Existing law establishes various crimes relating to computer services and systems, including, but not limited to, knowingly introducing a computer contaminant, as defined. Existing law makes a violation of those crimes punishable by specified fines or terms of imprisonment, or by both those fines and imprisonment.

Existing law defines extortion as obtaining the property of another, with his or her consent, induced by a wrongful use of force or fear. Existing law makes extortion a crime, punishable by imprisonment in a county jail for 2, 3, or 4 years.

This bill would define ransomware as a computer contaminant or lock placed or introduced without authorization into a computer, computer system, or computer network that restricts access by an authorized person to the computer, computer system, computer network, or any data therein under circumstances in which the person responsible for the placement or introduction of the ransomware demands payment of money or other consideration to remove the computer contaminant, restore access to the computer, computer system, computer network, or data, or otherwise remediate the impact of the computer contaminant or lock. The bill would provide that a person is responsible for placing or introducing ransomware into a computer, computer system, or computer network if the person directly places or introduces the ransomware or directs or induces another person do so, with the intent of demanding payment or other consideration to remove the ransomware, restore access, or otherwise remediate the impact of the ransomware. The bill would provide that a person who, with intent to extort money or other consideration from another, introduces ransomware into any computer, computer system, or computer network is punishable as if that money or other consideration were actually obtained by means of the ransomware. By expanding the scope of a crime, this bill would create a state-mandated local program.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Existing law establishes various crimes relating to computer services and systems, including, but not limited to, knowingly introducing a computer contaminant, as defined. Existing law makes a violation of those crimes punishable by specified fines or terms of imprisonment, or by both those fines and imprisonment.

Existing law defines extortion as obtaining the property of another, with his or her consent, induced by a wrongful use of force or fear. Existing law makes extortion a crime, punishable by imprisonment in a county jail for 2, 3, or 4 years.

This bill would define ransomware as a computer contaminant or lock placed or introduced without authorization into a computer, computer system, or computer network that restricts access by an authorized person to the computer, computer system, computer network, or any data therein under circumstances in which the person responsible for the placement or introduction of the ransomware demands payment of money or other consideration to remove the computer contaminant, restore access to the computer, computer system, computer network, or data, or otherwise remediate the impact of the computer contaminant or lock. The bill would provide that a person is responsible for placing or introducing ransomware into a computer, computer system, or computer network if the person directly places or introduces the ransomware or directs or induces another person do so, with the intent of demanding payment or other consideration to remove the ransomware, restore access, or otherwise remediate the impact of the ransomware. The bill would provide that a person who, with intent to extort money or other consideration from another, introduces ransomware into any computer, computer system, or computer network is punishable as if that money or other consideration were actually obtained by means of the ransomware. By expanding the scope of a crime, this bill would create a state-mandated local program.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Existing law establishes various crimes relating to computer services and systems, including, but not limited to, knowingly introducing a computer contaminant, as defined. Existing law makes a violation of those crimes punishable by specified fines or terms of imprisonment, or by both those fines and imprisonment.

Existing law defines extortion as obtaining the property of another, with his or her consent, induced by a wrongful use of force or fear. Existing law makes extortion a crime, punishable by imprisonment in a county jail for 2, 3, or 4 years.

This bill would define ransomware as a computer contaminant or lock placed or introduced without authorization into a computer, computer system, or computer network that restricts access by an authorized person to the computer, computer system, computer network, or any data therein under circumstances in which the person responsible for the placement or introduction of the ransomware demands payment of money or other consideration to remove the computer contaminant, restore access to the computer, computer system, computer network, or data, or otherwise remediate the impact of the computer contaminant or lock. The bill would provide that a person is responsible for placing or introducing ransomware into a computer, computer system, or computer network if the person directly places or introduces the ransomware or directs or induces another person do so, with the intent of demanding payment or other consideration to remove the ransomware, restore access, or otherwise remediate the impact of the ransomware. The bill would make it a crime for a person to knowingly introduce ransomware into any computer, computer system, or computer network. The bill would make a violation of this provision punishable by imprisonment in a county jail for 2, 3, or 4 years and a fine not exceeding $10,000. The bill would specify that prosecution under that provision does not prohibit or limit prosecution under any other law. provide that a person who, with intent to extort money or other consideration from another, introduces ransomware into any computer, computer system, or computer network is punishable as if that money or other consideration were actually obtained by means of the ransomware. By expanding the scope of a crime, this bill would create a state-mandated local program.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Existing law establishes various crimes relating to computer services and systems, including, but not limited to, knowingly introducing a computer contaminant, as defined. Existing law makes a violation of those crimes punishable by specified fines or terms of imprisonment, or by both those fines and imprisonment.

Existing law defines extortion as obtaining the property of another, with his or her consent, induced by a wrongful use of force or fear. Existing law makes extortion a crime, punishable by imprisonment in a county jail for 2, 3, or 4 years.

This bill would define ransomware as a computer or data contaminant or lock placed in or introduced into a computer system, computer or data in a computer system, or computer that restricts access to the system, computer, or data in some way, and under circumstances in which the person responsible for the ransomware demands payment of money or other consideration to remove the contaminant, unlock the computer system or computer, or repair the injury done to the computer system, computer, or data by the contaminant or lock. The bill would provide that a person is responsible for placing or introducing a contaminant or lock into a computer system, computer or data on a computer system, or computer if the person directly places or introduces the contaminant or lock, directs another to do so, or induces another person do so, with the intent of demanding payment or other consideration to remove the contaminant, unlock the computer system or computer, or repair the computer system, computer or data on the computer system, or computer. contaminant or lock placed or introduced without authorization into a computer, computer system, or computer network that restricts access by an authorized person to the computer, computer system, computer network, or any data therein under circumstances in which the person responsible for the placement or introduction of the ransomware demands payment of money or other consideration to remove the computer contaminant, restore access to the computer, computer system, computer network, or data, or otherwise remediate the impact of the computer contaminant or lock. The bill would provide that a person is responsible for placing or introducing ransomware into a computer, computer system, or computer network if the person directly places or introduces the ransomware or directs or induces another person do so, with the intent of demanding payment or other consideration to remove the ransomware, restore access, or otherwise remediate the impact of the ransomware. The bill would make it a crime for a person to knowingly introduce ransomware into any computer, computer system, or computer network. The bill would make a violation of this provision punishable by imprisonment in a county jail for 2, 3, or 4 years and a fine not exceeding $10,000. The bill would specify that prosecution under that provision does not prohibit or limit prosecution under any other law.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Existing law establishes various crimes relating to computer services and systems, including, but not limited to, knowingly introducing a computer contaminant, as defined. Existing law makes a violation of those crimes punishable by specified fines or terms of imprisonment, or by both those fines and imprisonment.

Existing law defines extortion as obtaining the property of another, with his or her consent, induced by a wrongful use of force or fear. Existing law makes extortion a crime, punishable by imprisonment in a county jail for 2, 3, or 4 years.

This bill would define ransomware as a computer or data contaminant or lock placed in or introduced into a computer system, computer or data in a computer system, or computer that restricts access to the infected computer and demands that the user pay a ransom to remove the restriction. system, computer, or data in some way, and under circumstances in which the person responsible for the ransomware demands payment of money or other consideration to remove the contaminant, unlock the computer system or computer, or repair the injury done to the computer system, computer, or data by the contaminant or lock. The bill would provide that a person is responsible for placing or introducing a contaminant or lock into a computer system, computer or data on a computer system, or computer if the person directly places or introduces the contaminant or lock, directs another to do so, or induces another person do so, with the intent of demanding payment or other consideration to remove the contaminant, unlock the computer system or computer, or repair the computer system, computer or data on the computer system, or computer. The bill would make it a crime for a person to knowingly introduce ransomware into any computer, computer system, or computer network. The bill would make a violation of this provision punishable by imprisonment in a county jail for 2, 3, or 4 years and a fine not exceeding $10,000. The bill would specify that prosecution under that provision does not prohibit or limit prosecution under any other law.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Existing law establishes various crimes relating to computer services and systems, including, but not limited to, knowingly introducing a computer contaminant, as defined. Existing law makes a violation of those crimes punishable by specified fines or terms of imprisonment, or by both those fines and imprisonment.

Existing law defines extortion as obtaining the property of another, with his or her consent, induced by a wrongful use of force or fear. Existing law makes extortion a crime, punishable by imprisonment in a county jail for 2, 3, or 4 years.

This bill would define ransomware as a computer contaminant that restricts access to the infected computer and demands that the user pay a ransom to remove the restriction. The bill would make it a crime for a person to knowingly introduce ransomware into any computer, computer system, or computer network. The bill would make a violation of this provision punishable by imprisonment in a county jail for 2, 3, or 4 years and a fine not exceeding $10,000.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Existing law establishes various crimes relating to computer services and systems, including, but not limited to, knowingly introducing a computer contaminant, as defined. Existing law makes a violation of those crimes punishable by specified fines or terms of imprisonment, or by both those fines and imprisonment.

Existing law defines extortion as obtaining the property of another, with his or her consent, induced by a wrongful use of force or fear. Existing law makes extortion a crime, punishable by imprisonment in a county jail for 2, 3, or 4 years.

This bill would define ransomware as a computer contaminant that restricts access to the infected computer and demands that the user pay a ransom to remove the restriction. The bill would make it a crime for a person to knowingly introduce ransomware into any computer, computer system, or computer network. The bill would make a violation of this provision punishable by imprisonment in a county jail for 2, 3, or 4 years and a fine not exceeding $10,000.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

 UNFINISHED BUSINESS  

Bill No: SB 1137

Author: Hertzberg (D), et al.

Amended: 8/19/16

Vote: 21

SENATE PUBLIC SAFETY COMMITTEE: 6-0, 4/12/16

AYES: Hancock, Glazer, Leno, Liu, Monning, Stone

NO VOTE RECORDED: Anderson

SENATE APPROPRIATIONS COMMITTEE: 7-0, 5/27/16

AYES: Lara, Bates, Beall, Hill, McGuire, Mendoza, Nielsen

SENATE FLOOR: 39-0, 5/31/16

AYES: Allen, Anderson, Bates, Beall, Berryhill, Block, Cannella, De León, Fuller, Gaines, Galgiani, Glazer, Hall, Hancock, Hernandez, Hertzberg, Hill, Hueso, Huff, Jackson, Lara, Leno, Leyva, Liu, McGuire, Mendoza, Mitchell, Monning, Moorlach, Morrell, Nguyen, Nielsen, Pan, Pavley, Roth, Stone, Vidak, Wieckowski, Wolk

NO VOTE RECORDED: Runner

ASSEMBLY FLOOR: 80-0, 8/23/16 - See last page for vote

SUBJECT: Computer crimes: ransomware

SOURCE: Los Angeles County District Attorney

TechNet

DIGEST: This bill 1) separately defines as extortion the act of placing a contaminant or lock on a computer, computer system or data, coupled with a demand for payment of money or other consideration before the lock will be removed or control returned to owner or authorized user; and, 2) specifically defines such a contaminant or lock as “ransomware.”

Assembly Amendments place the newly defined crime concerning “ransonware” into the Penal Code Section defining extortion, rather than the section concerning other forms of computer crimes.

ANALYSIS:

Existing law:

1. Defines numerous computer or electronic data offenses and imposes a wide range of penalties based on the seriousness of the offense or extent of harm caused by the defendant, including by felony imprisonment pursuant to Penal Code Section 1170, subdivision (h) for a term of term of 16 months, two years or three years and a fine of up to $10,000, or as misdemeanor by a fine not exceeding $5,000, or a fine of up to $1,000 by imprisonment in a county jail not exceeding one year, or as infraction. (Pen. Code § 502.)
2. Defines extortion as the obtaining of property from another person, without the person’s consent, or obtaining an official act of a public officer, induced by the wrongful use of force or fear, or under color of official right. (Pen. Code § 518.)
3. Defines force or fear sufficient to commit extortion as a threat to do any of the following:

• Injure the person or property of the person threatened or a third person.
• Accuse the threatened person or a relative of a crime.
• Expose or impute to the person threatened or a relative any deformity, disgrace or crime.
• Expose any secret of the person or relative.
• To report the immigration status of the person or a relative. (Pen. Code § 519.)

1. Provides that extortion is a felony, punishable pursuant to Penal Code Section 1170, subdivision (h), by a felony sentence of two, three or four years. (Pen. Code § 520.)
2. Provides that attempted extortion is an alternate felony-misdemeanor, punishable by a jail term of up to one year, a fine of up to $1,000, or both, or by a prison term of 16 months, two years or three years and a fine of up to $10,000. (Pen. Code § 524.)
3. Includes “white collar” financial crime prison sentence enhancements of one to five years and special fines, depending on the amount of money or property taken by the defendant or the loss suffered by the victim. The enhancements apply where the defendant is convicted of two or more related felonies and the loss to the victim or gain to the defendant is at least $100,000. To prevent a defendant from secreting or dissipating his or her assets, the court may order pretrial seizure of assets to preserve them for restitution and fines. (Pen. Code § 186.11.)
4. Includes the federal Computer Fraud and Abuse Act, which prohibits a number of different computer crimes, the majority of which involve accessing computers without authorization or in excess of authorization, and then taking specified forbidden actions, ranging from obtaining information to committing extortion. (18 U.S.C. § 1030(a)(1)-(7))

This bill:

1. Provides that a person is guilty of extortion where he or she is responsible for placing “ransomware” on a computer, computer system, or data in a computer, coupled with a demand that money or other consideration be paid to the person responsible for ransomware before it is removed or repaired.
2. Defines “ransomware” as the placement or introduction of a computer contaminant or lock on a computer, computer system, or data in a computer system, coupled with a demand that money or other consideration be paid to the person responsible for the contaminant or lock before it is removed or repaired.
3. Provides that one is responsible for ransomware if the person directly places or introduces the contaminant or lock, or directs or induces another person to do so, with the intent to demand payment or other consideration to remove the contaminant, unlock the computer system or data, or repair the computer, computer system or data.

Background

According to the author:

Kidnapping and ransom demands have been around as long as criminal activity itself. But what is new in today’s digital age is the immediacy in which a computer hacker can access your computer and hold it hostage. Computer users are told that the only way to get their machines back is to pay a steep fine. This is known as “ransomware. In practice, ransomware is simply a high-tech version of extortion, using the loss of access to one's data or computer as leverage to extort an electronic payment from the owner of the infected device.

This bill is intended to explicitly and clearly prohibit the use of malicious computer programs to infect computers or data and lock an authorized user out, and then extort money from that user in exchange for removing the ransomware or otherwise restoring access.

It appears that the use of ransom to extort money or other form of exchange, such as bitcoin, has become nearly ubiquitous. Even relatively large-scale attacks on or seizure of control over computers, computer systems and computer can be done quickly and remotely.

Victims can reasonably conclude that they have little option but to comply. The perpetrators might well be in another country or even another continent. An attempt to obtain assistance from law enforcement may be futile and the perpetrators could punish such attempts by destroying data that includes an entity’s entire operation. A business or organization could conclude that it could no longer function if the threat is carried out. Even where the threat is not executed, the very admission of the event could be extremely harmful to a business or other organization’s reputation. For example, a hospital would be loath to admit that confidential medical records were seized or locked. The customers and clients of banks and brokerage houses must believe that their financial holdings and information are safe. Attorneys cannot afford to reveal the confidences of clients stored in digital files.

Computer criminals have become increasingly sophisticated as technology became more sophisticated and essential to the life of virtually every person and entity. The attacks have included locking or encrypting files on the home computers of individual victims – often through authentic-look law enforcement notifications that the victim has done some wrong that he or she would never want exposed. (https://www.fbi.gov/news/stories/2012/august/new-internet-scam.) The attacks have also included attacks on large entities, such as three hospitals in recent, well-publicized incidents in Southern California and government entities. (http://www.latimes.com/local/lanow/la-me-ln-two-more-so-cal-hospitals-ransomware-20160322-story.html) It appears that no media report of ransomware incidents is complete without noting that even police departments have paid ransoms to computer criminals. A February 20, 2015 story in the Chicago Tribune reported the suburban Chicago town of Midlothian paid a hacker $500 in bitcoin for release of infected files. Even the department’s backup files were encrypted. (http://www.chicagotribune.com/news/local/breaking/ct-midlothian-hacker-ransom-met-20150220-story.html.)

A number of computer, software and computer and computer data security businesses have developed products to detect and remove ransomware. Numerous on-line guides about ransomware have been published. These typically include descriptions of ransomware, how to detect ransomware, remove it and protect against. For example, the Mountain View, California firm Symantec has published particularly detailed guides for addressing ransomware questions, concerns, protection, removal and repair. (http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-evolution-of-ransomware.pdf; http://www.symantec.com/tv/products/details.jsp?vid=1954285164001) TechNet – a Microsoft division that is a co-sponsor of this bill also publishes detailed ransomware guides and assistance, including information about newly discovered ransomware. (https://blogs.technet.microsoft.com/mmpc/2015/08/09/emerging-ransomware-troldesh/.)

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: Yes

According to the Assembly Appropriations Committee:

• Potential moderate increased cost (General Fund) to the California Department of Corrections and Rehabilitation for new commitments to state prison that would not have otherwise been convicted under the existing extortion statutes, or potentially longer sentences for convictions that otherwise would have been charged as other computer crimes. To the extent the provisions of this bill result in two additional commitments to state prison per year, the first year cost would be $58,000, the second year would be $116,000, and $174,00 thereafter assuming three-year sentences.
• Potential increase in nonreimbursable local incarceration costs to the extent persons would not have otherwise been convicted of the felony offense of extortion or other computer offenses under existing law. These costs may be partially offset by revenue from fines.

SUPPORT: (Verified 8/22/16)

Los Angeles County District Attorney (co-source)

TechNet (co-source)

Association for Los Angeles Deputy Sheriffs

Association of Deputy District Attorneys

Association of Orange County Deputy Sheriffs

California Association of Licensed Investigators

California Hospital Association

California Police Chiefs Association

California State Sheriffs’ Association

California Statewide Law Enforcement Association

Fraternal Order of Police, California State Lodge

Long Beach Police Officers Association

Los Angeles County Professional Peace Officers Association

Los Angeles Police Protective League

Los Angeles Probation Union, AFSCME, Local 685

Riverside Sheriffs' Association

Sacramento County Deputy Sheriffs’ Association

OPPOSITION: (Verified 8/22/16)

Legal Services for Prisoners with Children

ARGUMENTS IN SUPPORT: The sponsor, the Los Angeles County District Attorney, argues that this bill provides a clear statutory provision to prosecute ransomware because existing law may not properly cover the type of harm caused by ransomware. Ransomware impacts home computers, businesses, financial institutions, government agencies, academic institutions, and other organizations.

ARGUMENTS IN OPPOSITION: Legal Services for Prisoners with Children argues that these actions are already prohibited, such that a new crime and additional punishment is neither necessary nor prudent. This new law will not better protect individuals’ privacy.

ASSEMBLY FLOOR: 80-0, 8/23/16

AYES: Achadjian, Alejo, Travis Allen, Arambula, Atkins, Baker, Bigelow, Bloom, Bonilla, Bonta, Brough, Brown, Burke, Calderon, Campos, Chang, Chau, Chávez, Chiu, Chu, Cooley, Cooper, Dababneh, Dahle, Daly, Dodd, Eggman, Frazier, Beth Gaines, Gallagher, Cristina Garcia, Eduardo Garcia, Gatto, Gipson, Gomez, Gonzalez, Gordon, Gray, Grove, Hadley, Harper, Roger Hernández, Holden, Irwin, Jones, Jones-Sawyer, Kim, Lackey, Levine, Linder, Lopez, Low, Maienschein, Mathis, Mayes, McCarty, Medina, Melendez, Mullin, Nazarian, Obernolte, O'Donnell, Olsen, Patterson, Quirk, Ridley-Thomas, Rodriguez, Salas, Santiago, Steinorth, Mark Stone, Thurmond, Ting, Wagner, Waldron, Weber, Wilk, Williams, Wood, Rendon

Prepared by: Jerome McGuire / PUB. S. /

8/24/16 9:10:40

**** END ****

SENATE THIRD READING

STR Bill Id:SB 1137

Author:(Hertzberg)

As Amended Ver:August 19, 2016

Majority vote

SENATE VOTE: 39-0

SUMMARY: Clarifies that introducing "ransomware" into a computer or computer network with the intent of extorting money or property is punishable as extortion whether or not the money or property is actually obtained by means of the "ransomware." Specifically, this bill:

1. Clarifies that introducing "ransomware" into a computer or computer network with the intent of extorting money or property is punishable as extortion whether or not the money or property is actually obtained by means of the "ransomware." Such conduct would punishable by imprisonment in a county jail for two, three, or four years and a fine not exceeding $10,000.
2. Defines "Ransomware" to mean a "computer contaminant, as specified, or lock placed or introduced without authorization into a computer, computer system, or computer network that restricts access by an authorized person to the computer, computer system, computer network, or any data therein, under circumstances in which the person responsible for the placement or introduction of the ransomware demands payment of money or other consideration to remove the computer contaminant, restore access to the computer, computer system, computer network, or data, or otherwise remediate the impact of the computer contaminant or lock."
3. Specifies that a person is responsible for placing or introducing ransomware into a computer, computer system, or computer network if the person directly places or introduces the ransomware, or directs or induces another person do so, with the intent of demanding payment or other consideration to remove the ransomware, restore access, or otherwise remediate the impact of the ransomware.
4. States that prosecution under the provisions of this bill do not prohibit or limit prosecution under any other law.

EXISTING LAW:

1. Defines "extortion" as the obtaining of property from another, with his consent, or the obtaining of an official act of a public officer, induced by a wrongful use of force or fear, or under color of official right.
2. Specifies that fear, sufficient to constitute extortion, may be induced by a threat of any of the following:
   1. To do an unlawful injury to the person or property of the individual threatened or of a third person;
   2. To accuse the individual threatened, or any relative of his, or member of his family, of any crime;
   3. To expose, or to impute to him or them any deformity, disgrace or crime; or,
   4. To expose, any secret affecting him or them.
3. States that every person who extorts any money or other property from another, under circumstances not amounting to robbery or carjacking, by means of force, or any threat, such as is mentioned in existing provisions of law relating to threats sufficient to constitute extortion, shall be punished by custody time of two, three or four years.

Specifies that any person who commits any of the following acts is guilty of a crime:

• 1. Knowingly accesses and without permission alters, damages, deletes, destroys, or otherwise uses any data, computer, computer system, or computer network in order to either i) devise or execute any scheme or artifice to defraud, deceive, or extort, or ii) wrongfully control or obtain money, property, or data.
  2. Knowingly accesses and without permission takes, copies, or makes use of any data from a computer, computer system, or computer network, or takes or copies any supporting documentation, whether existing or residing internal or external to a computer, computer system, or computer network.
  3. Knowingly accesses and without permission adds, alters, damages, deletes, or destroys any data, computer software, or computer programs which reside or exist internal or external to a computer, computer system, or computer network.
  4. Knowingly and without permission disrupts or causes the disruption of computer services or denies or causes the denial of computer services to an authorized user of a computer, computer system, or computer network.
  5. Knowingly and without permission disrupts or causes the disruption of government computer services or denies or causes the denial of government computer services to an authorized user of a government computer, computer system, or computer network.
  6. Knowingly accesses and without permission adds, alters, damages, deletes, or destroys any data, computer software, or computer programs which reside or exist internal or external to a public safety infrastructure computer system computer, computer system, or computer network.
  7. Knowingly and without permission disrupts or causes the disruption of public safety infrastructure computer system computer services or denies or causes the denial of computer services to an authorized user of a public safety infrastructure computer system computer, computer system, or computer network.

1. States that any person who violates any of the provisions of 3a)-g) is guilty of a felony, punishable by imprisonment pursuant to Section 1170(h) for 16 months, or two or three years and a fine not exceeding $10,000, or a misdemeanor, punishable by imprisonment in a county jail not exceeding one year, by a fine not exceeding $5,000, or by both that fine and imprisonment.
2. Specifies that any person who commits any of the following acts is guilty of a crime:
   1. Knowingly and without permission provides or assists in providing a means of accessing a computer, computer system, or computer network in violation of this section;
   2. Knowingly and without permission accesses or causes to be accessed any computer, computer system, or computer network; and
   3. Knowingly and without permission provides or assists in providing a means of accessing a computer, computer system, or public safety infrastructure computer system computer, computer system, or computer network in violation of this section.
3. States that any person who violates 5a)-c) is punishable as follows:
   1. For a first violation that does not result in injury, an infraction punishable by a fine not exceeding $1,000;
   2. For any violation that results in a victim expenditure in an amount not greater than $5,000, or for a second or subsequent violation, by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both fine and imprisonment; and
   3. For any violation that results in a victim expenditure in an amount greater than $5,000, by a fine not exceeding $10,000, or by imprisonment pursuant to Section 1170(h) for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both fine and imprisonment.
4. Specifies that any person who commits any of the following acts is guilty of a crime:
   1. Knowingly introduces any computer contaminant into any computer, computer system, or computer network; and
   2. Knowingly introduces any computer contaminant into any public safety infrastructure computer system computer, computer system, or computer network.
5. States that any person who violates 7a)-b) is punishable as follows:
   1. For a first violation that does not result in injury, a misdemeanor punishable by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both fine and imprisonment; and
6. For any violation that results in injury, or for a second or subsequent violation, by a fine not exceeding $10,000, or by imprisonment in a county jail not exceeding one year, or by imprisonment pursuant to Section 1170(h), or by both fine and imprisonment.

COMMENTS: According to the author, "Kidnapping and ransom demands have been around as long as criminal activity itself. But what is new in today's digital age is the immediacy in which a computer hacker can access your computer and hold it hostage. Computer users are told that the only way to get their machines back is to pay a steep fine. This is known as "ransomware."

"SB 1137 addresses this new form of ransom in Penal Code. Currently, statutes on extortion can be used to prosecute ransomware crimes. However, extortion is based on the threat of future harm. When ransomware is used there is no threat to commit a future harm unless a ransom is paid, the harm has already occurred. The attacker is demanding payment to undo the harm they have already committed. The difference is slight, but extremely important in a criminal prosecution.

"Earlier this year, computers at Hollywood Presbyterian Medical Center became infected with malware that shut down their communications capabilities. After the 434-bed hospital had been reduced to keeping records with pen and paper, the facility paid a ransom of 40 bitcoins – about $17,000 – and regained access to its system.

"SB 1137 defines ransomware and outlines the punishment for those convicted of the crime. With advanced technology comes advanced forms of crime, and we must be properly equipped to address them."

Please see the policy committee analysis for a full discussion of this bill.

Analysis Prepared by: David Billingsley / PUB. S. / (916) 319-3744 FN: 0004639

SENATE THIRD READING

STR Bill Id:

Author:(Hertzberg)

As Amended Ver:

Majority vote

SENATE VOTE: 39-0

SUMMARY: Makes it a crime to knowingly introduce "ransomware" into a computer or computer network for the purpose of extorting payment. Specifically, this bill:

1. Makes it a crime for a person to knowingly introduce ransomware into any computer, computer system, or computer network. This bill would make a violation of this provision punishable by imprisonment in a county jail for two, three, or four years and a fine not exceeding $10,000.
2. Defines "Ransomware" mean a "computer contaminant or lock placed or introduced without authorization into a computer, computer system, or computer network that restricts access by an authorized person to the computer, computer system, computer network, or any data therein, under circumstances in which the person responsible for the placement or introduction of the ransomware demands payment of money or other consideration to remove the computer contaminant, restore access to the computer, computer system, computer network, or data, or otherwise remediate the impact of the computer contaminant or lock."
3. Specifies that a person is responsible for placing or introducing ransomware into a computer, computer system, or computer network if the person directly places or introduces the ransomware, or directs or induces another person do so, with the intent of demanding payment or other consideration to remove the ransomware, restore access, or otherwise remediate the impact of the ransomware.
4. Specifies that prosecution under that provision does not prohibit or limit prosecution under any other law.

EXISTING LAW:

1. Defines "extortion" as the obtaining of property from another, with his consent, or the obtaining of an official act of a public officer, induced by a wrongful use of force or fear, or under color of official right.
2. Specifies that fear, sufficient to constitute extortion, may be induced by a threat of any of the following:
   1. To do an unlawful injury to the person or property of the individual threatened or of a third person;
   2. To accuse the individual threatened, or any relative of his, or member of his family, of any crime;
   3. To expose, or to impute to him or them any deformity, disgrace or crime; or,
   4. To expose, any secret affecting him or them.
3. States that every person who extorts any money or other property from another, under circumstances not amounting to robbery or carjacking, by means of force, or any threat, such as is mentioned in existing provisions of law relating to threats sufficient to constitute extortion, shall be punished by custody time of two, three or four years. Specifies that any person who commits any of the following acts is guilty of a crime:
   1. Knowingly accesses and without permission alters, damages, deletes, destroys, or otherwise uses any data, computer, computer system, or computer network in order to either i) devise or execute any scheme or artifice to defraud, deceive, or extort, or ii) wrongfully control or obtain money, property, or data.
   2. Knowingly accesses and without permission takes, copies, or makes use of any data from a computer, computer system, or computer network, or takes or copies any supporting documentation, whether existing or residing internal or external to a computer, computer system, or computer network.
   3. Knowingly accesses and without permission adds, alters, damages, deletes, or destroys any data, computer software, or computer programs which reside or exist internal or external to a computer, computer system, or computer network.
   4. Knowingly and without permission disrupts or causes the disruption of computer services or denies or causes the denial of computer services to an authorized user of a computer, computer system, or computer network.
   5. Knowingly and without permission disrupts or causes the disruption of government computer services or denies or causes the denial of government computer services to an authorized user of a government computer, computer system, or computer network.
   6. Knowingly accesses and without permission adds, alters, damages, deletes, or destroys any data, computer software, or computer programs which reside or exist internal or external to a public safety infrastructure computer system computer, computer system, or computer network.
   7. Knowingly and without permission disrupts or causes the disruption of public safety infrastructure computer system computer services or denies or causes the denial of computer services to an authorized user of a public safety infrastructure computer system computer, computer system, or computer network.
4. States that any person who violates any of the provisions of 3a)-g) is guilty of a felony, punishable by imprisonment pursuant to Section 1170(h) for 16 months, or two or three years and a fine not exceeding $10,000, or a misdemeanor, punishable by imprisonment in a county jail not exceeding one year, by a fine not exceeding $5,000, or by both that fine and imprisonment.
5. Specifies that any person who commits any of the following acts is guilty of a crime:
   1. Knowingly and without permission provides or assists in providing a means of accessing a computer, computer system, or computer network in violation of this section;
   2. Knowingly and without permission accesses or causes to be accessed any computer, computer system, or computer network; and
   3. Knowingly and without permission provides or assists in providing a means of accessing a computer, computer system, or public safety infrastructure computer system computer, computer system, or computer network in violation of this section.
6. States that any person who violates 5a)-c) is punishable as follows:
   1. For a first violation that does not result in injury, an infraction punishable by a fine not exceeding $1,000;
   2. For any violation that results in a victim expenditure in an amount not greater than $5,000, or for a second or subsequent violation, by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both fine and imprisonment; and
   3. For any violation that results in a victim expenditure in an amount greater than $5,000, by a fine not exceeding $10,000, or by imprisonment pursuant to Section 1170(h) for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both fine and imprisonment.
7. Specifies that any person who commits any of the following acts is guilty of a crime:
   1. Knowingly introduces any computer contaminant into any computer, computer system, or computer network; and
   2. Knowingly introduces any computer contaminant into any public safety infrastructure computer system computer, computer system, or computer network.
8. States that any person who violates 7a)-b) is punishable as follows:
   1. For a first violation that does not result in injury, a misdemeanor punishable by a fine not exceeding $5,000, or by imprisonment in a county jail not exceeding one year, or by both fine and imprisonment; and
   2. For any violation that results in injury, or for a second or subsequent violation, by a fine not exceeding $10,000, or by imprisonment in a county jail not exceeding one year, or by imprisonment pursuant to Section 1170(h), or by both fine and imprisonment.

COMMENTS: According to the author, "Kidnapping and ransom demands have been around as long as criminal activity itself. But what is new in today's digital age is the immediacy in which a computer hacker can access your computer and hold it hostage. Computer users are told that the only way to get their machines back is to pay a steep fine. This is known as "ransomware."

"SB 1137 addresses this new form of ransom in Penal Code. Currently, statutes on extortion can be used to prosecute ransomware crimes. However, extortion is based on the threat of future harm. When ransomware is used there is no threat to commit a future harm unless a ransom is paid, the harm has already occurred. The attacker is demanding payment to undo the harm they have already committed. The difference is slight, but extremely important in a criminal prosecution.

"Earlier this year, computers at Hollywood Presbyterian Medical Center became infected with malware that shut down their communications capabilities. After the 434-bed hospital had been reduced to keeping records with pen and paper, the facility paid a ransom of 40 bitcoins – about $17,000 – and regained access to its system. (http://www.latimes.com/business/technology/la-me-ln-hollywood-hospital-bitcoin-20160217-story.html)

"SB 1137 defines ransomware and outlines the punishment for those convicted of the crime. With advanced technology comes advanced forms of crime, and we must be properly equipped to address them."

Analysis Prepared by: David Billingsley / PUB. S. / (916) 319-3744 FN: 0004128

Date of Hearing: August 3, 2016

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Lorena Gonzalez, Chair

SBPCA Bill Id:SB 1137

Author:(Hertzberg) – As Amended Ver:August 1, 2016

Urgency: No State Mandated Local Program: Yes Reimbursable: No

SUMMARY:

This bill provides that a person who knowingly introduces “ransomware,” as defined, into any computer, computer system, or computer network is guilty of a felony, punishable by imprisonment in a county jail, or state prison under specified circumstances, for two, three, or four years, and/or a fine of up to $10,000.

FISCAL EFFECT:

1. Potential moderate increased cost (General Fund) to the California Department of Corrections and Rehabilitation (CDCR ) for new commitments to state prison that would not have otherwise been convicted under the extortion statutes, or potentially longer sentences for convictions that otherwise would have been charged as other computer crimes. To the extent the provisions of this measure result in two additional commitments to state prison per year, the first year cost would be $58,000, the second year would be $116,000, and $174,00 thereafter assuming three-year sentences.
2. Potential increase in nonreimbursable local incarceration costs to the extent persons would not have otherwise been convicted of the felony offense of extortion or other computer offenses under existing law. These costs may be partially offset by revenue from fines.

COMMENTS:

1. Purpose. According to the author, "Kidnapping and ransom demands have been around as long as criminal activity itself. But what is new in today’s digital age is the immediacy in which a computer hacker can access your computer and hold it hostage. Computer users are told that the only way to get their machines back is to pay a steep fine. This is known as “ransomware

In practice, ransomware is simply a high-tech version of extortion, using the loss of access to one's data or computer as leverage to extort an electronic payment from the owner of the infected device.

This bill is intended to explicitly and clearly prohibit the use of malicious computer programs to infect computers or data and lock an authorized user out, and then extort money from that user in exchange for removing the ransomware or otherwise restoring access.

1. Background. Current law defines "extortion" as the obtaining of property from another, with consent, or the obtaining of an official act of a public officer, induced by a wrongful use of force or fear, or under color of official right. Current law also specifies that every person who extorts any money or other property from another, under circumstances not amounting to robbery or carjacking, by means of force, or any threat, such as is mentioned in existing provisions of law relating to threats sufficient to constitute extortion is guilty of a crime.

Current law establishes various crimes relating to computer services and systems, including, but not limited to, knowingly introducing a computer contaminant. It also makes a violation of those crimes relating to computer services punishable by specified fines or terms of imprisonment, or by both those fines and imprisonment.

According to the author's office, "The L.A. Times reports that since 2010 at least 158 institutions, including medical providers, insurers and hospitals, have reported being hacked or having information technology issues that compromised patient records. Earlier this year, computers at Hollywood Presbyterian Medical Center became infected with malware that shut down their communications capabilities. After the 434-bed hospital had been reduced to keeping records with pen and paper, the facility paid a ransom of 40 bitcoins -- about $17,000 -- and regained access to its system. More than a week later, computers at the Los Angeles County Department of Health Services became infected with a program that blocked access to their data. According to a recent report by the Institute for Critical Infrastructure Technology, ransomware will 'wreak havoc' on the United States’ critical infrastructure community in 2016."

1. Support. The sponsors, the Los Angeles District Attorney's Office, argues that this bill provides a clear code section to prosecute ransomware because existing law may not properly cover the type of harm caused by ransomware. Ransomware impacts home computers, businesses, financial institutions, government agencies, academic institutions, and other organizations.
2. Opposition. Legal Services for Prisoners with Children argues that these actions are already prohibited, a new crime and additional punishment is neither necessary nor prudent. This new law will simply create longer sentences for individuals convicted of violating these provisions, which does not better protect individual's privacy.
3. Prior Legislation:
4. AB 32 (Waldron), Chapter 614, Statutes of 2015, increased the fines for felony convictions of specified computer crimes from a maximum of $5,000 to a maximum of $10,000.
5. AB 32 (Waldron), Chapter 614, Statutes of 2015, increased the fines for felony convictions of specified computer crimes from a maximum of $5,000 to a maximum of $10,000.

Analysis Prepared by: Pedro Reyes / APPR. / (916) 319-2081

Date of Hearing: June 28, 2016

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Ed Chau, Chair

SBPCA Bill Id:SB 1137

Author:(Hertzberg) – As Amended Ver:March 31, 2016

SENATE VOTE: 39-0

SUBJECT: Computer crimes: ransomware

SUMMARY: Makes the knowing introduction of ransomware into a computer with the intent of demanding payment to remove the ransomware or reverse its effects a felony, punishable by up to four years in prison and a fine not exceeding ten thousand dollars ($10,000). Specifically, this bill:

1. Makes it a felony to knowingly introduce ransomware into any computer, computer system, or computer network and specifies punishment as imprisonment for two, three, or four years and a fine not exceeding ten thousand dollars ($10,000).
2. Clarifies that prosecution for the knowing introduction of ransomware does not prohibit or limit prosecution under any other law.
3. Defines "ransomware" as "a computer or data contaminant or lock placed in or introduced into a computer system, computer or data in a computer system, or computer that restricts access to the system, computer, or data in some way, and under circumstances in which the person responsible for the ransomware demands payment of money or other consideration to remove the contaminant, unlock the computer system or computer, or repair the injury done to the computer system, computer, or data by the contaminant or lock."
4. Further provides that a person is responsible for placing or introducing a contaminant or lock into a computer system, computer or data on a computer system, or computer if the person directly places or introduces the contaminant or lock, directs another to do so, or induces another person do so, with the intent of demanding payment or other consideration to remove the contaminant, unlock the computer system or computer, or repair the computer system, computer or data on the computer system, or computer.
5. Provides that no reimbursement is required because the only costs that may be incurred by a local agency or school district will be incurred because this bill creates a new crime or infraction, eliminates a crime or infraction, changes the penalty for a crime or infraction, or changes the definition of a crime.

EXISTING LAW:

1. Establishes various crimes relating to computer services and systems, including, but not limited to, knowingly introducing a computer contaminant. (Penal Code Section (PC) 502(c))
2. Makes a violation of those crimes relating to computer services punishable by specified fines or terms of imprisonment, or by both those fines and imprisonment. (PC 502(d))
3. Authorizes, in addition to any other civil remedy available, the owner or lessee of the computer, computer system, computer network, computer program, or data who suffers damage or loss by reason of a violation of a computer crime may bring a civil action against the violator for compensatory damages and injunctive relief or other equitable relief, as well as reasonable attorney's fees. (PC 502(e))
4. Deems any computer, computer system, computer network, or any software or data, owned by the defendant, that is used during the commission of a computer crime, or any computer owned by the defendant used as a repository for the storage of software or data illegally obtained, shall be subject to forfeiture, as specified. (PC 502(g))
5. Defines a “computer contaminant” as "any set of computer instructions that are designed to modify, damage, destroy, record, or transmit information within a computer, computer system, or computer network without the intent or permission of the owner of the information. They include, but are not limited to, a group of computer instructions commonly called viruses or worms, that are self-replicating or self-propagating and are designed to contaminate other computer programs or computer data, consume computer resources, modify, destroy, record, or transmit data, or in some other fashion usurp the normal operation of the computer, computer system, or computer network." (PC 502 (b)(12))
6. Defines extortion as "the obtaining of property from another, with his consent, or the obtaining of an official act of a public officer, induced by a wrongful use of force or fear, or under color of official right." (PC 512)

FISCAL EFFECT: According to the Senate Appropriations Committee, this bill would have the following fiscal impacts:

State prisons: Potential minor increase in state costs (General Fund) for new commitments to state prison that would not have otherwise been convicted under the extortion statutes, or potentially longer sentences for convictions that otherwise would have been charged as other computer crimes. [The California Department of Corrections and Rehabilitation] data indicates 29 commitments to state prison in 2015 under the extortion statutes. To the extent the provisions of this measure result in even two additional commitments to state prison in any one year would result in state costs of $58,000 assuming the contract bed rate of $29,000 per inmate.

County jails: Potential increase in local incarceration costs (Local Funds) to the extent persons would not have otherwise been convicted of the felony offense of extortion or other computer offenses under existing law.

COMMENTS:

1. Purpose of this bill. This bill is intended to explicitly and clearly prohibit the use of malicious computer programs called "ransomware" to infect computers or data and lock an authorized user out, and then extort money from that user in exchange for removing the ransomware or otherwise restoring access. This bill is co-sponsored by TechNet and Los Angeles County District Attorney Jackie Lacey.
2. Author's statement. According to the author's office, "The L.A. Times reports that since 2010 at least 158 institutions, including medical providers, insurers and hospitals, have reported being hacked or having information technology issues that compromised patient records. Earlier this year, computers at Hollywood Presbyterian Medical Center became infected with malware that shut down their communications capabilities. After the 434-bed hospital had been reduced to keeping records with pen and paper, the facility paid a ransom of 40 bitcoins -- about $17,000 -- and regained access to its system. More than a week later, computers at the Los Angeles County Department of Health Services became infected with a program that blocked access to their data. According to a recent report by the Institute for Critical Infrastructure Technology, ransomware will 'wreak havoc' on the United States’ critical infrastructure community in 2016."
3. Understanding ransomware. According to cybersecurity firm Kaspersky Labs, ransomware is "a type of malware that, upon infecting a device, blocks access to it or to some or all of the information stored on it. In order to unlock either the device or the data, the user is required to pay a ransom, usually in bitcoins or another widely used e-currency." In practice, ransomware is simply a high-tech version of extortion, using the loss of access to one's data or computer as leverage to extort an electronic payment from the owner of the infected device.
   
   The potential impacts of a ransomware infection are serious. According to the Federal Bureau of Investigation (FBI), "Hospitals, school districts, state and local governments, law enforcement agencies, small businesses, large businesses—these are just some of the entities impacted recently by ransomware, an insidious type of malware that encrypts, or locks, valuable digital files and demands a ransom to release them. The inability to access the important data these kinds of organizations keep can be catastrophic in terms of the loss of sensitive or proprietary information, the disruption to regular operations, financial losses incurred to restore systems and files, and the potential harm to an organization’s reputation. And, of course, home computers are just as susceptible to ransomware, and the loss of access to personal and often irreplaceable items—including family photos, videos, and other data—can be devastating for individuals as well." As a result, victims have to deal not only with the loss of access and potentially paying the cost of the ransom, but also the attendant costs of dealing with identity theft and remediating the underlying breach to re-secure the system.
   
   The author's office cites FBI statistics showing that more than $209 million in ransomware payments have been paid by victims in the United States in the first three months of 2016, compared to $25 million in all of last year.
   
4. Ransomware attacks on the rise. In an April 2016 news bulletin, the FBI warns that incidents of ransomware are on the rise: "Ransomware has been around for a few years, but during 2015, law enforcement saw an increase in these types of cyber attacks, particularly against organizations because the payoffs are higher. And if the first three months of this year are any indication, the number of ransomware incidents—and the ensuing damage they cause—will grow even more in 2016 if individuals and organizations don’t prepare for these attacks in advance."
   
   These attacks have also become far more sophisticated. The same FBI bulletin states that "[s]everal years ago, ransomware was normally delivered through spam e-mails, but because e-mail systems got better at filtering out spam, cyber criminals turned to spear phishing e-mails targeting specific individuals. And in newly identified instances of ransomware, some cyber criminals aren’t using e-mails at all," and are instead "seeding legitimate websites with malicious code, taking advantage of unpatched software on end-user computers."
   
   Two well-publicized examples of ransomware attacks in California are cited by co-sponsor TechNet as evidence of how serious the threat is: "During February 2016, the Los Angeles County Department of Health Services computers were targets of a 'ransomware' cyberattack. The agency identified remnants of a ransomware thread on five work computers, but operations were not affected and the county did not pay a ransom. On the other hand, Hollywood Presbyterian Medical Center paid a $17,000 ransom in bitcoin to hackers who seized control of the hospital’s computer system on February 5. The attack forced the hospital to return to pen and paper for its record-keeping. In the best interest of restoring normal operations, the hospital paid the ransom to obtain the decryption key."
5. Arguments in support. According to co-sponsor, the Los Angeles District Attorney's Office, "SB 1137 provides a clear code section to prosecute this specific type of computer crime. Existing law does not adequately provide prosecutors with the tools to prosecute this type of crime. SB 1137 eliminates the argument that triggering a system malfunction that implements a restriction is not a contaminant for purposes of Penal Code Section 502. SB 1137 also eliminates this type of argument for password-lockout situations, in which the attacker resets the victim's password and holds it hostage."
   
   "SB 1137 also provides prosecutors a much needed tool to prosecute attackers who use ransomware because California's existing extortion statute (Penal Code 518) may not properly cover the type of harm caused by ransomware. Penal Code 518 makes it a crime to obtain property from an individual with the individual's consent by a wrongful use of force or fear. A wrongful use of fear for the purpose of extortion requires a threat to do an unlawful injury to the property of an individual. In cases of ransomware there is no threat to do harm to the property of another because the harm has already been caused by the introduction of the malware…When ransomware is used there is no threat to commit a future harm unless a ransom is paid, the harm has already occurred. The attacker is demanding payment to undo the harm they have already committed. The difference is slight but extremely important in a criminal prosecution."
   
   According to co-sponsor TechNet, "we are proud to sponsor SB 1137 (Hertzberg) Ransomware Prevention, which makes it a crime to infect computers, computer systems, or networks with ransomware. We agree ransomware not only affects victims financially, but also imposes additional costs of replacing breached hardware, bringing legal action, and updating system security. This doesn’t just impact home computers. Businesses, financial institutions, government agencies, academic institutions, and other organizations are often targets."
6. Arguments in opposition. According to Legal Services for Prisoners with Children, "[ransomware] is already covered by existing law. Penal Code section 502(c) makes it a crime to access a person's computer, to delete data in order to extort money from them, to damage or delete a person's data without their permission, to disrupt the services of another's computer, and to introduce a computer contaminant (virus) to a computer system. Some of these are already felonies. Because these actions are already prohibited, a new crime and additional punishment is neither necessary nor prudent. This will simply create longer sentences for individuals convicted of violating these provisions, which does not better protect individual's privacy."
   
7. Previous legislation. AB 32 (Waldron), Chapter 614, Statutes of 2015, increased the fines for felony convictions of specified computer crimes from a maximum of $5,000 to a maximum of $10,000.
   
   AB 1649 (Waldron), Chapter 379, Statutes of 2014, provided that the crimes and penalties for unauthorized access of or damage to a computer, computer system or data specifically and separately apply to government and public safety infrastructure computers, computer systems and data.
8. Double-referral. This bill was double-referred to the Assembly Public Safety Committee on June 21, 2016, where it passed 7-0.

REGISTERED SUPPORT / OPPOSITION:

Support

Los Angeles County District Attorney’s Office (co-sponsor)

TechNet (co-sponsor)

AFSCME Local 658

Association for Los Angeles Deputy Sheriffs

Association of Deputy District Attorneys

Association of Orange County Deputy Sheriffs

California Association of Licensed Investigators

California Hospital Association

California Police Chiefs Association

California State Sheriffs’ Association

California Statewide Law Enforcement Association

Fraternal Order of Police

Long Beach Police Officers Association

Los Angeles County Professional Peace Officers Association

Los Angeles Police Protective League

Los Angeles Probation Officer’s Union

Riverside Sheriffs Association

Sacramento County Deputy Sheriffs’ Association

Opposition

Legal Services for Prisoners with Children

Analysis Prepared by: Hank Dempsey & Karim Troost / P. & C.P. / (916) 319-2200

Date of Hearing: June 21, 2016

Counsel: David Billingsley

ASSEMBLY COMMITTEE ON PUBLIC SAFETY

Reginald Byron Jones-Sawyer, Sr., Chair

SBPCA Bill Id:SB 1137

Author:(Hertzberg) – As Amended Ver:March 31, 2016

SUMMARY: Makes it a crime to knowingly introduce “ransomware” into a computer or computer network for the purpose of extorting payment. Specifically, this bill:

1. Makes it a crime for a person to knowingly introduce ransomware into any computer, computer system, or computer network. This bill would make a violation of this provision punishable by imprisonment in a county jail for two, three, or four years and a fine not exceeding $10,000. 
   
2. Defines “ransomware” to mean a “computer or data contaminant or lock placed in or introduced into a computer system, computer or data in a computer system, or computer that restricts access to system, computer, or data in some way, and under circumstances in which the person responsible for the ransomware demands payment of money or other consideration to remove the  contaminant, unlock the computer system or computer, or repair the injury done to the computer system, computer, or data by the contaminant or lock.”
   
3. Specifies that a person is responsible for placing or introducing a contaminant or lock into a computer system, computer or data on a computer system, or computer if the person directly places or introduces the contaminant or lock, directs another to do so, or induces another person do so, with the intent of demanding payment or other consideration to remove the contaminant, unlock the computer system or computer, or repair the computer system, computer or data on the computer system, or computer.
4. Specifies that prosecution under that provision does not prohibit or limit prosecution under any other law.

EXISTING LAW:

1. Defines "extortion" as the obtaining of property from another, with his consent, or the obtaining of an official act of a public officer, induced by a wrongful use of force or fear, or under color of official right. (Pen. Code, § 518.)
   
2. Specifies that fear, sufficient to constitute extortion, may be induced by a threat of any of the following:
   
   1. To do an unlawful injury to the person or property of the individual threatened or of a third person;
      
   2. To accuse the individual threatened, or any relative of his, or member of his family, of any crime;
      
   3. To expose, or to impute to him or them any deformity, disgrace or crime; or,
      
   4. To expose, any secret affecting him or them. (Pen. Code, § 519.)
      
3. States that every person who extorts any money or other property from another, under circumstances not amounting to robbery or carjacking, by means of force, or any threat, such as is mentioned in existing provisions of law relating to threats sufficient to constitute extortion, shall be punished by custody time of two, three or four years. (Pen. Code Section 520.)
   
4. Provides that every person who commits any extortion under color of official right, in cases for which a different punishment is not prescribed in the Penal Code, is guilty of a misdemeanor. (Pen. Code Section 521.)
   
5. States that every person who attempts, by means of any threat, such as is specified in existing provisions of law relating to threats sufficient to constitute extortion, to extort money or other property from another is punishable by imprisonment in the county jail not longer than one year or in the state prison or by fine not exceeding ten thousand dollars ($10,000), or by both such fine and imprisonment. (Pen. Code Section 524.)
   
6. Specifies that any person who commits any of the following acts is guilty of a crime:
   
   1. Knowingly accesses and without permission alters, damages, deletes, destroys, or otherwise uses any data, computer, computer system, or computer network in order to either (A) devise or execute any scheme or artifice to defraud, deceive, or extort, or (B) wrongfully control or obtain money, property, or data. (Pen. Code, § 502, subd. (c)(1).) 
      
   2. Knowingly accesses and without permission takes, copies, or makes use of any data from a computer, computer system, or computer network, or takes or copies any supporting documentation, whether existing or residing internal or external to a computer, computer system, or computer network. (Pen. Code, § 502, subd. (c)(2).)
      
   3. Knowingly accesses and without permission adds, alters, damages, deletes, or destroys any data, computer software, or computer programs which reside or exist internal or external to a computer, computer system, or computer network. (Pen. Code, § 502, subd. (c)(4).)
      
   4.  Knowingly and without permission disrupts or causes the disruption of computer services or denies or causes the denial of computer services to an authorized user of a computer, computer system, or computer network. (Pen. Code, § 502, subd. (c)(5).)
      
   5. Knowingly and without permission disrupts or causes the disruption of government computer services or denies or causes the denial of government computer services to an authorized user of a government computer, computer system, or computer network. (Pen. Code, § 502, subd. (c)(10).)
      
   6. Knowingly accesses and without permission adds, alters, damages, deletes, or destroys any data, computer software, or computer programs which reside or exist internal or external to a public safety infrastructure computer system computer, computer system, or computer network. (Pen. Code, § 502, subd. (c)(11).)
      
   7. Knowingly and without permission disrupts or causes the disruption of public safety infrastructure computer system computer services or denies or causes the denial of computer services to an authorized user of a public safety infrastructure computer system computer, computer system, or computer network. (Pen. Code, § 502, subd. (c)(12).)
      
7. States that any person who violates any of the provisions of 6(a)-(g) is guilty of a felony, punishable by imprisonment pursuant to subdivision (h) of Section 1170 for 16 months, or two or three years and a fine not exceeding ten thousand dollars ($10,000), or a misdemeanor, punishable by imprisonment in a county jail not exceeding one year, by a fine not exceeding five thousand dollars ($5,000), or by both that fine and imprisonment.
   
8. Specifies that any person who commits any of the following acts is guilty of a crime:
   
   1. Knowingly and without permission provides or assists in providing a means of accessing a computer, computer system, or computer network in violation of this section; (Pen. Code, § 502, subd. (c)(6).)
      
   2. Knowingly and without permission accesses or causes to be accessed any computer, computer system, or computer network; and (Pen. Code, § 502, subd. (c)(7).)
      
   3. Knowingly and without permission provides or assists in providing a means of accessing a computer, computer system, or public safety infrastructure computer system computer, computer system, or computer network in violation of this section. (Pen. Code, § 502, subd. (c)(13).)
      
9. States that any person who violates 8(a)-(c) is punishable as follows:
   
   1. For a first violation that does not result in injury, an infraction punishable by a fine not exceeding one thousand dollars ($1,000);
      
   2. For any violation that results in a victim expenditure in an amount not greater than five thousand dollars ($5,000), or for a second or subsequent violation, by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both fine and imprisonment; and
      
   3. For any violation that results in a victim expenditure in an amount greater than five thousand dollars ($5,000), by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment pursuant to subdivision (h) of Section 1170 for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both fine and imprisonment.
      
10. Specifies that any person who commits any of the following acts is guilty of a crime:
    
    1. Knowingly introduces any computer contaminant into any computer, computer system, or computer network; and (Pen. Code, § 502, subd. (c)(8).)
       
    2. Knowingly introduces any computer contaminant into any public safety infrastructure computer system computer, computer system, or computer network. (Pen. Code, § 502, subd. (c)(14).)
       
11.  States that any person who violates 10(a)-(b) is punishable as follows:
    
    1. For a first violation that does not result in injury, a misdemeanor punishable by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both fine and imprisonment; and
       
    2. For any violation that results in injury, or for a second or subsequent violation, by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment in a county jail not exceeding one year, or by imprisonment pursuant to subdivision (h) of Section 1170, or by both fine and imprisonment.
       
12. States that in addition to any other civil remedy available, the owner or lessee of the computer, computer system, computer network, computer program, or data who suffers damage or loss by reason of a violation of specified computer may bring a civil action against the violator for compensatory damages and injunctive relief or other equitable relief. (Pen. Code, § 502, subd. (e)(1).)

FISCAL EFFECT: Unknown.

COMMENTS:

1. Author's Statement: According to the author, "Kidnapping and ransom demands have been around as long as criminal activity itself. But what is new in today’s digital age is the immediacy in which a computer hacker can access your computer and hold it hostage. Computer users are told that the only way to get their machines back is to pay a steep fine. This is known as “ransomware.”
   

“SB 1137 addresses this new form of ransom in Penal Code. Currently, statutes on extortion can be used to prosecute ransomware crimes. However, extortion is based on the threat of future harm. When ransomware is used there is no threat to commit a future harm unless a ransom is paid, the harm has already occurred. The attacker is demanding payment to undo the harm they have already committed. The difference is slight, but extremely important in a criminal prosecution.

“Earlier this year, computers at Hollywood Presbyterian Medical Center became infected with malware that shut down their communications capabilities. After the 434-bed hospital had been reduced to keeping records with pen and paper, the facility paid a ransom of 40 bitcoins -- about $17,000 -- and regained access to its system.

“SB 1137 defines ransomware and outlines the punishment for those convicted of the crime. With advanced technology comes advanced forms of crime, and we must be properly equipped to address them.”

1. Ransomware: Ransomware is a type of malware that restricts access to the infected computer system in some way, and demands that the user pay a ransom to the malware operators to remove the restriction. Some forms of ransomware systematically encrypt files on the system's hard drive, which become difficult or impossible to decrypt without paying the ransom for the encryption key.
   

Payment is virtually always the goal, and the victim is coerced into paying for the ransomware to be removed—which may or may not actually occur—either by supplying a program that can decrypt the files, or by sending an unlock code that undoes the payload's changes. A key element in making ransomware work for the attacker is a convenient untraceable payment system. A range of such payment methods have been used, including: wire transfer, premium-rate text messages, online payment voucher service such as Ukash or Paysafecard, and the digital currency Bitcoin.

1. Ransomware is a Crime under Existing California Law: The use of ransomware to demand a payment from a computer or computer system owner or operator appears to constitute extortion under existing California law. California law makes it a felony to commit extortion. "Extortion" is defined as obtaining property from another, with his consent by a use of force or fear. (Pen. Code, § 518.) Existing law states that fear, sufficient to establish extortion, may be established by a threat do an unlawful injury to the person or property of the individual.
   
   A demand for money based on the introduction of “ransomware” to an individual computer or to a computer network seems to fit within the crime of extortion. If the computer owner fails to pay the “ransom”, they face financial losses if they are unable to access data, programs, or computer functionality that they need. In addition to any financial losses, the computer user is denied the use of, and access to, their property. If the fear of such consequences results in payment to remove the ransomware, the crime of extortion has been committed.
   

California law (Pen. Code, § 502 – the section amended by this bill) also makes it a crime to access, damage or alter a computer system or data without permission. Section 502 specifically lists prohibited acts and provides various penalties, based on the severity of the harm caused or value of services taken.

This bill would add the use of ransomware as a computer crime in Section 502. The penalty for this form of computer crimes is the same as the penalty for extortion, a felony term of two, three, or four years. (Pen. Code, §§ 518-527.)

1. Governor’s 2016 Veto Message Regarding “Multiplication” and “Particularization” of Crimes: In 2015, the Governor vetoed a number of criminal justice bills because they created new crimes for conduct that was already prohibited. The bills the Governor vetoed on this basis included: AB 144, AB 849, SB 168, SB 170, SB 271, SB 333, SB 347, SB 716, SB 722
   
   The Governor vetoed those bills and issued this statement applying to all the bills:
   

“Each of these bills creates a new crime - usually by finding a novel way to characterize and criminalize conduct that is already proscribed. This multiplication and particularization of criminal behavior creates increasing complexity without commensurate benefit. 

“Over the last several decades, California's criminal code has grown to more than 5,000 separate provisions, covering almost every conceivable form of human misbehavior. During the same period, our jail and prison populations have exploded. 

“Before we keep going down this road, I think we should pause and reflect on how our system of criminal justice could be made more human, more just and more cost-effective.”

As pointed out above, “ransomware” is already criminal behavior prohibited by existing law.

1. Argument in Support: According to the Los Angeles County District Attorney, “Attackers using ransomware don’t just target private individuals. Businesses, financial institutions, government agencies, academic institutions, and other organizations are often targets. According to the L.A. Times, since 2010 at least 158 institutions, including medical providers, insurers and hospitals, have reported being hacked or having information technology issues that compromised patient records.
   
   “During February 2016, the Los Angeles County Department of Health Services computers were targets of a “ransomware” cyber attack. The agency identified remnants of a ransomware thread on five work computers, but operations were not affected and the county did not pay a ransom. On the other hand, Hollywood Presbyterian Medical Center paid a $17,000 ransom in bitcoin to hackers who seized control of the hospital’s computer system on February 5. The attack forced the hospital to return to pen and paper for its record-keeping. In the best interest of restoring normal operations, the hospital paid the ransom to obtain the decryption key.
   
   “SB 1137 provides a clear code section to prosecute this specific type of computer crime. Existing law does not adequately provide prosecutors with the tools to prosecute this type of crime. SB 1137 eliminates the argument that triggering a system function that implements a restriction is not a contaminant for purposes of Penal Code Section 502. SB 1137 also eliminates this type of argument for password-lockout situations, in which the attacker resets the victim’s password and holds it hostage. SB 1137 also provides prosecutors a much needed tool to prosecute attackers who use ransomware because California’s existing extortion statute (Penal Code 518) may not properly cover the type of harm caused by ransomware.
   
   “Penal Code Section 518 makes it a crime to obtain property from an individual with the individual’s consent by a wrongful use of fear. A wrongful use of fear for the purpose of extortion requires a threat to do an unlawful injury to the property of another because the harm has already been caused by the introduction of the malware.
   
   “For example in a traditional extortion prosecution, a defendant is charged with extortion for threatening to cause physical harm to an individual or their property (pay me $1 million or I will break your legs or I will burn your business to the ground). In these prosecutions it is the threat to commit the harm unless a ransom is paid that is prosecuted.
   
   “When ransomware is used there is no threat to commit a future harm unless a ransom is paid, the harm has already occurred. The attacker is demanding to undo the harm they have already committed. The difference is slight but extremely important in a criminal prosecution.
   
2. Argument in Opposition: According to Legal Services for Prisoners with Children, “This bill would create a specific prohibition against infecting a person’s computer with 'ransomware,' causing their computer to fail to operate, and extorting money from them. However, this activity is already covered by existing law. Penal Code section 502(c) makes it a crime to access a person’s computer, to delete data in order to extort money from them, to damage or delete a person’s data without their permission, to disrupt the services of another’s computer, and to introduce a computer contaminant (virus) to a computer system. Some of these are already felonies.
   
   “Because these actions are already prohibited, a new crime and additional punishment is neither necessary nor prudent. This will simply create longer sentences for individuals convicted of violating these provisions, which does not increase public safety.”
   
3. Related Legislation:
   
   1. AB 32 (Waldron), Chapter 614, Statutes of 2015, increased fines for felony convictions of specified computer crimes from a maximum of $5,000, to a maximum of $10,000.
      
4. Prior Legislation:
   
   1. AB 1649 (Waldron), Chapter 379, Statutes of 2014, provided that the crimes and penalties for unauthorized access of or damage to a computer, computer system or data shall apply to government and public safety infrastructure computers, computer systems and data.
      

REGISTERED SUPPORT / OPPOSITION:

Support

Los Angeles County District Attorney’s Office (Co-Sponsor)

TechNet (Co-Sponsor)
AFSCME Local 685
Association of Deputy District Attorneys
Association of Orange County Deputy Sheriffs
California Association of Licensed Investigators
California District Attorneys Association
California Hospital Association
California Police Chiefs Association

California State Sheriffs’ Association
California Statewide Law Enforcement Association

Fraternal Order of Police
Los Angeles Deputy Sheriffs
Los Angeles Police Protective League
Los Angeles Probation Officer’s Union
Long Beach Police officers Association
Riverside Sheriffs Association
Sacramento County Deputy Sheriffs’ Association

Opposition

Legal Services for Prisoners with Children

Analysis Prepared by: David Billingsley / PUB. S. / (916) 319-3744

 THIRD READING  

Bill No: SB 1137

Author: Hertzberg (D), et al.

Amended: 3/31/16

Vote: 21

SENATE PUBLIC SAFETY COMMITTEE: 6-0, 4/12/16

AYES: Hancock, Glazer, Leno, Liu, Monning, Stone

NO VOTE RECORDED: Anderson

SENATE APPROPRIATIONS COMMITTEE: 7-0, 5/27/16

AYES: Lara, Bates, Beall, Hill, McGuire, Mendoza, Nielsen

SUBJECT: Computer crimes: ransomware

SOURCE: Los Angeles County District Attorney

TechNet

DIGEST: This bill separately defines as a felony the crime of placing a contaminant or lock on a computer or computer system for the purpose of locking or controlling the computer, computer system or data files, coupled with a demand for payment of money or other consideration before the lock will be removed of control returned to owner or authorized user; and specifically defines such a contaminant or lock as “ransomware.”

ANALYSIS:

Existing law:

1) Defines numerous computer or electronic data offenses and imposes a wide range of penalties based on the seriousness of the offense or extent of harm caused by the defendant, including by felony imprisonment pursuant to Penal Code Section 1170, subdivision (h) for a term of term of 16 months, two years or three years and a fine of up to $10,000, or as misdemeanor by a fine not exceeding $5,000, or a fine of up to $1,000 by imprisonment in a county jail not exceeding one year, or as infraction. (Pen. Code § 502.) These penalties apply where any person knowingly:

a) Accesses and without permission alters, damages, deletes, destroys, or otherwise uses any data, computer, computer system, or computer network in order to devise or execute any scheme or artifice to defraud, deceive, or extort, or wrongfully control or obtain money, property or data.

b) Accesses and without permission takes, copies or makes use of any data from a computer, computer system, or computer network, or takes or copies any supporting documentation, whether existing or residing internal or external to a computer, computer system, or computer network.

c) Accesses and without permission adds, alters, damages, deletes, or destroys any data, computer software, or computer programs which reside or exist internal or external to a computer, computer system, or computer network

d) Without permission, disrupts or causes the disruption of computer services or denies or causes the denial of computer services, or denies or causes the denial of computer services to an authorized user of a computer, computer system, or computer network.

e) Disrupts or improperly accesses a government or public safety computer system.

f) Without permission provides or assists in providing a means of accessing, accesses, or causes to be accessed a computer, computer system, or computer network.

g) Introduces any computer contaminant into any computer, or computer system, or computer network as specified.

h) Without permission uses the Internet domain name of another individual, corporation, or entity in connection with the sending of one or more electronic mail messages, and thereby damages or causes damage to a computer, computer system, or computer network as specified. (Pen. Code § 502, subds. (c)(9) and (d)(5).)

2) Defines extortion as the obtaining of property from another person, without the person’s consent, or obtaining an official act of a public officer, induced by the wrongful use of force or fear, or under color of official right. (Pen. Code § 518.)

3) Defines force or fear sufficient to commit extortion as a threat to do any of the following:

a) Injure the person or property of the person threatened or a third person.

b) Accuse the threatened person or a relative of a crime.

c) Expose or impute to the person threatened or a relative any deformity, disgrace or crime.

d) Expose any secret of the person or relative.

e) To report the immigration status of the person or a relative (Pen. Code § 519.)

4) Provides that extortion is a felony, punishable pursuant to Penal Code Section 1170, subdivision (h), to an executed felony sentence of two, three or four years. (Pen. Code § 520.)

5) Provides that attempted extortion is an alternate felony-misdemeanor, punishable by a jail term of up to one year, a fine of up to $1,000, or both, or by a prison term of 16 months, two years or three years and a fine of up to $10,000.

6) Includes “white collar” financial crime prison sentence enhancements of one to five years and special fines, depending on the amount of money or property taken by the defendant or the loss suffered by the victim. The enhancements apply where the defendant is convicted of two or more related felonies and the loss to the victim or gain to the defendant is at least $100,000. To prevent a defendant from secreting or dissipating his or her assets, the court may order pretrial seizure of assets to preserve them for restitution and fines. (Pen. Code § 186.11.)

7) Includes the federal Computer Fraud and Abuse Act, which prohibits a number of different computer crimes, the majority of which involve accessing computers without authorization or in excess of authorization, and then taking specified forbidden actions, ranging from obtaining information to damaging a computer or computer data. (18 U.S.C. § 1030(a)(1)-(7)).

8) Includes federal statutory provisions crimes applicable to a person who intends to extort from any person any money or other thing of value and transmits in interstate or foreign commerce any communication containing either of the following:

a) A threat to damage a protected computer;

b) A threat to obtain information from a protected computer without authorization or in excess of authorization or to impair the confidentiality of information obtained from a protected computer without authorization or by exceeding authorized access; or

c) A demand or request for money or other thing of value in relation to damage to a protected computer, where such damage was caused to facilitate the extortion. A first violation is punishable by imprisonment for up to five years and a fine determined pursuant to the sentencing guidelines. A violation that follows conviction for this offense or a related offense is punishable by imprisonment for up to 10 years and a fine determined through the sentencing guidelines. (18 U.S.C. § 1030 (a)(7).)

This bill:

1) Provides that the person responsible for placing “ransomware” on a computer, computer system, or data in a computer system is a felony, punishable pursuant to Penal Code Section 1170, subdivision (h), by an executed felony sentence of two years, three years or four years and a fine of up to $10,000.

2) Defines “ransomware” as the placement or introduction of a computer contaminant or lock on a computer, computer system, or data in a computer system, coupled with a demand that money or other consideration be paid to the person responsible for the contaminant or lock before it is removed or repaired.

3) Provides that one is responsible for ransomware if the person directly places or introduces the contaminant or lock, or directs or induces another person to do so, with the intent to demand payment or other consideration to remove the contaminant, unlock the computer system or data, or repair the computer, computer system or data.

Background

The use of ransomware to demand a payment from a computer or computer system owner or operator may constitute extortion under existing California law. California law (Pen. Code § 502 – the section amended by this bill) also makes it a crime to access, damage or alter a computer system or data without permission. Section 502 specifically lists prohibited acts and provides various penalties, based on the severity of the harm caused or value of services taken.

This bill adds the use of ransomware as a computer crime in Section 502. The penalty for this form of computer crimes is the same as the penalty for extortion, a felony term of two, three, or four years. (Pen. Code § 518-527.) A prosecutor could charge ransomware with the very specific crime defined by this bill and the more general crime of extortion. A prosecutor could perhaps conclude that jurors would have a set understanding of extortion as meaning a demand for protection money from a store owner or blackmail to hide an embarrassing secret that they might be confused or reluctant to apply extortion to a highly technical and sophisticated computer scheme. A defendant, however, convicted of both offenses would be subject to a single punishment. California sentencing law generally permits a prosecutor to obtain a conviction on every crime covered by the defendant’s conduct. However, the defendant can only be punished a single time for one act that violates a number of criminal statutes or for multiple offenses committed in one indivisible transaction. (Pen. Code § 654.)

It appears that the use of ransom to extort money or other form of exchange, such as bitcoin, has become nearly ubiquitous. Even relatively large-scale attacks on or seizure of control over computers, computer systems and computer can be done quickly and remotely. Victims can reasonably conclude that they have little option but to comply. The perpetrators might well be in another country or even another continent. An attempt to obtain assistance from law enforcement may be futile and the perpetrators could punish such attempts by destroying data that includes an entity’s entire operation. A business or organization could conclude that it could no longer function if the threat is carried out. Even where the threat is not executed, the very admission of the event could be extremely harmful to a business or other organization’s reputation. For example, a hospital would be loath to admit that confidential medical records were seized or locked. The customers and clients of banks and brokerage houses must believe that their financial holdings and information are safe. Attorneys cannot afford to reveal the confidences of clients stored in digital files.

Computer criminals have become increasingly sophisticated as technology became more sophisticated and essential to the life of virtually every person and entity. The attacks have included locking or encrypting files on the home computers of individual victims – often through authentic-look law enforcement notifications that the victim has done some wrong that he or she would never want exposed. (https://www.fbi.gov/news/stories/2012/august/new-internet-scam.)

The attacks have also targeted large entities, such as three hospitals in recent, well-publicized incidents in Southern California and government entities. (https://www.fbi.gov/news/stories/2012/august/new-internet-scam.) It appears that no media report of ransomware incidents is complete without noting that even police departments have paid ransoms to computer criminals. A February 20, 2015 story in the Chicago Tribune reported the suburban Chicago town of Midlothian paid a hacker $500 in bitcoin for release of infected files. Even the department’s backup files were encrypted. (http://www.chicagotribune.com/news/local/breaking/ct-midlothian-hacker-ransom-met-20150220-story.html)

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: Yes

According to the Senate Appropriations Committee:

• State prisons: Potential minor increase in state costs (General Fund) for new commitments to state prison that would not have otherwise been convicted under the extortion statutes, or potentially longer sentences for convictions that otherwise would have been charged as other computer crimes. The California Department of Corrections and Rehabilitation data indicates 29 commitments to state prison in 2015 under the extortion statutes. To the extent the provisions of this bill result in even two additional commitments to state prison in any one year would result in state costs of $58,000 assuming the contract bed rate of $29,000 per inmate.
• County jails: Potential increase in local incarceration costs (Local Funds) to the extent persons would not have otherwise been convicted of the felony offense of extortion or other computer offenses under existing law.

SUPPORT: (Verified 5/27/16)

Los Angeles County District Attorney (co-source)

TechNet (co-source)

Association of Orange County Deputy Sheriffs

California Association of Licensed Investigators

California Police Chiefs Association

California State Sheriffs’ Association

California Statewide Law Enforcement Association

Fraternal Order of Police, California State Lodge

Long Beach Police Officers Association

Los Angeles County Professional Peace Officers Association

Sacramento County Deputy Sheriffs’ Association

OPPOSITION: (Verified 5/27/16)

Legal Services for Prisoners with Children

Prepared by: Jerome McGuire / PUB. S. /

5/28/16 16:57:31

**** END ****

SENATE COMMITTEE ON APPROPRIATIONS

Senator Ricardo Lara, Chair

2015 - 2016 Regular Session

SB 1137 (Hertzberg) - Computer crimes: ransomware

This bill meets the criteria for referral to the Suspense File.

Bill Summary:

SB 1137 would provide that a person who knowingly introduces “ransomware,” as defined, into any computer, computer system, or computer network is guilty of a felony, punishable by imprisonment in a county jail, or state prison under specified circumstances, for two, three, or four years, and a fine not exceeding $10,000.

Fiscal Impact:

• State prisons: Potential minor increase in state costs (General Fund) for new commitments to state prison that would not have otherwise been convicted under the extortion statutes, or potentially longer sentences for convictions that otherwise would have been charged as other computer crimes. CDCR data indicates 29 commitments to state prison in 2015 under the extortion statutes. To the extent the provisions of this measure result in even two additional commitments to state prison in any one year would result in state costs of $58,000 assuming the contract bed rate of $29,000 per inmate.
• County jails: Potential increase in local incarceration costs (Local Funds) to the extent persons would not have otherwise been convicted of the felony offense of extortion or other computer offenses under existing law.

Background:

Existing law establishes various offenses relating to computer data and electronic systems and imposes a wide range of penalties based on the seriousness of the offense or extent of harm caused by the defendant, including as an infraction, a misdemeanor, or as a felony, punishable pursuant to Penal Code (PC) § 1170(h) for a term of term of 16 months, two years, or three years and a fine of up to $10,000. (PC § 502.) These penalties apply where any person knowingly does any of the following:

• Accesses and without permission adds, alters, copies, damages, deletes, destroys, or otherwise uses any data, computer, computer system, computer programs, computer software, or computer network in order to devise or execute any scheme or artifice to defraud, deceive, or extort, or wrongfully control or obtain money, property or data.
• Without permission, disrupts or causes the disruption of computer services or denies or causes the denial of computer services, or denies or causes the denial of computer services to an authorized user of a computer, computer system, or computer network.
• Disrupts or improperly accesses a government or public safety computer system.
• Without permission provides or assists in providing a means of accessing, accesses, or causes to be accessed a computer, computer system, or computer network.
• Introduces any computer contaminant into any computer, or computer system, or computer network.
• Without permission uses the Internet domain name of another individual, corporation, or entity in connection with the sending of one or more electronic mail messages, and thereby damages or causes damage to a computer, computer system, or computer network.

Existing law defines extortion as the obtaining of property from another person, without the person’s consent, or obtaining an official act of a public officer, induced by the wrongful use of force or fear, or under color of official right. (PC § 518.) Under existing law, a person who extorts any money or other property from another, under circumstances not amounting to robbery or carjacking, by means of force, or any threat, as specified, is guilty of extortion, a felony punishable by imprisonment pursuant to PC § 1170(h) for two, three or four years. (PC § 520.)

Proposed Law:

This bill provides that a person who knowingly introduces “ransomware” on a computer, computer system, or computer network is guilty of a felony, punishable pursuant to PC § 1170 (h) by an executed felony sentence of two years, three years, or four years and a fine of up to $10,000. Additionally, this bill:

• Defines “ransomware” as a computer or data contaminant or lock placed in or introduced into a computer system, computer or data in a computer system, or computer that restricts access to the system, computer, or data in some way, and under circumstances in which the person responsible for the ransomware demands payment of money or other consideration to remove the contaminant, unlock the computer system or computer, or repair the injury done to the computer system, computer, or data by the contaminant or lock.
• Provides that one is responsible for placing or introducing ransomware if the person directly places or introduces the contaminant or lock, or directs or induces another person to do so, with the intent to demand payment or other consideration to remove the contaminant, unlock the computer system or computer, or repair the computer, computer system, or data.
• Provides that prosecution under the felony offense of placing ransomware on a computer does not prohibit or limit prosecution under any other law.

Prior Legislation:

AB 32 (Waldron) Chapter 614/2015 increases the fines for felony convictions of specified computer crimes from a maximum of $5,000, to a maximum of $10,000.

AB 1649 (Waldron) Chapter 379/2014 specifically and separately provides that the crimes and penalties for unauthorized access of or damage to a computer, computer system or data apply to government and public safety infrastructure computers, computer systems and data, as specified.

Staff Comments:

By separately establishing the offense of ransomware, this bill could potentially result in new commitments and longer sentences being imposed, both to state prison and county jail. Pursuant to the provisions of PC § 1170(h)(3), sentences imposed on defendants with the following criminal history must be served in state prison: 1) a defendant has a prior or current felony conviction for a serious or violent felony; 2) a defendant is required to register as a sex offender; or 3) a defendant is convicted of a crime and as part of the sentence an enhancement pursuant to PC § 186.11 is imposed.

The fiscal impact of this bill cannot be known with certainty, as the actual impact will be dependent on numerous factors including but not limited to judicial and prosecutorial discretion, the criminal history of the defendant, and the factors unique to each case. However, to the extent defendants convicted of knowingly introducing ransomware into a computer are already largely reflected in the historical commitments to state prison and county jail under the existing extortion statutes, the impact of this bill would be somewhat mitigated.

While a defendant cannot be punished for an offense under more than one provision of law (PC § 654), a defendant could be charged with both offenses, which could potentially have an impact on the outcome of the proceedings that may not have otherwise occurred under existing provisions of law.

-- END --

SENATE COMMITTEE ON PUBLIC SAFETY

Senator Loni Hancock, Chair

2015 - 2016 Regular

Bill No: SB 1137 Hearing Date: April 12, 2016

Subject: Computer Crimes: Ransomware

HISTORY

Source: TechNet; Los Angeles County District Attorney

Prior Legislation: AB 32 (Waldron) Ch. 614 Stats. 2015

AB 1649 (Waldron) – Ch. 379, Statutes of 2014

Support: Association of Orange County Deputy Sheriffs; California Association of Licensed Investigators; California Police Chiefs Association; California State Sheriffs’ Association; California Statewide Law Enforcement Association; Fraternal Order of Police, California State Lodge; Long Beach Police Officers Association; Sacramento County Deputy Sheriffs’ Association

Opposition: Legal Services for Prisoners with Children

PURPOSE

The purpose of this bill is to: 1) separately define as a felony the crime of placing a contaminant or lock on a computer or computer system for the purpose of locking or controlling the computer, computer system or data files, coupled with a demand for payment of money or other consideration before the lock will be removed of control returned to owner or authorized user; and, 2) to specifically define such a contaminant or lock as “ransomware.”

Existing law defines numerous computer or electronic data offenses and imposes a wide range of penalties based on the seriousness of the offense or extent of harm caused by the defendant, including by by felony imprisonment pursuant to Penal Code Section 1170, subdivision (h) for a term of term of 16 months, two years or three years and a fine of up to $10,000, or as misdemeanor by a fine not exceeding $5,000, or a fine of up to $1,000 by imprisonment in a county jail not exceeding one year, or as infraction. (Pen. Code § 502.) These penalties apply where any person knowingly:

• Accesses and without permission alters, damages, deletes, destroys, or otherwise uses any data, computer, computer system, or computer network in order to devise or execute any scheme or artifice to defraud, deceive, or extort, or wrongfully control or obtain money, property or data.
• Accesses and without permission takes, copies or makes use of any data from a computer, computer system, or computer network, or takes or copies any supporting documentation, whether existing or residing internal or external to a computer, computer system, or computer network.
• Accesses and without permission adds, alters, damages, deletes, or destroys any data, computer software, or computer programs which reside or exist internal or external to a computer, computer system, or computer network
• Without permission, disrupts or causes the disruption of computer services or denies or causes the denial of computer services, or denies or causes the denial of computer services to an authorized user of a computer, computer system, or computer network.
• Disrupts or improperly accesses a government or public safety computer system
• Without permission provides or assists in providing a means of accessing, accesses, or causes to be accessed a computer, computer system, or computer network as
• Introduces any computer contaminant into any computer, or computer system, or computer network as follows:
• Without permission uses the Internet domain name of another individual, corporation, or entity in connection with the sending of one or more electronic mail messages, and thereby damages or causes damage to a computer, computer system, or computer network as follows:. (Pen. Code § 502, subds. (c)(9) and (d)(5).)

Existing law defines extortion as the obtaining of property from another person, without the person’s consent, or obtaining an official act of a public officer, induced by the wrongful use of force or fear, or under color of official right. (Pen. Code § 518.)

Existing law defines force or fear sufficient to commit extortion as a threat to do any of the following:

• Injure the person or property of the person threatened or a third person.
• Accuse the threatened person or a relative of a crime.
• Expose or impute to the person threatened or a relative any deformity, disgrace or crime.
• Expose any secret of the person or relative.
• To report the immigration status of the person or a relative (Pen. Code § 519.)

Existing law provides that extortion is a felony, punishable pursuant to Penal Code Section 1170, subdivision (h), to an executed felony sentence of two, three or four years. (Pen. Code § 520.)

Existing law provides that attempted extortion is an alternate felony-misdemeanor, punishable by a jail term of up to one year, a fine of up to $1,000, or both, or by a prison term of 16 months, two years or three years and a fine of up to $10,000.

Existing law includes “white collar” financial crime prison sentence enhancements of 1-5 years and special fines, depending on the amount of money or property taken by the defendant or the loss suffered by the victim. The enhancements apply where the defendant is convicted of two or more related felonies and the loss to the victim or gain to the defendant is at least $100,000. To prevent a defendant from secreting or dissipating his or her assets, the court may order pretrial seizure of assets to preserve them for restitution and fines. (Pen. Code § 186.11.)

Existing federal law includes the Computer Fraud and Abuse Act ("CFAA"), which prohibits a number of different computer crimes, the majority of which involve accessing computers without authorization or in excess of authorization, and then taking specified forbidden actions, ranging from obtaining information to damaging a computer or computer data. (18 U.S.C. § 1030(a)(1)-(7)).

Existing federal law provides that a person who intends to extort from any person any money or other thing of value and transmits in interstate or foreign commerce any communication containing either of the following:

• A threat to damage a protected computer;
• A threat to obtain information from a protected computer without authorization or in excess of authorization or to impair the confidentiality of information obtained from a protected computer without authorization or by exceeding authorized access; or
• A demand or request for money or other thing of value in relation to damage to a protected computer, where such damage was caused to facilitate the extortion." A first violation is punishable by imprisonment for up to five years and a fine determined pursuant to the sentencing guidelines.^[1] A violation that follows conviction for this offense or a related offense is punishable by imprisonment for up to 10 years and a fine determined through the sentencing guidelines. (18 U.S.C. § 1030 (a)(7).)

This bill provides that the person responsible for placing “ransomware” on a computer, computer system, or data in a computer system is a felony, punishable pursuant to Penal Code Section 1170, subdivision (h), by an executed felony sentence of two years, three years or four years and a fine of up to $10,000.

This bill with defines “ransomware” as the placement or introduction of a computer contaminant or lock on a computer, computer system, or data in a computer system, coupled with a demand that money or other consideration be paid to the person responsible for the contaminant or lock before it is removed or repaired.

This bill provides that one is responsible for ransomware if the person directly places or introduces the contaminant or lock, or directs or induces another person to do so, with the intent to demand payment or other consideration to remove the contaminant, unlock the computer system or data, or repair the computer, computer system or data.

RECEIVERSHIP/OVERCROWDING CRISIS AGGRAVATION

For the past several years this Committee has scrutinized legislation referred to its jurisdiction for any potential impact on prison overcrowding. Mindful of the United States Supreme Court ruling and federal court orders relating to the state’s ability to provide a constitutional level of health care to its inmate population and the related issue of prison overcrowding, this Committee has applied its “ROCA” policy as a content-neutral, provisional measure necessary to ensure that the Legislature does not erode progress in reducing prison overcrowding.

On February 10, 2014, the federal court ordered California to reduce its in-state adult institution population to 137.5% of design capacity by February 28, 2016, as follows:

• 143% of design bed capacity by June 30, 2014;
• 141.5% of design bed capacity by February 28, 2015; and,
• 137.5% of design bed capacity by February 28, 2016.

In December of 2015 the administration reported that as “of December 9, 2015, 112,510 inmates were housed in the State’s 34 adult institutions, which amounts to 136.0% of design bed capacity, and 5,264 inmates were housed in out-of-state facilities. The current population is 1,212 inmates below the final court-ordered population benchmark of 137.5% of design bed capacity, and has been under that benchmark since February 2015.” (Defendants’ December 2015 Status Report in Response to February 10, 2014 Order, 2:90-cv-00520 KJM DAD PC, 3-Judge Court, Coleman v. Brown, Plata v. Brown (fn. omitted).) One year ago, 115,826 inmates were housed in the State’s 34 adult institutions, which amounted to 140.0% of design bed capacity, and 8,864 inmates were housed in out-of-state facilities. (Defendants’ December 2014 Status Report in Response to February 10, 2014 Order, 2:90-cv-00520 KJM DAD PC, 3-Judge Court, Coleman v. Brown, Plata v. Brown (fn. omitted).)

While significant gains have been made in reducing the prison population, the state must stabilize these advances and demonstrate to the federal court that California has in place the “durable solution” to prison overcrowding “consistently demanded” by the court. (Opinion Re: Order Granting in Part and Denying in Part Defendants’ Request For Extension of December 31, 2013 Deadline, NO. 2:90-cv-0520 LKK DAD (PC), 3-Judge Court, Coleman v. Brown, Plata v. Brown (2-10-14). The Committee’s consideration of bills that may impact the prison population therefore will be informed by the following questions:

• Whether a proposal erodes a measure which has contributed to reducing the prison population;
• Whether a proposal addresses a major area of public safety or criminal activity for which there is no other reasonable, appropriate remedy;
• Whether a proposal addresses a crime which is directly dangerous to the physical safety of others for which there is no other reasonably appropriate sanction;
• Whether a proposal corrects a constitutional problem or legislative drafting error; and
• Whether a proposal proposes penalties which are proportionate, and cannot be achieved through any other reasonably appropriate remedy.

COMMENTS

1. Need for This Bill

According to the author:

Kidnapping and ransom demands have been around as long as criminal activity itself. But what is new in the digital age is the immediacy in which a computer hacker can access and hold your computer hostage. Computer users are told that the only way to get their machines back is to pay a steep fine. This is known as “ransomware,” a computer virus that renders files unobtainable until a ransom is paid.

Essentially online extortion, ransomware involves infecting a user’s computer with a virus that locks it. The attackers demand money before the computer will be unlocked, but once the money is paid attackers may not unlock the system. One of the scarier things about ransomware is that criminals can use victims’ machines however they like. While the computer is locked, the criminals can steal passwords and even get into the victim’s online bank accounts. Ransomware affects victims financially and imposes additional costs of replacing breached hardware, bringing legal action, and updating system security.

This doesn’t just impact home computers. Businesses, financial institutions, government agencies, academic institutions, and other organizations can and have become infected as well, resulting in loss of sensitive or proprietary information, disruption of regular operations, financial losses incurred to restore systems and files, and/or potential harm to an organization’s reputation. In 2014, according to a recent report, 43 percent of companies experienced some sort of data breach, including highly visible and damaging attacks on Sony, Home Depot, Target and JP Morgan Chase.

This bill defines “ransomware” in state law and makes it a crime to introduce ransomware into any computer, system, or network. The range of punishment (up to four years imprisonment) is equivalent to the punishment under current law for extortion.

1. Using Ransomware is Criminal under Existing California and Federal Laws, including Extortion and Introducing a Contaminant into a Computer or Computer System

The use of ransomware to demand a payment from a computer or computer system owner or operator appears to constitute extortion under existing California law. California law (Pen. Code § 502 – the section amended by this bill) also makes it a crime to access, damage or alter a computer system or data without permission. Section 502 specifically lists prohibited acts and provides various penalties, based on the severity of the harm caused or value of services taken.

This bill would add the use of ransomware as a computer crime in Section 502. The penalty for this form of computer crimes is the same as the penalty for extortion, a felony term of two, three, or four years. (Pen. Code § 518-527.) A prosecutor could charge ransomware with the very specific crime defined by this bill and the more general crime of extortion. A prosecutor could perhaps conclude that jurors would have a set understanding of extortion as meaning a demand for protection money from a store owner or blackmail to hide an embarrassing secret that they might be confused or reluctant to apply extortion to a highly technical and sophisticated computer scheme. A defendant, however, convicted of both offenses would be subject to a single punishment. California sentencing law generally permits a prosecutor to obtain a conviction on every crime covered by the defendant’s conduct. However, the defendant can only be punished a single time for one act that violates a number of criminal statutes or for multiple offenses committed in one indivisible transaction. (Pen. Code § 654.)

1. Explosion in Computer and Data Fraud and Extortion Incidents and Awareness

It appears that the use of ransom to extort money or other form of exchange, such as bitcoin, has become nearly ubiquitous. Even relatively large-scale attacks on or seizure of control over computers, computer systems and computer can be done quickly and remotely.

Victims can reasonably conclude that they have little option but to comply. The perpetrators might well be in another country or even another continent. An attempt to obtain assistance from law enforcement may be futile and the perpetrators could punish such attempts by destroying data that includes an entity’s entire operation. A business or organization could conclude that it could no longer function if the threat is carried out. Even where the threat is not executed, the very admission of the event could be extremely harmful to a business or other organization’s reputation. For example, a hospital would be loath to admit that confidential medical records were seized or locked. The customers and clients of banks and brokerage houses must believe that their financial holdings and information are safe. Attorneys cannot afford to reveal the confidences of clients stored in digital files.

Computer criminals have become increasingly sophisticated as technology became more sophisticated and essential to the life of virtually every person and entity. The attacks have included locking or encrypting files on the home computers of individual victims – often through authentic-look law enforcement notifications that the victim has done some wrong that he or she would never want exposed.^[2] The attacks have also included attacks on large entities, such as three hospitals in recent, well-publicized incidents in Southern California^[3] and government entities. It appears that no media report of ransomware incidents is complete without noting that even police departments have paid ransoms to computer criminals. A February 20, 2015 story in the Chicago Tribune reported the suburban Chicago town of Midlothian paid a hacker $500^[4] in bitcoin for release of infected files. Even the department’s backup files were encrypted.

A number of computer, software and computer and computer data security businesses have developed products to detect and remove ransomware. Numerous on-line guides about ransomware have been published. These typically include descriptions of ransomware, how to detect ransomware, remove it and protect against. For example, the Mountain View, California firm Symantec has published particularly detailed guides^[5] for addressing ransomware questions, concerns, protection, removal and repair.^[6] TechNet – a Microsoft division that is a co-sponsor of this bill also publishes detailed ransomware guides and assistance, including information about newly discovered ransomware.^[7]

Comparison with Identity Theft

In recent decades, identity theft has become a growing and daunting crime problem. Traditional investigative techniques did not work well to combat identity theft, a crime that was often committed by unseen, electronic means, creating law enforcement problems similar to recent ransomware incidents.

In 1997, California was one of the first states to create a crime specifically described as identity theft in Penal Code section 530.5.^[8] Prior to that time, law enforcement agencies generally considered the defrauded business entity that was defrauded to be the victim of identity theft, not the person whose identity was stolen so that the fraud could be committed, although applicable statutes described a person whose identity was misused as a crime victim. However, advocates believed that the person who was the actual victim often found himself or herself given no respect or standing in repairing the damage done by the crime.

It would appear that the greatest value in the current identity theft statutes is to allow a victim to clear his or her name. Penal Code section 530.6 allows an identity theft victim to require the police to investigate an identity theft report and further allows the victim to use the report to obtain a court order declaring that he or she did not commit certain crimes or accumulate certain debts. Pursuant to this judicial procedure, a person may be listed in a database of identity theft victims maintained by the Department of Justice.

One of the most daunting and frustrating problems encountered by identify theft victims is the damage to one's credit. Good credit is essential to financial stability. An identity theft victim may well face months of work and substantial expense repairing his or credit. Companies marketing credit repair services. Credit card companies compete for business, in part, by including credit monitoring and repair in a credit account. Similar daunting problems face victims of ransomware and cryptoware. Business and government entities that were hacked must repair systems, recreate files and rebuild the trust of customers and citizens.

-- END –

1. It appears that the fine would be no more than $250,000 or twice the gain or loss in the crime. (18 U.S.C. § 3571.) ↑

2. https://www.fbi.gov/news/stories/2012/august/new-internet-scam ↑

3. http://www.latimes.com/local/lanow/la-me-ln-two-more-so-cal-hospitals-ransomware-20160322-story.html ↑

4. http://www.chicagotribune.com/news/local/breaking/ct-midlothian-hacker-ransom-met-20150220-story.html ↑

5. http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-evolution-of-ransomware.pdf ↑

6. http://www.symantec.com/tv/products/details.jsp?vid=1954285164001 ↑

7. https://blogs.technet.microsoft.com/mmpc/2015/08/09/emerging-ransomware-troldesh/ ↑

8. AB 156 (Murray) Ch. 768, Stats. 1997 ↑