criminal offense):
$40.00
Government Code § 70372 assessment ($5 for every $10):
$5,000.00
Government Code § 70373 assessment ($30 for felony or misdemeanor offense):
$30.00
Government Code § 76000 assessment ($7 for every $10):
$7,000.00
Government Code § 76000.5 assessment ($2 for every $10):
$2,000.00
Government Code § 76104.6 assessment ($1 for every $10):
$1,000.00
Government Code § 76104.7 assessment ($4 for every $10):
$4,000.00
Fine with Assessments:
$41,070.00*
*In addition to the assessments detailed in the chart, the defendant could be subject to pay "actual administrative costs" related to his or her arrest and booking (Gov. Code, § 29550 et seq.) and victim restitution for damages impose by the court.
"Cyber Revenge" or "Revenge Porn": Recently, there have been numerous publicized incidents of cyber revenge or revenge porn which involves the posting of nude or sexually explicit photos without the consent of the person depicted. While not every incident of revenge porn would involve illegally obtaining the photos by hacking into a computer system, revenge porn incidents can overlap with the privacy interests addressed in this bill.
Proposed Amendments: The proposed amendments modify the bill significantly from the introduced version. As introduced this bill added a second fine of up to $10,000 per image for a violation of specified sections of Penal Code § 502 when the image in question is of an intimate body part, as defined by the bill. In lieu of the additional fine, this bill raises the maximum fine for the offenses in Penal Code § 502 that were a maximum of $5,000 to fines with a maximum of $10,000. Additionally, the amendments maintain an extension of the statute of limitations for Penal Code § 502 offenses involving photographs of intimate body parts until the discovery of the photographs, as specified.
All letters that were written in support and in opposition of the
bill reflect the introduced version of the bill and not the proposed
amended version of the bill.
Argument in Support: According to the Association for Los Angeles Deputy Sheriffs, "AB 32 will take critical steps to establish stronger penalties for violating personal privacy…[the bill] would extend the timeframe for enforcing the penalty to one year from the discovery of the offense.
"Current law does not provide a sufficient level of penalty to discourage individuals from committing these harmful crimes…Strengthening the punishment will decrease the likelihood that computer hackers will choose to commit these types of intrusive violations. Further, the measure will ensure that justice will be served by establishing that a criminal complaint may be filed up to a year from discovery.
"The public deserves to feel safe and secure in this age of
emerging technology. Computers, cellular phones and cloud technology
will continue to evolve into more integral components of our lives.
Any effort that can be undertaken to safeguard the private personal
information that is stored on these mediums should be applauded."
Argument in Opposition: According to the California Attorneys for Criminal Justice, "Penal Code section 502 is already extremely broad. Anyone who '[k]knowingly accesses and without permission takes, copies, or makes use of any data from a computer system, or computer network, or takes or copies any supporting documentation whether existing or residing internal or external to a computer, computer system, or computer network' can be fined $10,000 and may be sentenced to prison for up to 2 years (Penal Code 502 subd. (c)(2) & (d)(1)."
Prior Legislation:
AB 1649 (Waldron), Chapter 379, Statutes of 2014, specified the penalties for any person who disrupts or causes the disruption of, adds, alters, damages, destroys, provides or assists in providing a means of accessing, or introduces any computer contaminant into a "government computer system" or a "public safety infrastructure computer system," as specified, and changed and added the definition of specified terms.
SB 255 (Canella), Chapter 466, Statutes of 2014 created a new misdemeanor for the distribution of a consensually taken image of an identifiable person in a state of full or partial undress when the image is distributed with the intent to cause serious emotional distress, and the person suffers such distress.
REGISTERED SUPPORT / OPPOSITION:
Support
Association of Deputy District Attorneys
Association for Los Angeles Deputy Sheriffs
California College and University Police Chiefs
California Communities United Institute
Los Angeles Police Protective League
Riverside Sheriffs Association
Opposition
California Attorneys for Criminal Justice
California Public Defenders Association
Analysis Prepared by:
Gabriel Caswell / PUB. S. / (916) 319-3744
Discussed in Hearing
1MIN
Assembly Floor
5MIN
Senate Standing Committee on Public Safety
1MIN
Assembly Floor
5MIN
Assembly Standing Committee on Public Safety
Bill Author
