Existing law authorizes a court to issue a restraining order to a person to prevent abuse, as specified, based on reasonable proof of a past act or acts of abuse. Existing law authorizes the order to be issued solely on the affidavit or testimony of the person requesting the restraining order.

Existing law requires a manufacturer of a connected device to equip the device with a reasonable security feature or features that are appropriate to the nature and function of the device, appropriate to the information it may collect, contain, or transmit, and designed to protect the device and information contained in the device from unauthorized access, destruction, use, modification, or disclosure.

Existing law authorizes a court to issue an ex parte order for, among other things, disturbing the peace of the other party. Existing law provides that disturbing the peace of the other party may be committed directly or indirectly, including through the use of a third party, and by any method or through any means including, but not limited to, telephone, online accounts, text messages, internet-connected devices, or other electronic technologies.

This bill would provide that, for purposes of those provisions, an internet-connected device includes a connected device as described in the bill.

Existing law establishes various privacy requirements applicable to vehicle manufacturers, including limitations on the usage of images or video recordings from in-vehicle cameras in new motor vehicles equipped standard with one or more in-vehicle cameras.

This bill would, among other things, require a vehicle manufacturer that offers a vehicle for sale, rent, or lease in the state that includes remote vehicle technology to do certain things, including ensuring that the remote vehicle technology can be immediately manually disabled by a driver of the vehicle while that driver is inside the vehicle. The bill would require a vehicle manufacturer to offer secure remote means via the internet for a requester survivor to submit a vehicle separation notice that meets specified requirements. This bill would require a requester survivor to submit a vehicle separation notice through the secure remote means within 7 days of the date on which the requester survivor used the method of manually disabling remote vehicle technology and would require the notice to include prescribed information.

Existing law authorizes a court to issue a restraining order to a person to prevent abuse, as specified, based on reasonable proof of a past act or acts of abuse. Existing law authorizes the order to be issued solely on the affidavit or testimony of the person requesting the restraining order.

Existing law requires a manufacturer of a connected device to equip the device with a reasonable security feature or features that are appropriate to the nature and function of the device, appropriate to the information it may collect, contain, or transmit, and designed to protect the device and information contained in the device from unauthorized access, destruction, use, modification, or disclosure.

This bill would, commencing January 1, 2026, require an account manager, as defined, to deny a person access to a connected device commencing no later than 2 days after a device protection request is submitted to the account manager, as provided, and would set forth the requirements on an account manager to make information about requests and the request process available. The bill would require a device protection request to include verification of the requesters exclusive legal possession or control of the connected device, as specified, and identification of the connected device and the person that the requester seeks to deny access to.This to. The bill would authorize an account manager to contact the requester or their representative to confirm that device access is denied or notify the requester that the request is incomplete. The bill would require an account manager and any officer, director, employee, vendor, or agent thereof to treat any information submitted as confidential and securely dispose of the information, as provided.

Existing law authorizes a court to issue an ex parte order for, among other things, disturbing the peace of the other party. Existing law provides that disturbing the peace of the other party may be committed directly or indirectly, including through the use of a third party, and by any method or through any means including, but not limited to, telephone, online accounts, text messages, internet-connected devices, or other electronic technologies.

This bill would provide that, for purposes of those provisions, an internet-connected device includes a connected device as described in the bill.

Existing law authorizes a court to issue a restraining order to a person to prevent abuse, as specified, based on reasonable proof of a past act or acts of abuse. Existing law authorizes the order to be issued solely on the affidavit or testimony of the person requesting the restraining order.

Existing law requires a manufacturer of a connected device to equip the device with a reasonable security feature or features that are appropriate to the nature and function of the device, appropriate to the information it may collect, contain, or transmit, and designed to protect the device and information contained in the device from unauthorized access, destruction, use, modification, or disclosure.

This bill would, commencing January 1, 2026, require an account manager, as defined, to deny an abuser, as defined, a person access to a connected device commencing no later than 2 days after a device protection request is submitted to the account manager by a victim of that abuser, manager, as provided, and would set forth the requirements for a victim to submit a device protection request and the requirements that on an account manager to make information about requests and the request process available. By providing that a victim may include a copy of a signed affidavit to submit a device protection request, and thus expanding the crime of perjury, this bill would impose a state-mandated local program. The bill would require a device protection request to include verification of the requesters exclusive legal possession or control of the connected device, as specified, and identification of the connected device and the person that the requester seeks to deny access to.

This bill would require the authorize an account manager to notify the victim of specified information and contact the requester or their representative to confirm that device access is denied or notify the requester that the request is incomplete. The bill would require an account manager and any officer, director, employee, vendor, or agent thereof to treat any information submitted by a victim as confidential and securely dispose of the information, as provided.

Existing law authorizes a court to issue an ex parte order for, among other things, disturbing the peace of the other party. Existing law provides that disturbing the peace of the other party may be committed directly or indirectly, including through the use of a third party, and by any method or through any means including, but not limited to, telephone, online accounts, text messages, internet-connected devices, or other electronic technologies.

This bill would provide that, for purposes of those provisions, an internet-connected device includes a connected device as described in the bill.

Existing law authorizes a court to issue a restraining order to a person to prevent abuse, as specified, based on reasonable proof of a past act or acts of abuse. Existing law authorizes the order to be issued solely on the affidavit or testimony of the person requesting the restraining order.

Existing law requires a manufacturer of a connected device to equip the device with a reasonable security feature or features that are appropriate to the nature and function of the device, appropriate to the information it may collect, contain, or transmit, and designed to protect the device and information contained in the device from unauthorized access, destruction, use, modification, or disclosure.

This bill would, commencing January 1, 2026, require an account manager, as defined, to deny an abuser, as defined, access to a connected device commencing no later than 2 days after a device protection request is submitted to the account manager by a victim of that abuser, and would set forth the requirements for a victim to submit a device protection request and the requirements that an account manager make the request available. By providing that a victim may include a copy of a signed affidavit to submit a device protection request, and thus expanding the crime of perjury, this bill would impose a state-mandated local program.

This bill would require the account manager to notify the victim of specified information and require an account manager and any officer, director, employee, vendor, or agent thereof to treat any information submitted by a victim as confidential and securely dispose of the information, as provided.

This bill would authorize enforcement of these provisions by injunction or civil penalty in any court action by any person injured by a violation of those provisions, the Attorney General, or a district attorney, against an account manager or abuser, as provided. The bill would prohibit a waiver of these prohibitions and would declare that these provisions are severable.

Existing law authorizes a court to issue an ex parte order for, among other things, disturbing the peace of the other party. Existing law provides that disturbing the peace of the other party may be committed directly or indirectly, including through the use of a third party, and by any method or through any means including, but not limited to, telephone, online accounts, text messages, internet-connected devices, or other electronic technologies.

This bill would provide that, for purposes of those provisions, an internet-connected device includes a connected device as described in the bill.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Existing law makes it the duty of the coroner to inquire into and determine the circumstances, manner, and cause of specified deaths, including all unattended deaths. Under existing law, in any case in which the coroner conducts an inquiry, the coroner or a deputy is required to personally sign the certificate of death, except as specified. Under specified circumstances, existing law requires a funeral director, physician, or other person who has charge of a deceased persons body to immediately notify the coroner.

This bill would make nonsubstantive changes to those provisions.

Date of Hearing: August 7, 2024

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Buffy Wicks, Chair

SBPCA Bill Id:SB 1000

Author:(Ashby) – As Amended Ver:June 24, 2024

Urgency: No State Mandated Local Program: Yes Reimbursable: No

SUMMARY:

This bill requires an account manager of an internet-connected device and a vehicle manufacturer to, upon request by a survivor of domestic violence (“survivor”), disable access to the device or vehicle for a perpetrator of domestic violence (“perpetrator”). The bill also requires a vehicle manufacturer to include, in each vehicle sold in California, a mechanism that any driver can use to disable remote vehicle technology from inside the car.

Specifically, among other provisions, this bill:

1. Requires an account manager to, within two days of a request by a survivor, terminate or disable a perpetrator’s access to a connected device or account.
2. Requires a vehicle manufacturer to immediately terminate or disable remote vehicle technology upon receipt of a device protection request from a survivor.
3. Requires a vehicle manufacturer that offers a vehicle for sale, rent, or lease in California that includes remote vehicle technology to ensure a driver of the vehicle can immediately disable the remote vehicle technology from inside the car without a password or login information.
4. Requires a survivor to submit a vehicle separation notice to a vehicle manufacturer within seven days of manually disabling remote vehicle technology. Requires the notice to include information about the vehicle, the perpetrator, and supporting documentation.
5. Authorizes enforcement of a violation of the bill through a civil action filed by a public prosecutors or a person injured by the violation, and establishes a civil penalty of up to $2,500 for each violation.

FISCAL EFFECT:

1. Cost pressures (General Fund) to the Department of Justice (DOJ) of an unknown but potentially significant amount if the Attorney General brings civil actions to enforce violations of this bill. If DOJ files enforcement actions under this bill, the department may experience a significant workload increase in excess of $150,000 annually, depending on the number of enforcement actions filed and the amount of time needed for each case. If DOJ chooses not to pursue enforcement as authorized by this bill, DOJ would likely not incur any costs.
2. Cost pressures (Trial Court Trust Fund, General Fund) of an unknown but potentially significant amount to the courts to adjudicate civil enforcement actions. The bill authorizes civil suits to be filed by public prosecutors or any person who is injured by a violation of the bill’s provisions. Actual costs will depend on the number of cases filed and the amount of court time needed to resolve each case. It generally costs approximately $1,000 to operate a courtroom for one hour. Although courts are not funded on the basis of workload, increased pressure on the Trial Court Trust Fund may create a need for increased funding for courts from the General Fund. The fiscal year 2024-25 state budget provides $37.3 million ongoing General Fund to backfill declining revenue to the Trial Court Trust Fund.

According to the Legislative Analyst’s Office, the General Fund faces a structural deficit in the tens of billions of dollars over the next several fiscal years.

COMMENTS:

1. Purpose. According to the author:

Domestic violence organizations continue to raise concerns about the increasing number of abuse cases related to internet-connected devices and shared accounts. Victims report escalating issues of virtual abuse, including loss of autonomy over everyday household items such as doors, speakers, thermostats, lights, cameras, and even vehicles. While modern technology offers convenience and connectivity, it has unfortunately become a tool for perpetrators to exert control over their victims remotely. SB 1000 addresses the urgent need to stop this alarming new trend.

1. Background. This is one of three bills currently pending in the Legislature that attempts to help survivors of domestic violence escape the reach of remote vehicle technology and internet-connected devices, which can be used by perpetrators to track, harass, and harm them. The other two bills – AB 3139 (Weber) and SB 1394 (Min) – pertain only to remote vehicle technology. This bill requires vehicle manufacturers to include, in all vehicles offered for sale or lease in California, a mechanism that can be used by a driver to manually disable any remote vehicle technology in the vehicle without a password or any login information. At this point, all three bills contain similar provisions requiring a mechanism that can immediately and manually disable remote vehicle technology. AB 3139 is currently pending the Senate Appropriations Committee. SB 1394 is currently pending in this committee.

This bill also requires an account manager for an internet-connected device to block a perpetrator’s access to a connected device or account within two days of receiving a request from a survivor, and establishes the process and documentation that must accompany such a request. These provisions apply to internet-connected devices like cell phones, appliances, smart speakers, thermostats, and home security systems.

Analysis Prepared by: Annika Carlson / APPR. / (916) 319-2081

Date of Hearing: July 2, 2024

ASSEMBLY COMMITTEE ON JUDICIARY

Ash Kalra, Chair

SBPCA Bill Id:SB 1000

Author:(Ashby) – As Amended Ver: June 24, 2024

SENATE VOTE: 38-0

SUBJECT: Connected devices: device protection requests

KEY ISSUES:

1. Should the manager of an internet-based or app-based user account have the authority to deny a person access to a connected device, as specified, if requested to do so by a survivor of domestic violence?
2. Should a vehicle manufacturer be required to provide a survivor of domestic violence with a means to disable remote vehicle technology manually, from inside of the vehicle and without needing a password or login information?

SYNOPSIS

Although domestic violence has apparently always been with us, the tools of the domestic abuser have changed with available technology. Today most of us find ourselves dependent upon our “connected devices,” which this bill defines as internet-based devices that enable a person to remotely obtain data from, or send commands to, a connected device or account through a software application. While these devices aim to make our lives easier, they also provide novel means of harassment, stalking, and abuse for those so inclined to use them for those purposes. According to recent media coverage, based on reports of domestic survivors and those who work with them, the perpetrators of domestic violence increasingly use connected devices to inflict further pain and suffering on victims and survivors. An article appearing last year in the New York Times told of abusive husbands tracking the location of ex-wives, or remotely turning on heat on a hot day in a formerly shared home. Other recent reports stress the dangers of the remote tracking of vehicles, which could prevent a victim from eluding a violent abuser.

This bill is one of three moving through the Legislature that attempt to protect victims of domestic violence from an abuser’s use of remote technology. The two other bills only address remote vehicle technology, while this bill covers vehicles as well as the panoply of other connected devices. The bill does this by requiring “account managers” of connected devices to deny access to a perpetrator within two days of receiving a request from a survivor. The bill requires manufacturers of vehicles with remote technology to provide a survivor with the ability to deny access immediately, including by permitting a person to disable the technology manually from inside the car without a password or login information.

While it is critical that the Legislature amend the law as necessary to account for new tools of domestic violence and abuse, the provisions in this bill on remote technology in vehicles raise a number of questions, including possible unintended consequences that could endanger the very people it seeks to protect. The bill is supported by advocates of domestic violence survivors. While there is no opposition, the Electronic Frontier Foundation and the Alliance for Automotive Innovation have raised significant concerns. The bill recently passed out of the Assembly Privacy Committee on an 11-0 vote.

SUMMARY: Requires an account manager to deny a person access to a connected device no later than two days after the submission of a device protection request by a survivor of domestic violence; requires a vehicle manufacturer to immediately terminate access or disable remote technology and provide the survivor with a way to disable remote vehicle technology manually, as specified. Specifically, this bill:

1. Requires an account manager, as defined, to terminate or disable access to a connected device or account by a perpetrator of domestic violence (perpetrator) if a survivor of domestic violence (survivor) has submitted a device protection request to the account manager. Requires termination or disabling of the account no later than two days after the survivor has submitted the request.
2. Requires a vehicle manufacturer to immediately terminate or disable remote vehicle technology upon receipt of a device protection request from a survivor.
3. Requires a survivor who submits a device protection request to an account manager to include in the request all of the following:
   1. Verification that the perpetrator has committed or allegedly committed a covered act against the survivor or an individual in the survivor’s care, by providing specified documentation, including, among other things, police reports, restraining orders, or a signed affidavit from a licensed medical or mental health care provider.
   2. Verification of the survivor’s exclusive legal possession or control of the connected device, including, but not limited to, a dissolution decree, temporary restraining order, protective order, domestic violence restraining order, or other document indicating the survivor’s exclusive use, care, possession, or control of the connected device.
   3. Identification of the connected device or devices and identification of the perpetrator.
4. Requires the account manager to provide the survivor with a secure means of submitting a device protection request and to keep confidential information submitted by the survivor. Prohibits the account manager from conditioning a device protection request upon payment of a fee or other specified limitations.
5. Defines the following terms for purposes of the above:
   1. “Account manager” means a person or entity that provides an individual an internet-based or app-based user account, or a third party that manages those user accounts on behalf of that person or entity that has authority to make decisions regarding user access to those user accounts.
   2. “Connected Device” means a device that is capable of connecting to the internet, directly or indirectly, and that enables a person to remotely obtain data from, or send commands to, a connected device or account, which may be accomplished through a software application that is designed to be operated on a mobile device, computer, or other technology.
6. Requires a vehicle manufacturer that offers a vehicle for sale, rent, or lease in California that includes remote vehicle technology to do all of the following:
   1. Ensure that a driver of the vehicle can immediately disable the remote vehicle technology from inside the car and requires, among other things, that this can be done without a password or login information.
   2. Offer secure remote means via the internet for a survivor to submit a vehicle separation notice that includes a prominent link on the vehicle manufacturer’s internet website.
   3. Upon request, reset the remote vehicle technology with a new secure account and delete all data from the original account.
   4. Reenable the remote vehicle technology only if the registered owner of the car notifies the manufacturer that the remote vehicle technology was disabled in error, and a survivor has not contacted the vehicle manufacturer to provide the information required by 7) within seven days of the remote vehicle technology being disabled.
7. Requires a survivor to submit a vehicle separation notice to a vehicle manufacturer, as specified, within seven days of the date on which the survivor used the method of manually disabling remote vehicle technology. Requires the notice to include information about the vehicle, the perpetrator, the act, and other information with supporting documentation.
8. Defines “remote vehicle technology,” for purposes of the above, to mean any technology that allows a person who is outside of a vehicle to access the activity, track the location, or control any operation of the vehicle or its parts, including, but not limited to, a global positions system (GPS), and app-based technology, or any other remote wireless connectivity technology.
9. Makes an account manager or vehicle manufacturer who violates the provisions above liable for a civil penalty not to exceed $2,500 for each violation, in an action brought by a person injured by a violation or by the Attorney General or other public prosecutor in the name of the people of California. Provides for the distribution of a civil penalty brought by a public prosecutor. If the action is brought by a person injured by the violation, the penalty shall be awarded to that person.

EXISTING LAW:

1. Requires a manufacturer of a connected device to equip the device with a reasonable security feature or features that are appropriate to the nature and function of the device, appropriate to the information it may collect, contain, or transmit, and designed to protect the device and information contained in the device from unauthorized access, destruction, use, modification, or disclosure. (Civil Code Sections 1798.91.04 - 1798.91.06.)
2. Establishes the federal Safe Connections Act (SCA) of 2022, which requires mobile service providers to separate the line of a survivor of domestic violence (and other related crimes and abuse), and any individuals in the care of the survivor, from a mobile service contract shared with an abuser within two business days after receiving a request from the survivor. (U.S. Public Law 117-223.)
3. Authorizes a court to issue an ex parte order enjoining a party from molesting, attacking, striking, stalking, threatening, sexually assaulting, battering, harassing, telephoning, including, but not limited to, making annoying telephone calls, destroying personal property, contacting, either directly or indirectly, by mail or otherwise, coming within a specified distance of, or disturbing the peace of the other party. Defines “disturbing the peace of the other party” for this purpose to mean conduct that, based on the totality of the circumstances, destroys the mental or emotional calm of the other party. Specifies that this conduct may be committed through, among other things, online accounts, text messages, internet-connected devices, or other electronic technologies. (Family Code Section 6320.)
4. Authorizes a person to participate in the Safe at Home program if they, or a household member, are a victim of domestic violence, sexual assault, stalking, human trafficking, child abduction, or elder or dependent adult abuse. Designates the Secretary of State (SOS) as the agent for service of process and receipt of mail, and providing the SOS with any address they want kept confidential. (Government Code Section 6206 (a).)
5. Establishes the Safe at Home (SAH) address confidentiality program in order to enable state and local agencies to both accept and respond to requests for public records without disclosing the changed name or address of a victim of domestic violence, sexual assault, or stalking. (Government Code Section 6205 et seq.)

FISCAL EFFECT: As currently in print this bill is keyed fiscal.

COMMENTS: According to the author, this bill “addresses the increasingly prevalent problem of digital abuse and control in domestic violence cases.” The author notes that domestic violence organizations are concerned with the increased number of abuse cases related to internet-connected devices and shared accounts. “While modern technology offers convenience and connectivity,” the author writes, “it has unfortunately become a tool for perpetrators to exert control over their victims remotely.” The author believes that “SB 1000 addresses the urgent need to stop this alarming new trend. This bill empowers victims and provides a crucial layer of protection. It ensures that California law evolves alongside technological advancements, empowering and safeguarding victims of domestic violence.”

Technological Abuse and the “Internet of Things.” The Office on Violence against Women (OVW), within the U.S. Department of Justice, breaks down domestic violence into several categories of abuse. Not surprisingly, it includes the more familiar categories of “physical abuse,” “sexual abuse,” “emotional abuse,” and “psychological abuse.” However, the OVW list now includes a newer category of “technological abuse.” OVW defines “technological abuse” as follows:

An act or pattern of behavior that is intended to harm, threaten, control, stalk, harass, impersonate, exploit, extort, or monitor another person that occurs using any form of technology, including but not limited to: internet enabled devices, online spaces and platforms, computers, mobile devices, cameras and imaging programs, apps, location tracking devices, or communication technologies, or any other emerging technologies. (https://www.justice.gov/ovw/domestic-violence.)

In 2021, an article in the California Law Review aptly noted, “tactics of domestic violence are nothing new. However, as with various other aspects of modern life, technology threatens disruption.” The article detailed how the “Internet of Things” has given abusers “a powerful new tool to expand and magnify the traditional harms of domestic violence, threatening the progress advocates have made in the past thirty years and creating novel dangers for survivors.” The article noted that those who work in the domestic violence sphere have developed creative responses and educational resources to warn people about the potential dangers of connected devices and ways to mitigate risks. However, the article then turned to how advocates might supplement these important efforts with legal remedies. Most the article’s recommendations focused on updating definitions of domestic violence, harassment, and stalking to account for the rising use of smart technology; recognizing that efforts to “control” another person were a key element of violence and abuse; and ensuring that the terms of domestic violence restraining orders (DVROs) consider forms of technological harassment and stalking. For the most part, as even the article noted, California has already adopted many of these changes. (Madison Lo, “A Domestic Violence Dystopia: Abuse via the Internet of Things and Remedies under Current Law,” 109 California Law Review 277 (2021).) Yet it appears that most legal responses to the problem of technological abuse have focused on the conduct and methods of the abuser.

This bill focuses not on the abusers, but on the managers, operators, and manufacturers of the devices. The bill contains two parts. The first part applies to “connected devices,” defined as internet-based devices that enable a person to remotely obtain data from, or send commands to, a connected device or account through a software application. The second part deals more specifically with “remote vehicle technology,” defined as any technology that allows a person who is outside of a vehicle to access the activity, track the location, or control any operation of the vehicle or its parts.

The first part of the bill would require “account managers” to block a perpetrator’s access to a connected device or account within two days of receiving a request from a survivor. The bill defines the “account manager” to mean a person or entity that provides the internet-based or app-based account, or a third party that manages the account on their behalf, and that has the authority to make decisions regarding access to the device or account. The bill sets forth the process and the documentation that must accompany a request.

The bill also requires manufacturers who sell or lease vehicles with remote technology within the state to provide the survivor with a means of disabling the perpetrator’s access to the technology. Most new cars offer some form of remote vehicle technology that allows someone with a smart phone app to check the vehicle’s location and even track the history of where the car has been. Some technology even allows a person to remotely lock and unlock the vehicle, turn it on or off, honk the horn, or even set the car’s climate controls. (Kashmir Hill, “Your Car Is Tracking You. Abusive Partners May Be, Too.” New York Times, Dec. 31, 2023.) However, rather than allowing this to be done within two days of the request, the bill requires the vehicle manufacturer to provide a means by which the survivor can deny access immediately, including by permitting the survivor – or any other person, for that matter – to disable the technology manually from inside the car without a password or login information.

Unintended consequences of immediate and manual disabling in vehicles. The ability to disable the tracking system, immediately and manually, without prior documentation could be a vital tool for a survivor who needs immediate protection from a perpetrator who is stalking, abusing, or harassing them by means of the vehicle tracking system. However, it also is possible that this capability could be misused. For example, if any person inside the vehicle could manually disable the technology, someone other than the survivor could misuse this method of deactivation. For example, a car thief could disable the tracking system in order to escape detection by law enforcement. A perpetrator might block access to a survivor, who might want to know the abuser’s location. Indeed, an abusive ex-husband could turn off the technology while kidnapping the survivor or the survivor’s children.

The remote vehicle technology provisions in this bill track the language of AB 3139 (Weber), which is now in the Senate Appropriations Committee, and which this Committee heard and passed in April. However, this Committee’s analysis pointed out potentially dangerous unintended consequences of manual disabling, and suggested that the author of that bill consider this possibility as the bill moved forward. Not only were the provisions of AB 3139 not amended, the prior Committee inserted the language from AB 3139 into the bill now before the Committee. The Committee believes that the author of this bill should also seriously consider these potential unintended consequences, albeit with the understanding that this bill is much later in the legislative process than was AB 3139 when heard by this Committee.

Technical feasibility and application to existing vehicles. As noted above, the bill requires any vehicle manufacturer that offers to sell, rent, or lease a vehicle with remote vehicle technology to ensure that a driver can immediately and manually disable the technology from inside the vehicle. Moreover, the driver must be able to do this without needing to use a password or enter any other login information. In addition to the unintended consequences discussed above, the Alliance for Automotive Innovation (Alliance) points out that, at present, few if any vehicles offer such a method of manual disabling this technology. In light of this, the Committee has asked the author’s office if it expects that the bill will only apply to vehicles manufactured after the operative date of this bill. That is, the bill imposes its restrictions on the “manufacturer.” Thus going forward, if manufacturers want to sell or lease their vehicles in California, they will need to install a manual mechanism that does not require access to the internet or a software application on all future vehicles that they manufacture. It is unclear, however, what obligation the manufacturer will owe to the driver of an existing vehicle within this state that has remote technology. The other requirements under the bill seem less problematic. For example, the manufacturer should be able to offer a secure means by which a survivor could ask the manufacturer to disable the technology remotely, by resetting or otherwise amending the existing account. However, the Alliance has raised questions about the ability of a manufacturer to do this legally where the abuser, as opposed to the survivor, is the owner of the vehicle and the account. Having said that, it is notable that the Alliance does not oppose this bill, but has only registered its concerns about a manufacturer’s ability to comply with the bill, both technologically and legally. The Alliance supports the intent of the bill, but simply wants to ensure – especially given that three different bills address the same issue – that compliance will be possible and requirements uniform.

Related legislation: do we need three bills on remote vehicle technology? As noted above, this bill is one of three pending pieces of legislation that seek to protect survivors of domestic violence from modern technology. The two other bills apply exclusively to remote vehicle technology. SB 1394 (Min) – which was not referred to this Committee – requires a vehicle manufacturer to terminate a person’s access to remote vehicle technology upon request from a driver who establishes proof that they have exclusive use and legal possession of the vehicle, are a survivor of domestic violence, and seek to block access to the perpetrator of that violence. AB 3139 (Weber), like this bill, requires a manufacturer that sells, rents, or leases vehicles with remote vehicle technology to ensure that a driver of the vehicle can immediately disable the remote vehicle technology from inside the car and without need of a password or login information. The key difference between SB 1394, on the one hand, and AB 3139 and this bill, on the other hand, has to do with both the immediacy and method of deactivation, as well as with the need for the survivor to provide prior documentation. While AB 3139 has the advantage of an easy and immediate means of activation, SB 1394 has the advantage of avoiding the potentially dangerous unintended consequences of allowing any person inside the vehicle to disable the technology manually. Ideally, the authors of SB 1394 and AB 3139 could find a way to incorporate the best aspects of both bills and find a solution that protects survivors in a workable fashion. Given that there are already two competing bills on remote vehicle technology, and because this bill covers “connected devices” not covered by the other two bills, the Committee suggested that the author remove the vehicle provisions from this bill. The author rejected that recommendation.

Enforcement. Of particular relevance to this Committee, the bill provides legal remedies if an account manager or vehicle manufacturer violates the provisions of the bill. An account manager or vehicle manufacturer that fails to deny access to a perpetrator, as required, would be subject to a civil action brought by any person injured by a violation, or by the Attorney General or a city or county public prosecutor acting in the name of the people of California. The account manager or vehicle manufacturer that violates the bill would be liable for a civil penalty of $2,500 for each violation. If the Attorney General brings the action, the fine will go to the General Fund. If a local city or county prosecutor brings the action, the fine will go to the city or county treasury. If a person injured by the violation brings an action, the penalty will go to that person.

The Alliance for Automotive Innovation has asked that the enforcement provision include protection from a possible lawsuit by an owner (an alleged perpetrator) denied access to the vehicle. The Alliance points out that under Civil Code Section 1491.6 (d), a property owner who changes locks to protect a victim of domestic violence is not liable to a person excluded. The Alliance seeks a similar provision that would protect them from a person, especially an owner, denied access, so long as the manufacturer acted in good faith compliance with the provisions of this bill. However, the bill only creates a civil action brought against a party or entity that fails to deny access, so that the person bringing a civil action under this bill would be the survivor, not the alleged perpetrator denied access. Thus, the Alliance is apparently concerned that a perpetrator denied access could bring a lawsuit on some other grounds, such as an unlawful taking or a common law conversion. If the bill passes out of this Committee, the author may wish to consider such an amendment.

ARGUMENTS IN SUPPORT: San Francisco Safehouse supports this bill because it “addresses digital harassment by requiring companies to swiftly cut off access for abusers at the request of a victim, ensuring immediate protection for one of our most vulnerable populations. . . While technology can serve as a valuable resource for victims,” Safehouse notes, “it is unfortunately frequently abused by perpetrators of domestic violence. Abusers can use modern technology to monitor, harass, threaten, and violate their victims.” Safehouse believes that “SB 1000 is a crucial measure to protect domestic violence victims from digital abuse and control [and] prevent abusers from using, controlling, or remotely harassing their victims when instances of abuse are reported by a victim – ensuring California law continues to empower and protect victims even as technology advances.”

ARGUMENTS IN SUPPORT IF AMENDED: While the Electronic Frontier Foundation (EFF) supports the general intent of this bill, it can only support the bill if significantly amended. First, for many connected devices found in a home, EFF notes that a person with physical access to the device can simply reset it to the original factory settings. This effectively cuts off the abuser’s access. Second, EFF contends that the “broad scope of S.B. 1000 creates a tremendous burden for device manufacturers, who will need to build an infrastructure that receives and verifies device disconnection requests with little additional benefit to survivors of abuse, who already have these other, simpler options for the majority of connected devices.” Third, EFF raises concerns about the privacy implications raised by the some of the information that the survivor must submit.

ARGUMENTS OF CONCERN: The Alliance for Automotive Innovation (Alliance) does not oppose this bill, but it believes that this bill, along with SB 1394 or AB 3139, will
“create unique challenges that must be addressed.” First, the Alliance asks for a single bill or careful coordination of the three bills, noting that manufacturers cannot comply with three different sets of requirements. Second, the Alliance argues that the requirements must be operationally and technologically feasible. Third, the Alliance believes that this bill, like the others, must better clarify the “appropriate level of legal documentation” needed to trigger the requirement to remove an abuser’s access to a vehicle. Of the three pending bills, the Alliance believes that SB 1394 establishes the appropriate standard of documentation. Finally, the Alliance argues that vehicle manufacturers should have protection from liability, just as property owners who change locks to protect tenants are not liable to abusers who are denied access to a dwelling.

REGISTERED SUPPORT / OPPOSITION:

Support

Alliance for Hope International

Oakland Privacy

Sacramento Regional Family Justice Center (SRFJS)

San Francisco Safehouse

Voices Survivor Advocacy Network

Support If Amended

Electronic Frontier Foundation

Concerns

Alliance for Automotive Innovation

Opposition

None on file

Analysis Prepared by: Tom Clark / JUD. / (916) 319-2334

Date of Hearing: June 18, 2024

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Rebecca Bauer-Kahan, Chair

SBPCA Bill Id:SB 1000

Author:(Ashby) – As Amended Ver:May 16, 2024

AS PROPOSED TO BE AMENDED

SENATE VOTE: 38-0

SUBJECT: Connected devices: device protection requests

SYNOPSIS

Alongside advances in technology are parallel advances in the dangers for people who are or were in relationships with violent perpetrators. The technological advances have brought new and inventive ways for perpetrators to abuse and torture the people in their lives. In fact, the federal government now recognizes technology-enabled abuse as a form of domestic abuse. The Office of Violence against Women housed in the US Department of Justice defines technological abuse as:

An act or pattern of behavior that is intended to harm, threaten, control, stalk, harass, impersonate, exploit, extort, or monitor another person that occurs using any form of technology, including but not limited to: internet enabled devices, online spaces and platforms, computers, mobile devices, cameras and imaging programs, apps, location tracking devices, or communication technologies, or any other emerging technologies.

As internet connected devices have become even more commonplace, domestic violence shelters have reported growing numbers of calls from women who are convinced they are going crazy. They are reporting that their air-conditioning systems were turning on and off without them touching them, that the code numbers on front door digital locks changed daily and they could not figure out why, or that they kept hearing the doorbell ring, but no one was ever there. Abusers not only use connected devices to terrorize their victims, but also to stalk and surveil their every move. Smart speakers can often be used to listen in on conversations in a home through an online app. Home security cameras and baby monitors can allow an abuser to watch and record their victims. Small tracking devices can easily be hidden in bags, clothing, or vehicles, allowing an abuser to monitor their current or former partner’s movements. As new technology seeps into everyday life, abusers have adopted and repurposed it to terrorize and control their current and former partners.

This bill is substantially similar to the federal Safe Connections Act (SCA) of 2022 (PL 117-223). The SCA requires mobile service providers to separate the line of a survivor of domestic violence (and other related crimes and abuse), and any individuals in the care of the survivor, from a mobile service contract shared with an abuser within two business days after receiving a request from the survivor. Like the SCA, within two business days of receiving a device protection request this bill requires the account manager for a connected device to deny access to any person listed in the protection request.

The scope of this bill includes vehicles. As with other bills in the Legislature that propose applying the policy framework of the SCA to connectivity in vehicles, the Committee has taken the position that allowing two business days to disconnect the technology is too long in the case where a survivor is in immediate danger and needs to use their vehicle to escape an abuser. Therefore, the suggested Committee amendments require that drivers be able to immediately disable remote technology manually from inside the car.

This bill is supported by San Francisco SafeHouse, Oakland Privacy, and Alliance for Hope International, among others. Should it pass this Committee, it will next be heard in the Judiciary Committee.

SUMMARY: Requires account managers of internet connected devices to deny account access to a person in response to a “device protection request” when the requester submits specified documentation, including verification that they are in exclusive legal possession or control of the connected device. Specifically, this bill:

1. Defines the relevant terms, including:
   1. “Account manager” means a person or entity that provides an individual an internet-based or app-based user account, or a third party that manages those user accounts on behalf of that person or entity, that has authority to make decisions regarding user access to those user accounts.
   2. “Connected device” means any device, or other physical object that is capable of connecting to the internet, directly or indirectly, and that is assigned an internet protocol (IP) or Bluetooth address.
   3. “Device access” means the ability to remotely control a connected device, remotely change the characteristics of a connected device, or remotely view or manipulate data collected by or through a connected device, by accessing a user account or accounts associated with the connected device. Acts that require device access include, but are not limited to, remotely manipulating an audio system, security system, light fixture, or other home appliance or fixture and accessing camera or location data from a motor vehicle.
2. Requires an account manager to do the following:
   1. Deny a person’s device access, as identified in a qualifying device protection request, within two business days.
   2. Offer the ability to submit a device protection request through secure remote means that are easily navigable. An account manager shall not require a specific form of documentation to submit a device protection request.
   3. Make information about these options publicly available on their website and mobile application, if applicable.
3. Requires a device protection request to include all of the following:
   1. Verification of the requester’s exclusive legal possession or control of the connected device, including, but not limited to, a dissolution decree, temporary restraining order, protective order, domestic violence restraining order, or other document indicating the requester’s exclusive use care, possession, or control of the connected device.
   2. Identification of the connected device or devices.
   3. Identification of the person that the requester seeks to deny device access.
4. Prohibits an account manager from conditioning a device protection request upon any limitation or requirement, including:
   1. Payment of a fee, penalty, or other charge.
   2. Approval of the device protection request by any other person who is not a legal owner or in legal possession of the device.
   3. A prohibition or limitation on the ability to deny device access as a result of arrears accrued by the account or associated with the connected device.
   4. An increase in the rate charged for the account if any subscription fee or other recurring charge for account access applies.
   5. Any other limitation or requirement.
5. Provides that an account manager, and other specified agents or employees, shall treat any information submitted as confidential and securely dispose of the information not later than 90 days after receiving the information. This does not prohibit the maintenance, for longer than the period specified, of a record that verifies that a requester fulfilled the conditions of a request.
6. Makes any waiver of these provisions void and unenforceable. The duties and obligations imposed are cumulative with any other duties or obligations imposed under other law, and shall not be construed to relieve any party from any duties or obligations imposed under other law. The remedies or penalties provided by this chapter are cumulative to each other and to the remedies or penalties available under all other laws of the state.
7. Includes a severability clause.
8. Makes these provisions operative on January 1, 2026.
9. Amends the definition of “disturbing the peace of the other party” for purposes of securing a restraining order to include conduct committed through a connected device.

EXISTING LAW:

1. Criminalizes conduct amounting to false imprisonment and human trafficking. (Pen. Code § 236 et seq.)
2. Criminalizes conduct amounting to rape, duress, and other unlawful sexual conduct, including prostitution and abduction. (Pen. Code § 261 et seq.)
3. Authorizes a court to issue an ex parte order enjoining a party from molesting, attacking, striking, stalking, threatening, sexually assaulting, battering, credibly impersonating, falsely personating, harassing, telephoning, including, but not limited to, making annoying telephone calls, destroying personal property, contacting, either directly or indirectly, by mail or otherwise, coming within a specified distance of, or disturbing the peace of the other party. “Disturbing the peace of the other party” refers to conduct that, based on the totality of the circumstances, destroys the mental or emotional calm of the other party. This conduct may be committed directly or indirectly, including through the use of a third party, and by any method or through any means including, but not limited to, telephone, online accounts, text messages, internet-connected devices, or other electronic technologies. (Fam. Code § 6320.)
4. Authorizes an adult person, or a parent or guardian on behalf of a minor or an incapacitated person, to apply to participate in the Safe at Home program by stating that they are a victim of specified conduct, including domestic violence, sexual assault, stalking, human trafficking, child abduction, or elder or dependent adult abuse, or is a household member of a victim, designating the Secretary of State (SOS) as the agent for service of process and receipt of mail, and providing the SOS with any address they wish to be kept confidential. (Gov, Code § 6206(a).)
5. Establishes the federal Safe Connections Act (SCA) of 2022, which requires mobile service providers to separate the line of a survivor of domestic violence (and other related crimes and abuse), and any individuals in the care of the survivor, from a mobile service contract shared with an abuser within two business days after receiving a request from the survivor. (PL 117-223).
6. Establishes the Safe at Home (SAH) address confidentiality program in order to enable state and local agencies to both accept and respond to requests for public records without disclosing the changed name or address of a victim of domestic violence, sexual assault, or stalking. (Gov. Code § 6205 et seq.)

FISCAL EFFECT: As currently in print, this bill is keyed non-fiscal.

COMMENTS:

1) Intimate Partner Violence. Nationally more than one-third of women will experience rape, physical violence, and/or stalking by an intimate partner in their lifetime. Nearly 8 million women experience one or more of these abuses by a current or former partner each year. There are nearly 90 domestic violence related killings in California each year. There were 87 deaths in 2020, 70 were women and 17 were men.^[1] The National Domestic Violence Hotline reports that an average of 24 people per minute are victims of rape, physical violence or stalking by an intimate partner in the United States — more than 12 million women and men over the course of a single year. Almost half of all women and men in the US have experienced psychological aggression by an intimate partner in their lifetime (48.4% and 48.8%, respectively).^[2]

Statistically speaking, the most dangerous place for a woman is not out in public, it is in her home. In addition, the most dangerous people for a woman are not strangers, they are the men she knows and has relationships with (e.g. current and former partners, fathers, brothers, and friends). Given where the danger generally lies, for those situations where the danger is also a current partner or someone else who lives in their home, survivors need a safe, quick means of escape.

Adding to the risk, the most dangerous time for someone who is in a relationship with a violent abuser is when they decide to leave. According to organizations working with survivors of abuse, when someone being abused in a relationship leaves or attempts to leave, abusers often lash out in an attempt to regain control over their partner or, in some cases, resort to extreme violence, even homicide, because they feel they have nothing left to lose.^[3] According to Canada’s Battered Women Support Services:

Separation is a common theme found within spousal murder-suicide where half of the cases occur after the couple have either separated (26%), were in the process of separating (9%), or had expressed a desire to separate (15%). . . . The statistics outline the reality that the most dangerous time for a survivor/victim is when she leaves the abusive partner; 77 percent of domestic violence-related homicides occur upon separation and there is a 75 percent increase of violence upon separation for at least two years.^[4]

With the omnipresent nature of technology that contains remote geo-location capabilities, especially vehicles, leaving an abuser becomes significantly more difficult, if the abuser has online access to the survivor’s location that allows them to track the survivor’s every movement.

2) The internet of things (IoT). The “internet of things” (IoT) refers to a network of devices, vehicles, appliances, and other physical objects that are embedded with sensors, software, and network connectivity, allowing them to collect and share data. Some examples are kitchen appliances, thermostats, door locks, home surveillance systems, or automated sprinklers.

According to IBM’s website:

IoT enables these smart devices to communicate with each other and with other internet-enabled devices. Like smartphones and gateways, creating a vast network of interconnected devices that can exchange data and perform various tasks autonomously. This can include:

• monitoring environmental conditions in farms
• managing traffic patterns with smart cars and other smart automotive devices
• controlling machines and processes in factories
• tracking inventory and shipments in warehouses

The potential applications of IoT are vast and varied, and its impact is already being felt across a wide range of industries, including manufacturing, transportation, healthcare, and agriculture. As the number of internet-connected devices continues to grow, IoT is likely to play an increasingly important role in shaping our world. Transforming the way that we live, work, and interact with each other.^[5]

3) Technology-enabled abuse. Alongside advances in technology are parallel advances in the dangers for people who are or were in relationships with violent perpetrators. The advances have brought new and inventive ways for perpetrators to abuse and torture the people in their lives. In fact, the federal government now recognizes technological abuse as a form of domestic abuse. The Office of Violence against Women housed in the US Department of Justice defines technological abuse as:

An act or pattern of behavior that is intended to harm, threaten, control, stalk, harass, impersonate, exploit, extort, or monitor another person that occurs using any form of technology, including but not limited to: internet enabled devices, online spaces and platforms, computers, mobile devices, cameras and imaging programs, apps, location tracking devices, or communication technologies, or any other emerging technologies.^[6]

A New York Times article in 2018 explored the relatively new phenomenon of abuse cases that were tied to the rise of smart home technology. According to that article, domestic violence shelters were reporting calls from women who were convinced they were going crazy. They were reporting that their air-conditioning systems were turning on and off without them touching them, that the code numbers on front door digital locks changed daily and they could not figure out why, or that they kept hearing the doorbell ring, but no one was ever there. At the time, the Times reported:

In more than 30 interviews with The New York Times, domestic abuse victims, their lawyers, shelter workers and emergency responders described how the technology was becoming an alarming new tool. Abusers — using apps on their smartphones, which are connected to the internet-enabled devices — would remotely control everyday objects in the home, sometimes to watch and listen, other times to scare or show power. Even after a partner had left the home, the devices often stayed and continued to be used to intimidate and confuse.^[7]

In the intervening years, internet connected devices have become even more commonplace. Abusers not only use connected devices to terrorize their victims, but also to stalk and surveil their every move. Smart speakers can often be used to listen in on conversations in a home through an online app. Home security cameras and baby monitors can allow an abuser to watch and record their victims. Small tracking devices can be easily hidden in bags, clothing, or vehicles, allowing an abuser to monitor their victim’s movements. As each new technology seeps into everyday life, abusers have adopted and repurposed them to terrorize and control their current and former partners.

Specifically as it relates to automobile technology, since 2012 when General Motors’ OnStar debuted Family Link, a service that allowed remote users to track their family members and receive alerts about where the car goes, advocates and experts working with survivors of stalking and domestic abuse have warned about the dangers related to allowing this type of technology to be used in cars without offering a way for it to discreetly be turned off by the driver.^[8] Over the last 12 years this technology has become more sophisticated and common with most new cars offering remote vehicle technology that allows someone with a smart phone app to check a car’s location, including following the movement of the car in real time; track the history of where the car has been driven to; lock and unlock the vehicle remotely; turn it on or off; set the car’s climate controls; make the horn honk; and turn on its lights.^[9]

According to a recent article in The New York Times, “Domestic violence experts say that these convenience features are being weaponized in abusive relationships, and that car makers have not been willing to assist victims. This is particularly complicated when the victim is a co-owner of the car, or not named on the title.”^[10] The goal of this bill is to require manufacturers and account holders for all connected devices to be responsive to women who are reporting that their abuser has used the company’s device as a weapon and that the abuser needs to be removed from the account.

4) Purpose of this bill. This bill is substantially similar to the federal Safe Connections Act (SCA) of 2022 (PL 117-223). The SCA requires mobile service providers to separate the line of a survivor of domestic violence (and other related crimes and abuse), and any individuals in the care of the survivor, from a mobile service contract shared with an abuser within two business days after receiving a request from the survivor. Like the SCA, within two business days of receiving a device protection request this bill requires the account manager for a connected device to deny access to any person listed in the protection request.

5) Author’s statement. According to the author:

SB 1000 requires companies to swiftly cut off access to shared accounts, applications, and devices, offering immediate protections for domestic violence victims when proper documentation is provided. This is a necessary measure that addresses the increasingly prevalent problem of digital abuse and control in domestic violence cases.

Domestic violence organizations continue to raise concerns about the increasing number of abuse cases related to internet-connected devices and shared accounts. Victims report escalating issues of virtual abuse, including loss of autonomy over everyday household items such as doors, speakers, thermostats, lights, cameras, and even vehicles. While modern technology offers convenience and connectivity, it has unfortunately become a tool for perpetrators to exert control over their victims remotely.

SB 1000 addresses the urgent need to stop this alarming new trend. This bill empowers victims and provides a crucial layer of protection. It ensures that California law evolves alongside technological advancements, empowering and safeguarding victims of domestic violence.

6) Analysis. As noted previously, this bill is modeled after federal legislation that allows survivors to have their mobile phones separated from family plans or contracts that are connected to their abuser. This allows survivors to keep their phones and phone numbers. Under that law and this legislation, businesses have two business days to break the connection between devices once the business receives a request accompanied by documentation from a survivor.

Arguably, someone escaping violence could turn off their phone while leaving an abuser and wait for the time it takes for the mobile phone career to separate the phone from the connected account before turning it back on. Similarly, someone experiencing technology enabled abuse in their home through the use of internet connected appliances and other devices, may be able to temporarily cover the security cameras, unplug an appliance or reset a Wi-Fi password while the connected devices account manager removes the abuser’s access. However, as discussed in detail in previous sections of this analysis, the most dangerous time in an abusive relationship is when the survivor is attempting to leave their abusive partner. Having access to a vehicle is critical during that time for most survivors. Unfortunately, as currently drafted, this bill allows auto manufacturers the same two business-day period to disconnect the remote vehicle technology. Imagine being a survivor in an increasingly dangerous relationship who needs to flee the Friday before Memorial Day. Under this bill, an abuser would have five days to track the person fleeing before the connection is broken. This is ample time for an abuser to track down their victim and either harm them more or coerce them into returning to their home.

Three bills modeled after the Safe Connection Act were introduced in the Legislature this year. AB 3139 (Weber) and AB 1394 (Min) both initially focused solely on applying the policy framework established in the Act to allowing survivors of domestic abuse to request that an auto manufacturer disconnect their vehicles from any remote capabilities. As noted above, the manufacturers would be provided with two business days to fulfill the request. This bill, however, takes the policy framework in the Safe Connection Act and applies it broadly to all connected devices including home appliances, thermostats, locks, doorbells, vehicles, and any other devices that is connected remotely to an application.

When it comes to connectivity in vehicles, the Committee has taken the position that the delayed time frame in all three bills is too long and has proposed amendments to all of the bills that are designed to accomplish three key things:

1. The driver must be able to manually disable the connectivity from inside the car without needing to log into an account or provide a password.
2. Disabling the technology cannot result in account-holders or registered owner being notified that it has been disconnected by the driver.
3. The survivor must be provided with a grace period that allows her time to get to safety and then gather and submit the documents required to permanently remove the abuser from remote access.

Creating a safe harbor. The intent of these amendments is to provide survivors with the immediate protection they need when using their vehicle to escape escalating violence, while allowing them time to submit the necessary information to an auto manufacturer establishing that even though the survivor may not be the registered owner of the vehicle, they have a right to disconnect the technology. The amendments still require that survivors provide the necessary documentation needed to establish their right to the car. This is intended to ensure that abusers cannot further weaponize the vehicle by manually disabling the technology in the car and simply claiming that they are the person being abused in the relationship.

7) Suggested Committee amendments. In order to effectuate the goals discussed in the previous section, the Committee suggests adopting the following amendments.

Amendment #1 adds the following definition to 22948.30:

(d) “Remote vehicle technology” means any technology that allows a person who is outside of a vehicle to access the activity, track the location, or control any operation of the vehicle or its parts, that includes, but is not limited to, any of the following:

(1) A Global Positioning System (GPS).

(2) An app-based technology.

(3) Any other remote wireless connectivity technology.

Amendment #2 inserts the following section:

22948.33.1 (a) A vehicle manufacturer that offers a vehicle for sale, rent, or lease in the state that includes remote vehicle technology shall do all of the following:

(1) Ensure that the remote vehicle technology can be immediately manually disabled by a driver of the vehicle while that driver is inside the vehicle by a method that meets all of the following criteria:

(A) The method of manually disabling the remote vehicle technology shall be prominently located and easy to use and does not require access to a remote, online application.

(B) Upon its use, the method of manually disabling the remote vehicle technology shall inform the user of the requirements of subdivision (b).

(C) The method of manually disabling the remote vehicle technology shall not require a password or any log-in information.

(D) Upon its use, the method of manually disabling the remote vehicle technology shall not result in the remote vehicle technology, vehicle manufacturer, or a third-party service provider sending to the registered owner of the car an email, telephone call, or any other notification related to the remote vehicle technology being disabled.

(E) Upon its use, the method of manually disabling the remote vehicle technology shall cause the remote vehicle technology to be disabled for a minimum of seven days and capable of being reenabled only by the vehicle manufacturer pursuant to paragraph (4).

(2) Offer secure remote means via the internet for a requester to submit a vehicle separation notice that includes a prominent link on the vehicle manufacturer’s internet website.

(3) Upon the request, reset the remote vehicle technology with a new secure account and delete all data from the original account.

(4) Reenable the remote vehicle technology only if the registered owner of the car notifies the manufacturer that the remote vehicle technology was disabled in error, and a requester has not contacted the vehicle manufacturer to provide the information required by subdivision (b) within seven days of the remote vehicle technology being disabled.

(b) A requester shall submit a vehicle separation notice to a vehicle manufacturer through the means provided by the vehicle manufacturer pursuant to paragraph (2) of subdivision (a) within 7 days of the date on which the requester used the method of manually disabling remote vehicle technology required by subdivision (a), which shall include the vehicle identification number of the vehicle and a copy of either of the following documents that supports that the perpetrator has committed, or allegedly committed,  a covered act against the requester or an individual in the requester’s care:

(1) A signed affidavit from any of the following individuals acting within the scope of that person’s employment:

(A) A licensed medical or mental health care provider.

(B) A licensed military medical or mental health care provider.

(C) A licensed social worker.

(D) A victim services provider.

(E) A licensed military victim services provider.

(2) A copy of any of the following documents:

(A) A police report.

(B) A statement provided by the police, including military police, to a magistrate judge or other judge.

(C) A charging document.

(D) A protective or restraining order, including military protective orders.

(E) Any other relevant document that is an official record.

(c) (1) Only if, for technological reasons, a vehicle manufacturer is unable to comply with paragraph (1) of subdivision (a), the vehicle manufacturer shall disable remote vehicle technology within one business day after receiving a request that includes the information required by subdivision (b) and is submitted pursuant to the mechanism required by paragraph (1).

8) Larger policy questions. While this bill has the potential to make a significant difference in the lives of those fleeing abusive partners, it raises larger policy considerations related to the invasive nature of technology that would benefit from additional attention. With the proliferation of surveillance and tracking technology, including built in vehicle location technology, tracking devices that can easily be concealed in a car or in someone’s belongings, in home and public surveillance cameras, automated license plate recognition tools, not to mention the ability to track someone using the smartphones that are virtually universal, at what point has surveillance gone too far? Should Californians simply accept the complete loss of privacy as people move through their lives in public and private spaces?

Much like the focus that is being placed on the impact of social media, advancement in artificial technology, and the collection and sale of personal information for profit, constant surveillance by private individuals, businesses, and government has a profound impact on Californians’ lives. Rather than considering the risks of one device or technological advancement at a time, at some point, it might behoove the Legislature, and this Committee in particular, to explore the larger surveillance policy questions, including the dangers associated with the unchecked proliferation of surveillance tools and their impact on Californians’ privacy rights, especially for those who are at risk of abuse.

9) Related legislation. AB 3139 (Weber, 2024) requires the manufacturer of a vehicle with remote vehicle technology allowing the vehicle to be tracked to equip the vehicle with a feature that allows the driver to immediately sever the connection between the vehicle and the remote application. In addition, it prohibits manufacturers from restoring the connection for one week, while allowing a survivor of domestic abuse the opportunity to provide a vehicle separation request accompanied by the required documentation. This bill is currently pending in the Senate Judiciary Committee.

SB 1394 (Min, 2024) requires a vehicle manufacturer to terminate a person’s access to remote vehicle technology upon a completed request from a driver who establishes legal possession of the vehicle or a domestic violence restraining order naming the person whose access is sought to be terminated. The bill would prohibit a vehicle manufacturer from charging a fee to a driver for completing their request to terminate a person’s access to remote vehicle technology. That bill is pending in this Committee.

ARGUMENTS IN SUPPORT:

Writing in support of the bill, Oakland Privacy notes:

Unfortunately, the advancement of technology has brought with it novel ways for abusers to perpetrate acts of domestic violence and coercive control. And the potential for abuse will grow if not curbed by law. In 2022 The National Domestic Violence Hotline received 35,145 calls (with 18% of the calls featuring some level of digital abuse).

An IoT device is any standalone internet-connected device that can be monitored and/or controlled remotely and a recent study found that U.S. households have an average of connected devices. It is readily apparent that IoT devices will proliferate exponentially, and with that will also come more abuse through those technologies. Abuse of IoT devices can not only intimidate, harass or attempt to control, but can also negatively affect a victim’s life in other kinds of ways. For example, an abuser remotely unlocked a victim’s home and car, and then weaponized the malicious acts claiming they were an indication that the victim was an unfit parent in a child custody battle.

Also writing in support, San Francisco SafeHouse further argues:

The National Domestic Violence Hotline reports that one in four women and one in seven men are survivors of severe domestic violence in their lifetime. An average of 24 people per minute are victims of rape, physical violence, or stalking by an intimate partner in the United States — more than 12 million women and men over the course of a single year. Almost half of all women and men in the US have experienced psychological aggression by an intimate partner in their lifetime.

While technology can serve as a valuable resource for victims, it is unfortunately frequently abused by perpetrators of domestic violence. Abusers can use modern technology to monitor, harass, threaten, and violate their victims. Technology advancements and an increase in the use of technology have become troubling tools in cases of domestic violence and harassment.

Perpetrators leverage apps and accounts to control everyday objects within the victims’ possession. Even after the abuser has left, the connected devices and accounts often remain with a victim, continuing to be used as a means of intimidating victims.

SB 1000 is a crucial measure to protect domestic violence victims from digital abuse and control. This bill will prevent abusers from using, controlling, or remotely harassing their victims when instances of abuse are reported by a victim – ensuring California law continues to empower and protect victims even as technology advances.

REGISTERED SUPPORT / OPPOSITION:

Support

Alliance for Hope International
Oakland Privacy
Sacramento Regional Family Justice Center (SRFJS)
San Francisco Safehouse
Voices Survivor Advocacy Network

Support If Amended

Electronic Frontier Foundation

Analysis Prepared by: Julie Salley / P. & C.P. / (916) 319-2200

1. California Partnership to End Domestic Violence. California Domestic Violence Fact Sheet (2022) https://www.cpedv.org/policy-priorities. ↑

2. The National Domestic Violence Hotline. Domestic Violence Statistics. https://www.thehotline.org/stakeholders/domestic-violence-statistics/. ↑

3. Will My Partner Be Violent After I Leave? How to predict violence after leaving an abuser. DomesticShelters.org. (Mar. 24, 2017) https://www.domesticshelters.org/articles/safety-planning/will-my-partner-be-violent-after-i-leave. ↑

4. Eighteen Months After Leaving Domestic Violence is Still the Most Dangerous Time, Battered Women’s Support Services (Jun. 11, 2020) https://www.bwss.org/eighteen-months-after-leaving-domestic-violence-is-still-the-most-dangerous-time/. ↑

5. IBM, What is the IoT? https://www.ibm.com/topics/internet-of-things. ↑

6. Information on the types of domestic violence and the Office of Violence against Women can be found at https://www.justice.gov/ovw/domestic-violence. ↑

7. Bowles, Nellie. “Thermostats, Locks and Lights: Digital Tools of Domestic Abuse,” The New York Times (Jun. 23, 2018) https://www.nytimes.com/2018/06/23/technology/smart-home-devices-domestic-abuse.html. ↑

8. Lineman, Tracey. “Connected Car Technology Can Enable Abusers to Track Their Victims,” Motherboard, Tech by Vice (Aug. 14, 2018) available at https://www.vice.com/en/article/gy3kw7/internet-connected-car-technology-can-enable-abusers-to-track-victims. ↑

9. Hill, Kashmir. “Your Car Is Tracking You. Abusive Partners May Be, Too.” The New York Times (Dec. 31, 2023) available at https://www.nytimes.com/2023/12/31/technology/car-trackers-gps-abuse.html. ↑

10. Ibid. ↑

 THIRD READING  

Bill No: SB 1000

Author: Ashby (D) and Rubio (D)

Amended: 5/16/24

Vote: 21

SENATE JUDICIARY COMMITTEE: 11-0, 4/23/24

AYES: Umberg, Wilk, Allen, Ashby, Caballero, Durazo, Gonzalez, Laird, Min, Niello, Wahab

SENATE APPROPRIATIONS COMMITTEE: 7-0, 5/16/24

AYES: Caballero, Jones, Ashby, Becker, Bradford, Seyarto, Wahab

SUBJECT: Connected devices: device protection requests

SOURCE: Author

DIGEST:

This bill requires account managers of connected devices to deny account access to a person in response to a “device protection request” when the requester submits specified documentation, including verification that they are in exclusive legal possession or control of the connected device.

ANALYSIS:

Existing law:

1. Criminalizes conduct amounting to false imprisonment and human trafficking. (Pen. Code § 236 et seq.)
2. Criminalizes conduct amounting to rape, duress, and other unlawful sexual conduct, including prostitution and abduction. (Pen. Code § 261 et seq.)
3. Authorizes a court to issue an ex parte order enjoining a party from molesting, attacking, striking, stalking, threatening, sexually assaulting, battering, credibly impersonating, falsely personating, harassing, telephoning, including, but not limited to, making annoying telephone calls, destroying personal property, contacting, either directly or indirectly, by mail or otherwise, coming within a specified distance of, or disturbing the peace of the other party. “Disturbing the peace of the other party” refers to conduct that, based on the totality of the circumstances, destroys the mental or emotional calm of the other party. This conduct may be committed directly or indirectly, including through the use of a third party, and by any method or through any means including, but not limited to, telephone, online accounts, text messages, internet-connected devices, or other electronic technologies. (Fam. Code § 6320.)
4. Authorizes an adult person, or a parent or guardian on behalf of a minor or an incapacitated person, to apply to participate in the Safe at Home program by stating that they are a victim of specified conduct, including domestic violence, sexual assault, stalking, human trafficking, child abduction, or elder or dependent adult abuse, or is a household member of a victim, designating the Secretary of State (SOS) as the agent for service of process and receipt of mail, and providing the SOS with any address they wish to be kept confidential. (Gov’t Code § 6206(a).)

This bill:

1. Defines the relevant terms, including:
   1. “Account manager” means a person or entity that provides an individual an internet-based or app-based user account, or a third party that manages those user accounts on behalf of that person or entity, that has authority to make decisions regarding user access to those user accounts.
   2. “Connected device” means any device, or other physical object that is capable of connecting to the internet, directly or indirectly, and that is assigned an internet protocol (IP) or Bluetooth address.
   3. “Device access” means the ability to remotely control a connected device, remotely change the characteristics of a connected device, or remotely view or manipulate data collected by or through a connected device, by accessing a user account or accounts associated with the connected device. Acts that require device access include, but are not limited to, remotely manipulating an audio system, security system, light fixture, or other home appliance or fixture and accessing camera or location data from a motor vehicle.
2. Requires an account manager to do the following:
   1. Deny a person’s device access, as identified in a qualifying device protection request, within two business days.
   2. Offer the ability to submit a device protection request through secure remote means that are easily navigable. An account manager shall not require a specific form of documentation to submit a device protection request.
   3. Make information about these options publicly available on their website and mobile application, if applicable.
3. Requires a device protection request to include all of the following:
   1. Verification of the requester’s exclusive legal possession or control of the connected device, including, but not limited to, a dissolution decree, temporary restraining order, protective order, domestic violence restraining order, or other document indicating the requester’s exclusive use care, possession, or control of the connected device.
   2. Identification of the connected device or devices.
   3. Identification of the person that the requester seeks to deny device access.
4. Prohibits an account manager from conditioning a device protection request upon any limitation or requirement, including:
   1. Payment of a fee, penalty, or other charge.
   2. Approval of the device protection request by any other person who is not a legal owner or in legal possession of the device.
   3. A prohibition or limitation on the ability to deny device access as a result of arrears accrued by the account or associated with the connected device.
   4. An increase in the rate charged for the account if any subscription fee or other recurring charge for account access applies.
   5. Any other limitation or requirement.
5. Provides that an account manager, and other specified agents or employees, shall treat any information submitted as confidential and securely dispose of the information not later than 90 days after receiving the information. This does not prohibit the maintenance, for longer than the period specified, of a record that verifies that a requester fulfilled the conditions of a request.
6. Makes any waiver of these provisions void and unenforceable. The duties and obligations imposed are cumulative with any other duties or obligations imposed under other law, and shall not be construed to relieve any party from any duties or obligations imposed under other law. The remedies or penalties provided by this chapter are cumulative to each other and to the remedies or penalties available under all other laws of the state.
7. Includes a severability clause.
8. Makes these provisions operative on January 1, 2026.
9. Amends the definition of “disturbing the peace of the other party” for purposes of securing a restraining order to include conduct committed through a connected device.

Background

Domestic violence can take many forms, but generally involve a pattern of behaviors by an abuser to gain and maintain power and control over a victim. This can involve emotional abuse, intimidation, economic abuse, coercion and threats, and physical or sexual violence. Abusers can assert control over economic resources, children, and modes of transportation. Escaping domestic violence is often harrowing and beset by fear of being caught or found by the abuser.

With the near ubiquitous nature of connected devices and attendant tracking mechanisms, a new tool for abusers to maintain power and control has caused alarm among survivors and advocates. Research and reporting finds that abusers are increasingly using connected devices in homes and other consumer products to harass and terrify their victims even after they have managed to escape.

This bill provides a mechanism for submitting a “device protection request” to deny device access to connected devices to other persons. However, a person needs to verify that they have exclusive legal possession or control of the device. The bill also does not require the account manager to notify the requester when the account manager intends to notify the person being denied access. There is no mechanism for enforcement identified in the bill. This bill is author-sponsored. The bill is supported by Oakland Privacy and Alliance for Hope International. No timely opposition was received.

Comment

According to the author:

SB 1000 requires companies to swiftly cut off access to shared accounts, applications, and devices, offering immediate protections for domestic violence victims when proper documentation is provided. This is a necessary measure that addresses the increasingly prevalent problem of digital abuse and control in domestic violence cases.

Domestic violence organizations continue to raise concerns about the increasing number of abuse cases related to internet-connected devices and shared accounts. Victims report escalating issues of virtual abuse, including loss of autonomy over everyday household items such as doors, speakers, thermostats, lights, cameras, and even vehicles. While modern technology offers convenience and connectivity, it has unfortunately become a tool for perpetrators to exert control over their victims remotely.

SB 1000 addresses the urgent need to stop this alarming new trend. This bill empowers victims and provides a crucial layer of protection. It ensures that California law evolves alongside technological advancements, empowering and safeguarding victims of domestic violence.

FISCAL EFFECT: Appropriation: No Fiscal Com.: No Local: No

According to the Senate Appropriations Committee:

Unknown, potentially significant workload cost pressures (General Fund, Trial Court Trust Fund) to the courts.

SUPPORT: (Verified 5/17/24)

Alliance for Hope International

Oakland Privacy

OPPOSITION: (Verified 5/17/24)

None received

ARGUMENTS IN SUPPORT: Oakland Privacy states:

Modern technology has enabled perpetrators to facilitate abuse in a myriad of ways, from a distance and with little effort or cost. SB 1000 affords victims of domestic violence with legal protections to break from the grips of an abuser who utilizes connected devices (IoT devices) - an insidious exploitation of privacy - to harass, intimidate, monitor or control their victims, and endanger their physical safety.

Prepared by: Christian Kurpiewski / JUD. / (916) 651-4113

5/18/24 16:20:46

**** END ****

SENATE COMMITTEE ON APPROPRIATIONS

Senator Anna Caballero, Chair

2023 - 2024 Regular Session

SB 1000 (Ashby) - Connected devices: access: abusers

Bill Summary:

SB 1000 authorizes victims of specified acts to submit a device protection request, to deny abusers access to internet-connected devices.

*********** ANALYSIS ADDENDUM – SUSPENSE FILE ***********

The following information is revised to reflect amendments

adopted by the committee on May 16, 2024

Fiscal Impact:

Unknown, potentially significant workload cost pressures (General Fund, Trial Court Trust Fund) to the courts.

Committee Amendments:

Clarify that a person requesting device protection must be the sole legal owner of the device.

-- END --

SENATE COMMITTEE ON APPROPRIATIONS

Senator Anna Caballero, Chair

2023 - 2024 Regular Session

SB 1000 (Ashby) - Connected devices: access: abusers

Bill Summary: SB 1000 authorizes victims of specified acts to submit a device protection request, to deny abusers access to internet-connected devices.

Fiscal Impact:

• Unknown, potentially significant workload cost pressures (General Fund, Trial Court Trust Fund) to the courts to adjudicate civil cases filed by victims and civil enforcement actions brought by the Department of Justice (DOJ) and local prosecutors to enforce this bill. Actual costs will depend on the number of cases filed and the amount of time needed to adjudicate each case. It generally costs approximately $1,000 to operate a courtroom for one hour. Consequently, if additional cases are filed under the provisions of this measure that otherwise would not be available under existing law take 50 or more hours of court involvement, the cost pressures of this measure to the courts would surpass the Suspense File threshold. While the superior courts are not funded on a workload basis, an increase in workload could result in delayed court services and would put pressure on the General Fund to increase the amount appropriated to backfill for trial court operations. For illustrative purposes, the Governor’s 2024-25 state budget proposes $83.1 million ongoing General Fund to continue to backfill the Trial Court Trust Fund for expected revenue declines.
• Unknown, potentially significant workload cost pressures (General Fund, local funds) to the DOJ and local prosecutors to enforce the violations of this bill. However, costs may be offset to the extent any penalty revenue is successfully collected and allocated back to the General Fund and treasurer of the county in which the judgment was entered, as specified in this bill.

Background: Although many internet-enabled technologies provide consumers with convenience – like the ability to lock and unlock a car remotely or check the vehicle’s location in real time via an app – these features can also be weaponized against a survivor in an abusive relationship. The purpose of this bill is to provide victims of domestic violence with legal protections from an abuser who utilizes connected devices to harass, intimidate, monitor or control their victims, and endanger their physical safety.

Proposed Law:

• Defines the relevant terms, including:
  • “Abuser” means an individual who has committed or allegedly committed a covered act against a victim or an individual in the victim’s care.
  • “Account manager” means a person or entity that provides an individual an internet-based or app-based user account, or a third party that manages those user accounts on behalf of that person or entity that has authority to make decisions regarding user access to those user accounts.
  • “Connected device” means any device, or other physical object that is capable of connecting to the internet, directly or indirectly, and that is assigned an internet protocol (IP) or Bluetooth address.
  • “Covered act” means conduct that constitutes specified offenses, including rape, trafficking, sex offenses, but does not require a conviction or any other court determination.
    
  • “Device access” means the ability to remotely control a connected device, remotely change the characteristics of a connected device, or remotely view or manipulate data collected by or through a connected device, by accessing a user account or accounts associated with the connected device. Acts that require device access include, but are not limited to, remotely manipulating an audio system, security system, light fixture, or other home appliance or fixture and accessing camera or location data from a motor vehicle.
  • “Victim” means an individual against whom a covered act has been committed or allegedly committed or who cares for another individual against whom a covered act has been committed or allegedly committed, provided that the individual providing care did not commit or allegedly commit the covered act.
    
• Authorizes a victim seeking to deny an abuser “device access” to submit to the account manager a device protection request that includes both of the following:
  • A verification that the abuser has committed or allegedly committed a covered act against the victim or an individual in the victim’s care, by providing either of a signed affidavit from a licensed medical or mental health care provider, licensed military medical or mental health care provider, licensed social worker, victim services provider, or licensed military victim services provider, or an employee of a court, acting within the scope of that person’s employment, or a police report, statements provided by police, including military police, to magistrates or judges, charging documents, protective or restraining orders, military protective orders, or any other official record that documents the covered act; and,
    
  • Identification of the connected device or devices that the victim seeks to deny the abuser access to, and a statement that the connected device or devices are solely owned by the victim or an individual in the victim’s care, legally under the sole possession or control of the victim or an individual in the victim’s care, or a fixture or feature within a dwelling or motor vehicle that the abuser may not legally enter or use.
    
• Requires an account manager to deny device access to an abuser, as identified in the request, within two business days.
• Provides that an account manager, and other specified agents or employees, shall treat any information submitted by a victim as confidential and securely dispose of the information not later than 90 days after receiving the information.
  
• Subjects account managers in knowing violation of these provisions, and abusers that knowingly maintain device access despite access denial, to civil actions brought by any person injured by the violation or in the name of the people of the State of California by the Attorney General or by any district attorney. The court may award injunctive relief, and any other relief necessary to prevent a violation. Those in knowing violation are also liable for civil penalties not to exceed $2,500 for each connected device. If the action is brought by the Attorney General, the penalty shall be deposited into the General Fund. If the action is brought by a district attorney, the penalty shall be paid to the treasurer of the county in which the judgment was entered.

Related Legislation:

• SB 1394 (Min) would require a vehicle manufacturer to create a process for terminating a person’s access to remote vehicle technology, as defined, upon a completed request from a driver who establishes proof of legal possession of the vehicle. SB 1394 is pending on the Senate Floor.
• AB 3139 (Weber) would requires the manufacturer of a vehicle with certain remote vehicle technology to immediately reset the technology, as specified, upon the request of a survivor of domestic violence. AB 3139 is pending in Assembly Appropriations Committee.

-- END --

SENATE JUDICIARY COMMITTEE

Senator Thomas Umberg, Chair

2023-2024 Regular Session

Bill No: SB 1000 (Author:Ashby)

Version: March 13, 2024

Hearing Date: April 23, 2024

Fiscal: Yes

Urgency: No

Consultant: CK

SUBJECT

Connected devices: access: abusers

DIGEST

This bill authorizes victims of “covered acts,” as defined, to submit a “device protection request,” to with specified documentation, to deny abusers access to connected devices.

EXECUTIVE SUMMARY

Domestic violence can take many forms, but generally involve a pattern of behaviors by an abuser to gain and maintain power and control over a victim. This can involve emotional abuse, intimidation, economic abuse, coercion and threats, and physical or sexual violence. Abusers can assert control over economic resources, children, and modes of transportation. Escaping domestic violence is often harrowing and beset by fear of being caught or found by the abuser.

With the near ubiquitous nature of connected devices and attendant tracking mechanisms, a new tool for abusers to maintain power and control has caused alarm among survivors and advocates. Research and reporting finds that abusers are increasingly using connected devices in homes and other consumer products to harass and terrify their victims even after they have managed to escape.

This bill provides a mechanism for survivors of “covered acts” to regain control of these devices. These acts include false imprisonment, human trafficking, and other sexual crimes. With verification that a covered act has been committed against the victim and verification of the device as the victim’s or in the victim’s exclusive control or fixed within their home or vehicle, account managers, those in control of device access, must grant a device protection request, essentially denying the abuser access to the connected device. This bill is author-sponsored. The bill is supported by Oakland Privacy and Alliance for Hope International. No timely opposition was received.

PROPOSED CHANGES TO THE LAW

Existing law:

1. Criminalizes conduct amounting to false imprisonment and human trafficking. (Pen. Code § 236 et seq.)
2. Criminalizes conduct amounting to rape, duress, and other unlawful sexual conduct, including prostitution and abduction. (Pen. Code § 261 et seq.)
3. Authorizes a court to issue an ex parte order enjoining a party from molesting, attacking, striking, stalking, threatening, sexually assaulting, battering, credibly impersonating, falsely personating, harassing, telephoning, including, but not limited to, making annoying telephone calls, destroying personal property, contacting, either directly or indirectly, by mail or otherwise, coming within a specified distance of, or disturbing the peace of the other party. “Disturbing the peace of the other party” refers to conduct that, based on the totality of the circumstances, destroys the mental or emotional calm of the other party. This conduct may be committed directly or indirectly, including through the use of a third party, and by any method or through any means including, but not limited to, telephone, online accounts, text messages, internet-connected devices, or other electronic technologies. (Fam. Code § 6320.)
4. Authorizes an adult person, or a parent or guardian on behalf of a minor or an incapacitated person, to apply to participate in the Safe at Home program by stating that they are a victim of specified conduct, including domestic violence, sexual assault, stalking, human trafficking, child abduction, or elder or dependent adult abuse, or is a household member of a victim, designating the Secretary of State (SOS) as the agent for service of process and receipt of mail, and providing the SOS with any address they wish to be kept confidential. (Gov’t Code § 6206(a).)

This bill:

1. Defines the relevant terms, including:
   1. “Abuser” means an individual who has committed or allegedly committed a covered act against a victim or an individual in the victim’s care.
   2. “Account manager” means a person or entity that provides an individual an internet-based or app-based user account, or a third party that manages those user accounts on behalf of that person or entity, that has authority to make decisions regarding user access to those user accounts.
   3. “Connected device” means any device, or other physical object that is capable of connecting to the internet, directly or indirectly, and that is assigned an internet protocol (IP) or Bluetooth address.
   4. “Covered act” means conduct that constitutes any of the following, but does not require a conviction or any other court determination:
      1. A crime described in Penal Code Section 236 et seq. or Section 261 et seq.
      2. An act under federal law, tribal law, or the Uniform Code of Military Justice that is similar to an offense described above.
   5. “Device access” means the ability to remotely control a connected device, remotely change the characteristics of a connected device, or remotely view or manipulate data collected by or through a connected device, by accessing a user account or accounts associated with the connected device. Acts that require device access include, but are not limited to, remotely manipulating an audio system, security system, light fixture, or other home appliance or fixture and accessing camera or location data from a motor vehicle.
   6. “Victim” means an individual against whom a covered act has been committed or allegedly committed or who cares for another individual against whom a covered act has been committed or allegedly committed, provided that the individual providing care did not commit or allegedly commit the covered act.
2. Authorizes a victim seeking to deny an abuser “device access” to submit to the account manager a device protection request that includes both of the following:
   1. A verification that the abuser has committed or allegedly committed a covered act against the victim or an individual in the victim’s care, by providing either of the following:
      1. A copy of a signed affidavit from a licensed medical or mental health care provider, licensed military medical or mental health care provider, licensed social worker, victim services provider, or licensed military victim services provider, or an employee of a court, acting within the scope of that person’s employment.
      2. A copy of a police report, statements provided by police, including military police, to magistrates or judges, charging documents, protective or restraining orders, military protective orders, or any other official record that documents the covered act.
   2. Identification of the connected device or devices that the victim seeks to deny the abuser access to, and a statement that the connected device or devices are at least one of the following:
      1. Solely owned by the victim or an individual in the victim’s care.
      2. Legally under the sole possession or control of the victim or an individual in the victim’s care.
      3. A fixture or feature within a dwelling or motor vehicle that the abuser may not legally enter or use.
3. Requires an account manager to do the following:
   1. Deny device access to an abuser, as identified in the request, within two business days.
   2. Offer a victim the ability to submit a device protection request through secure remote means that are easily navigable. An account manager shall not require a specific form of documentation to submit a device protection request.
   3. Make information about these options publicly available on their website and mobile application, if applicable.
   4. Notify the victim of both of the following:
      1. The date on which they intend to give any formal notice to the abuser that has had their device access denied.
      2. That the account manager may contact the victim, or designated representative, to confirm that the abuser’s device access is denied, or to notify the victim that the device protection request is incomplete.
4. Prohibits an account manager from conditioning a device protection request upon any limitation or requirement, including:
   1. Payment of a fee, penalty, or other charge.
   2. Approval of the device protection request by any person who has device access that is not the victim.
   3. A prohibition or limitation on the ability to deny device access to an abuser as a result of arrears accrued by the account or associated with the connected device.
   4. An increase in the rate charged for the account if any subscription fee or other recurring charge for account access applies.
   5. Any other limitation or requirement.
5. Provides that an account manager, and other specified agents or employees, shall treat any information submitted by a victim as confidential and securely dispose of the information not later than 90 days after receiving the information. This does not prohibit the maintenance, for longer than the period specified, of a record that verifies that a victim fulfilled the conditions of a request.
6. Subjects account managers in knowing violation of these provisions, and abusers that knowingly maintain device access despite access denial, to civil actions brought by any person injured by the violation or in the name of the people of the State of California by the Attorney General or by any district attorney. The court may award injunctive relief, and any other relief necessary to prevent a violation. Those in knowing violation are also liable for civil penalties not to exceed $2,500 for each connected device. If the action is brought by the Attorney General, the penalty shall be deposited into the General Fund. If the action is brought by a district attorney, the penalty shall be paid to the treasurer of the county in which the judgment was entered.
7. Makes any waiver of these provisions void and unenforceable. The duties and obligations imposed are cumulative with any other duties or obligations imposed under other law, and shall not be construed to relieve any party from any duties or obligations imposed under other law. The remedies or penalties provided by this chapter are cumulative to each other and to the remedies or penalties available under all other laws of the state.
8. Includes a severability clause.
9. Makes these provisions operative on January 1, 2026.
10. Amends the definition of “disturbing the peace of the other party” for purposes of securing a restraining order to include conduct committed through a connected device.

COMMENTS

1. Technology as a means of abusive control

Smart technology has revolutionized everything in our lives, from our phones, to our cars, and even our thermostats. However, while remote access to many of these connected devices provides unparalleled convenience, it also has increasingly been used a weapon by abusers to maintain control over their victims. One study of the use of device tracking states the scope of the issue:

Intimate partner violence, abuse, and harassment is routinely linked with efforts to monitor and control a targeted person. As new technologies have seeped into everyday life, aggressors have adopted and repurposed them to terrorize, control, and manipulate their current and former partners. When National Public Radio conducted a survey of 72 domestic violence shelters in the United States, they found that 85% of domestic violence workers assisted victims whose abuser tracked them using GPS. The US-based National Network to End Domestic Violence found that 71% of domestic abusers monitor survivors’ computer activities, while 54% tracked survivors’ cell phones with stalkerware. In Australia, the Domestic Violence Resources Centre Victoria conducted a survey in 2013 that found that 82% of victims reported abuse via smartphones and 74% of practitioners reported tracking via applications as often occurring amongst their client base. In Canada, a national survey of anti-violence support workers from 2012 found that 98% of perpetrators used technology to intimidate or threaten their victims, that 72% of perpetrators had hacked the email and social media accounts of the women and girls that they targeted, and that a further 61% had hacked into computers to monitor online activities and extract information. An additional 31% installed computer monitoring software or hardware on their target’s computer.^[1]

Given the explosion of connected devices in our homes, the problem has only gotten worse as even when survivors are able to physically escape domestic violence, the abuse continues:

Connected home devices have increasingly cropped up in domestic abuse cases over the past year, according to those working with victims of domestic violence. Those at help lines said more people were calling in the last 12 months about losing control of Wi-Fi-enabled doors, speakers, thermostats, lights and cameras. Lawyers also said they were wrangling with how to add language to restraining orders to cover smart home technology.

Muneerah Budhwani, who takes calls at the National Domestic Violence Hotline, said she started hearing stories about smart homes in abuse situations last winter. “Callers have said the abusers were monitoring and controlling them remotely through the smart home appliances and the smart home system,” she said.

Graciela Rodriguez, who runs a 30-bed emergency shelter at the Center for Domestic Peace in San Rafael, Calif., said some people had recently come in with tales of “the crazy-making things” like thermostats suddenly kicking up to 100 degrees or smart speakers turning on blasting music.

“They feel like they’re losing control of their home,” she said. “After they spend a few days here, they realize they were being abused.”

Smart home technology can be easily harnessed for misuse for several reasons. Tools like connected in-home security cameras are relatively inexpensive — some retail for $40 — and are straightforward to install. Usually, one person in a relationship takes charge of putting in the technology, knows how it works and has all the passwords. This gives that person the power to turn the technology against the other person.

. . .

Each said the use of internet-connected devices by their abusers was invasive — one called it a form of “jungle warfare” because it was hard to know where the attacks were coming from. They also described it as an asymmetry of power because their partners had control over the technology — and by extension, over them.

One of the women, a doctor in Silicon Valley, said her husband, an engineer, “controls the thermostat. He controls the lights. He controls the music.” She said, “Abusive relationships are about power and control, and he uses technology.”^[2]

The concern is that often the abuser is the named account holder and likely installed and has continued access to the device even after the survivor has escaped the situation or even secured a restraining order. Advocates argue updates to the applicable laws need to be updated:

Legal recourse may be limited. Abusers have learned to use smart home technology to further their power and control in ways that often fall outside existing criminal laws, Ms. Becker said. In some cases, she said, if an abuser circulates video taken by a connected indoor security camera, it could violate some states’ revenge porn laws, which aim to stop a former partner from sharing intimate photographs and videos online.

Advocates are beginning to educate emergency responders that when people get restraining orders, they need to ask the judge to include all smart home device accounts known and unknown to victims. Many people do not know to ask about this yet, Ms. Becker said. But even if people get restraining orders, remotely changing the temperature in a house or suddenly turning on the TV or lights may not contravene a no-contact order, she said.^[3]

1. Allowing survivors of violence to reclaim control

This bill seeks to provide a tool for survivors to reclaim control of their lives by regaining control of the connected devices in their homes and lives. This bill requires “account managers,” those that control user access to internet-based or app-based accounts in connection with connected devices, to deny access to such devices to an abuser within two business days of receiving a “device protection request.”

To initiate such requests, a victim must provide two pieces of documentation. The first is a verification that the abuser has committed or allegedly committed a “covered act” against the victim or an individual in the victim’s care. Covered acts include specified crimes, or equivalent offenses, including false imprisonment, human trafficking, or sexual crimes.^[4]

This verification can take the form of a signed affidavit from a specified provider, such as a licensed social worker, or a court employee, or a police report, or other court documentation, including charging documents, restraining orders, or other official records documenting the covered act.

Second, the victim must provide identification of the relevant connected device and a statement that the connected device is one of the following:

• Solely owned by the victim or an individual in the victim’s care.
• Legally under the sole possession or control of the victim or an individual in the victim’s care.
• A fixture or feature within a dwelling or motor vehicle that the abuser may not legally enter or use.

Once documentation is provided, the “account manager,” the person or entity that provides an individual an internet-based or app-based user account, or a third party that manages them, that has authority to make decisions regarding user access to those user accounts, must deny device access to an abuser within two business days of receiving the request.

No specific piece of documentation can be required and no limitations or additional requirements can condition granting the request. There is also no requirement that the conduct result in a criminal conviction.

The bill also amends the definition of “disturbing the peace of the other party” for purposes of being issued a restraining order to explicitly include conduct committed through connected devices.

According to the author:

SB 1000 requires companies to swiftly cut off access to shared accounts, applications, and devices, offering immediate protections for domestic violence victims when proper documentation is provided. This is a necessary measure that addresses the increasingly prevalent problem of digital abuse and control in domestic violence cases.

Domestic violence organizations continue to raise concerns about the increasing number of abuse cases related to internet-connected devices and shared accounts. Victims report escalating issues of virtual abuse, including loss of autonomy over everyday household items such as doors, speakers, thermostats, lights, cameras, and even vehicles. While modern technology offers convenience and connectivity, it has unfortunately become a tool for perpetrators to exert control over their victims remotely.

SB 1000 addresses the urgent need to stop this alarming new trend. This bill empowers victims and provides a crucial layer of protection. It ensures that California law evolves alongside technological advancements, empowering and safeguarding victims of domestic violence.

Account managers that knowingly violate the law can be subject to civil actions brought by those injured or the Attorney General or a district attorney. Courts can grant injunctive relief and civil penalties not to exceed $2,500 per device for knowing violations. Such relief can also be awarded against an abuser that maintain or exercises device access despite having their access denied pursuant to a device protection request.

Writing in support, Oakland Privacy states:

Modern technology has enabled perpetrators to facilitate abuse in a myriad of ways, from a distance and with little effort or cost. SB 1000 affords victims of domestic violence with legal protections to break from the grips of an abuser who utilizes connected devices (IoT devices) - an insidious exploitation of privacy - to harass, intimidate, monitor or control their victims, and endanger their physical safety.

SUPPORT

Alliance for Hope International

Oakland Privacy

OPPOSITION

None received

RELATED LEGISLATION

Pending Legislation: SB 1394 (Min, 2024) requires a vehicle manufacturer to terminate a person’s access to remote vehicle technology, as defined, upon a completed request from a driver who establishes proof of legal possession of the vehicle or a domestic violence restraining order naming the person whose access is sought to be terminated. SB 1394 prohibits a vehicle manufacturer from charging a fee to a driver for completing their request requires a vehicle manufacturer, among other things, to establish an efficient, secure, and user-friendly online submission process for requests related to terminating a person’s access to remote vehicle technology, as specified, and to ensure that all personal information provided during this process is handled with the utmost security and privacy, adhering to relevant data protection laws and regulations. A vehicle manufacturer is required to provide a notification inside of a vehicle that is installed with remote vehicle technology that shows if the remote vehicle technology is being used. SB 1394 is currently in this Committee.

Prior Legislation: SB 975 (Min, Ch. 989, Stats. 2022) created a non-judicial process for addressing a debt incurred in the name of a debtor through duress, intimidation, threat, force, or fraud of the debtor’s resources or personal information for personal gain. This bill also creates a cause of action through which a debtor can enjoin a creditor from holding the debtor personally liable for such “coerced debts” and a cause of action against the perpetrator in favor of the claimant.

**************

1. Christopher Parsons, et al., The Predator in Your Pocket: A Multidisciplinary Assessment of the Stalkerware Application Industry (June 12, 2019) Citizen Lab, https://citizenlab.ca/docs/stalkerware-holistic.pdf. All internet citations are current as of April 9, 2024. ↑

2. Nellie Bowles, Thermostats, Locks and Lights: Digital Tools of Domestic Abuse (June 23, 2018) The New York Times, https://www.nytimes.com/2018/06/23/technology/smart-home-devices-domestic-abuse.html. ↑

3. Ibid. ↑

4. The reference in this definition to Title 9 (commencing with Section 261) of Part 1 of the Penal Code is broader than was contemplated by the author. For clarity, the author has agreed to amendments to specify the offenses within that Title that will amount to a “covered act.” ↑