1     
CRIMINAL LAW AMENDMENTS

2     
2017 GENERAL SESSION

3     
STATE OF UTAH

4     
Chief Sponsor: Daniel W. Thatcher

5     
House Sponsor: Lee B. Perry

6     

7     LONG TITLE
8     General Description:
9          This bill amends criminal provisions relating to cybercrime and making a false report.
10     Highlighted Provisions:
11          This bill:
12          ▸     defines terms;
13          ▸     modifies the elements, penalties, and defenses for computer crime;
14          ▸     makes it a crime to interrupt or interfere with critical infrastructure;
15          ▸     amends and enacts reporting requirements relating to computer crime or the
16     interruption of, or interference with, critical infrastructure;
17          ▸     amends provisions relating to raising a false alarm or filing a false report;
18          ▸     amends the elements of electronic communication harrassment; and
19          ▸     makes technical and conforming changes.
20     Money Appropriated in this Bill:
21          None
22     Other Special Clauses:
23          None
24     Utah Code Sections Affected:
25     AMENDS:
26          76-6-702, as last amended by Laws of Utah 2005, Chapter 72
27          76-6-703, as last amended by Laws of Utah 2010, Chapter 193
28          76-6-705, as last amended by Laws of Utah 1993, Chapter 38
29          76-9-105, as last amended by Laws of Utah 2002, Chapter 166
30          76-9-201, as last amended by Laws of Utah 2009, Chapter 326
31          76-9-202, as last amended by Laws of Utah 2002, Chapter 166
32     

33     Be it enacted by the Legislature of the state of Utah:
34          Section 1. Section 76-6-702 is amended to read:
35          76-6-702. Definitions.
36          As used in this part:
37          (1) "Access" means to directly or indirectly use, attempt to use, instruct, communicate
38     with, cause input to, cause output from, or otherwise make use of any resources of a computer,
39     computer system, computer network, or any means of communication with any of them.
40          (2) "Authorization" means having the express or implied consent or permission of the
41     owner, or of the person authorized by the owner to give consent or permission to access a
42     computer, computer system, or computer network in a manner not exceeding the consent or
43     permission.
44          (3) "Computer" means any electronic device or communication facility that stores,
45     [retrieves,] processes, [or] transmits, or facilitates the transmission of data.
46          (4) "Computer system" means a set of related, connected or unconnected, devices,
47     software, or other related computer equipment.
48          (5) "Computer network" means:
49          (a) the interconnection of communication or telecommunication lines between:
50          (i) computers; or
51          (ii) computers and remote terminals; or
52          (b) the interconnection by wireless technology between:
53          (i) computers; or
54          (ii) computers and remote terminals.
55          (6) "Computer property" includes electronic impulses, electronically produced data,
56     information, financial instruments, software, or programs, in either machine or human readable
57     form, any other tangible or intangible item relating to a computer, computer system, computer
58     network, and copies of any of them.
59          (7) "Computer technology" includes:
60          (a) a computer;
61          (b) a computer network;
62          (c) computer hardware;
63          (d) a computer system;
64          (e) a computer program;
65          (f) computer services;
66          (g) computer software; or
67          (h) computer data.
68          [(7)] (8) "Confidential" means data, text, or computer property that is protected by a
69     security system that clearly evidences that the owner or custodian intends that it not be
70     available to others without the owner's or custodian's permission.
71          (9) "Critical infrastructure" includes:
72          (a) a communication or data system;
73          (b) a financial or banking system;
74          (c) any railroad, airline, airport, airway, highway, bridge, waterway, fixed guideway, or
75     other transportation system intended for the transportation of persons or property;
76          (d) any public utility service, including a power, energy, gas, or water supply system;
77          (e) a sewage or water treatment system;
78          (f) a health care facility, as that term is defined in Section 26-21-2;
79          (g) an emergency fire, medical, or law enforcement response system;
80          (h) a public health facility or system;
81          (i) a food distribution system;
82          (j) a government computer system or network;
83          (k) a school; or
84          (l) other government facilities, operations, or services.
85          (10) "Denial of service attack" means an attack or intrusion that is intended to disrupt
86     legitimate access to, or use of, a network resource, a machine, or computer technology.
87          [(12)] (11) "Financial instrument" includes any check, draft, money order, certificate of
88     deposit, letter of credit, bill of exchange, electronic fund transfer, automated clearing house
89     transaction, credit card, or marketable security.
90          [(8)] (12) "Information" does not include information obtained:
91          (a) through use of:
92          (i) an electronic product identification or tracking system; or
93          (ii) other technology used by a retailer to identify, track, or price goods; and
94          (b) by a retailer through the use of equipment designed to read the electronic product
95     identification or tracking system data located within the retailer's location.
96          [(9)] (13) "License or entitlement" includes:
97          (a) licenses, certificates, and permits granted by governments;
98          (b) degrees, diplomas, and grades awarded by educational institutions;
99          (c) military ranks, grades, decorations, and awards;
100          (d) membership and standing in organizations and religious institutions;
101          (e) certification as a peace officer;
102          (f) credit reports; and
103          (g) another record or datum upon which a person may be reasonably expected to rely in
104     making decisions that will have a direct benefit or detriment to another.
105          [(10)] (14) "Security system" means a computer, computer system, network, or
106     computer property that has some form of access control technology implemented, such as
107     encryption, password protection, other forced authentication, or access control designed to keep
108     out unauthorized persons.
109          [(11)] (15) "Services" include computer time, data manipulation, and storage functions.
110          [(13)] (16) "Software" or "program" means a series of instructions or statements in a
111     form acceptable to a computer, relating to the operations of the computer, or permitting the
112     functioning of a computer system in a manner designed to provide results including system
113     control programs, application programs, or copies of any of them.
114          Section 2. Section 76-6-703 is amended to read:
115          76-6-703. Computer crimes and penalties -- Interfering with critical
116     infrastructure.
117          [(1) A person who without authorization gains or attempts to gain access to and alters,
118     damages, destroys, discloses, or modifies any computer, computer network, computer property,
119     computer system, computer program, computer data or software, and thereby causes damage to
120     another, or obtains money, property, information, or a benefit for any person without legal
121     right, is guilty of:]
122          (1) It is unlawful for a person to:
123          (a) without authorization, or in excess of the person's authorization, access or attempt
124     to access computer technology if the access or attempt to access results in:
125          (i) the alteration, damage, destruction, copying, transmission, discovery, or disclosure
126     of computer technology;
127          (ii) interference with or interruption of:
128          (A) the lawful use of computer technology; or
129          (B) the transmission of data;
130          (iii) physical damage to or loss of real, personal, or commercial property;
131          (iv) audio, video, or other surveillance of another person; or
132          (v) economic loss to any person or entity;
133          (b) after accessing computer technology that the person is authorized to access,
134     knowingly take or attempt to take unauthorized or unlawful action that results in:
135          (i) the alteration, damage, destruction, copying, transmission, discovery, or disclosure
136     of computer technology;
137          (ii) interference with or interruption of:
138          (A) the lawful use of computer technology; or
139          (B) the transmission of data;
140          (iii) physical damage to or loss of real, personal, or commercial property;
141          (iv) audio, video, or other surveillance of another person; or
142          (v) economic loss to any person or entity; or
143          (c) knowingly engage in a denial of service attack.
144          (2) A person who violates Subsection (1) is guilty of:
145          (a) a class B misdemeanor when:
146          (i) the economic loss or other loss or damage caused or the value of the money,
147     property, or benefit obtained or sought to be obtained is less than $500; or
148          (ii) the information obtained is not confidential;
149          (b) a class A misdemeanor when the economic loss or other loss or damage caused or
150     the value of the money, property, or benefit obtained or sought to be obtained is or exceeds
151     $500 but is less than $1,500;
152          (c) a third degree felony when the economic loss or other loss or damage caused or the
153     value of the money, property, or benefit obtained or sought to be obtained is or exceeds $1,500
154     but is less than $5,000;
155          (d) a second degree felony when the economic loss or other loss or damage caused or
156     the value of the money, property, or benefit obtained or sought to be obtained is or exceeds
157     $5,000; or
158          (e) a third degree felony when:
159          (i) the property or benefit obtained or sought to be obtained is a license or entitlement;
160          (ii) the damage is to the license or entitlement of another person; [or]
161          (iii) the information obtained is confidential; or
162          (iv) in gaining access the person breaches or breaks through a security system.
163          [(2)] (3) (a) [Except as provided in Subsection (2)(b), a] A person who intentionally or
164     knowingly and without authorization gains or attempts to gain access to a computer, computer
165     network, computer property, or computer system under circumstances not otherwise
166     constituting an offense under this section is guilty of a class B misdemeanor.
167          (b) Notwithstanding Subsection [(2)] (3)(a), a retailer that uses an electronic product
168     identification or tracking system, or other technology, to identify, track, or price goods is not
169     guilty of a violation of Subsection [(2)] (3)(a) if the equipment designed to read the electronic
170     product identification or tracking system data and used by the retailer to identify, track, or price
171     goods is located within the retailer's location.
172          [(3)] (4) A person who uses or knowingly allows another person to use any computer,
173     computer network, computer property, or computer system, program, or software to devise or
174     execute any artifice or scheme to defraud or to obtain money, property, services, or other things
175     of value by false pretenses, promises, or representations, is guilty of an offense based on the
176     value of the money, property, services, or things of value, in the degree set forth in Subsection
177     76-10-1801(1).
178          [(4) A person who intentionally or knowingly and without authorization, interferes
179     with or interrupts computer services to another authorized to receive the services is guilty of a
180     class A misdemeanor.]
181          (5) A person is guilty of a third degree felony if the person intentionally or knowingly,
182     and without lawful authorization, interferes with or interrupts critical infrastructure.
183          [(5)] (6) It is an affirmative defense to [Subsections] Subsection (1) [and], (2), or (3)
184     that a person obtained access or attempted to obtain access:
185          (a) in response to, and for the purpose of protecting against or investigating, a prior
186     attempted or successful breach of security of [a computer, computer network, computer
187     property, computer system] computer technology whose security the person is authorized or
188     entitled to protect, and the access attempted or obtained was no greater than reasonably
189     necessary for that purpose[.]; or
190          (b) pursuant to a search warrant or a lawful exception to the requirement to obtain a
191     search warrant.
192          Section 3. Section 76-6-705 is amended to read:
193          76-6-705. Reporting violations.
194          [Every person, except those to whom a statutory or common law privilege applies,]
195          (1) Each person who has reason to believe that the provisions of Section 76-6-703 are
196     being or have been violated shall report the suspected violation to:
197          (a) the attorney general, or county attorney, or, if within a prosecution district, the
198     district attorney of the county or prosecution district in which part or all of the violations
199     occurred[.]; or
200          (b) a state or local law enforcement agency.
201          (2) Subsection (1) does not apply to the extent that the person is prohibited from
202     reporting by a statutory or common law privilege.
203          Section 4. Section 76-9-105 is amended to read:
204          76-9-105. Making a false alarm -- Penalties.
205          (1) A person is guilty of making a false alarm if he initiates or circulates a report or
206     warning of any fire, impending bombing, or other crime or catastrophe, knowing that the report
207     or warning is false or baseless and is likely to cause evacuation of any building, place of
208     assembly, or facility of public transport, to cause public inconvenience or alarm or action of
209     any sort by any official or volunteer agency organized to deal with emergencies.
210          (2) (a) [Making] A person is guilty of a second degree felony if the person makes a
211     false alarm relating to a weapon of mass destruction as defined in Section 76-10-401 [is a
212     second degree felony].
213          (b) A person is guilty of a third degree felony if:
214          (i) the person makes a false alarm alleging on ongoing act or event, or an imminent
215     threat; and
216          (ii) the false alarm causes or threatens to cause bodily harm, serious bodily injury, or
217     death to another person.
218          [(b)] (c) Making a false alarm other than under Subsection (2)(a) or (b) is a class B
219     misdemeanor.
220          (3) In addition to any other penalty authorized by law, a court shall order any person
221     convicted of a felony violation of this section to reimburse any federal, state, or local unit of
222     government, or any private business, organization, individual, or entity for all expenses and
223     losses incurred in responding to the violation, unless the court states on the record the reasons
224     why the court finds the reimbursement would be inappropriate.
225          Section 5. Section 76-9-201 is amended to read:
226          76-9-201. Electronic communication harassment -- Definitions -- Penalties.
227          (1) As used in this section:
228          (a) "Adult" means a person 18 years of age or older.
229          (b) "Electronic communication" means any communication by electronic,
230     electro-mechanical, or electro-optical communication device for the transmission and reception
231     of audio, image, or text but does not include broadcast transmissions or similar
232     communications that are not targeted at any specific individual.
233          (c) "Electronic communication device" includes a telephone, a facsimile machine,
234     electronic mail, [or] a pager, a computer, or any other device or medium that can be used to
235     communicate electronically.
236          (d) "Minor" means a person who is younger than 18 years of age.
237          (e) "Personal identifying information" means the same as that term is defined in
238     Section 76-6-1102.
239          (2) A person is guilty of electronic communication harassment and subject to
240     prosecution in the jurisdiction where the communication originated or was received if with
241     intent to [annoy, alarm,] intimidate, [offend,] abuse, threaten, harass, frighten, or disrupt the
242     electronic communications of another, the person:
243          (a) (i) makes repeated contact by means of electronic communications, regardless of
244     whether [or not] a conversation ensues; or
245          (ii) after the recipient has requested or informed the person not to contact the recipient,
246     and the person repeatedly or continuously:
247          (A) contacts the electronic communication device of the recipient; or
248          (B) causes an electronic communication device of the recipient to ring or to receive
249     other notification of attempted contact by means of electronic communication;
250          (b) makes contact by means of electronic communication and insults, taunts, or
251     challenges the recipient of the communication or any person at the receiving location in a
252     manner likely to provoke a violent or disorderly response;
253          (c) makes contact by means of electronic communication and threatens to inflict injury,
254     physical harm, or damage to any person or the property of any person; [or]
255          (d) causes disruption, jamming, or overload of an electronic communication system
256     through excessive message traffic or other means utilizing an electronic communication
257     device[.]; or
258          (e) electronically publishes, posts, or otherwise discloses personal identifying
259     information of another person, in a public online site or forum, without that person's
260     permission.
261          (3) (a) (i) Electronic communication harassment committed against an adult is a class
262     B misdemeanor, except under Subsection (3)(a)(ii).
263          (ii) A second or subsequent offense under Subsection (3)(a)(i) is a:
264          (A) class A misdemeanor if all prior violations of this section were committed against
265     adults; and
266          (B) a third degree felony if any prior violation of this section was committed against a
267     minor.
268          (b) (i) Electronic communication harassment committed against a minor is a class A
269     misdemeanor, except under Subsection (3)(b)(ii).
270          (ii) A second or subsequent offense under Subsection (3)(b)(i) is a third degree felony,
271     regardless of whether any prior violation of this section was committed against a minor or an
272     adult.
273          (4) (a) Except under Subsection (4)(b), criminal prosecution under this section does not
274     affect an individual's right to bring a civil action for damages suffered as a result of the
275     commission of any of the offenses under this section.
276          (b) This section does not create any civil cause of action based on electronic
277     communications made for legitimate business purposes.
278          Section 6. Section 76-9-202 is amended to read:
279          76-9-202. Emergency reporting -- Interference -- False report.
280          (1) As used in this section:
281          (a) "Emergency" means a situation in which property or human life is in jeopardy and
282     the prompt summoning of aid is essential to the preservation of human life or property.
283          (b) "Party line" means a subscriber's line or telephone circuit [consisting]:
284          (i) that consists of two or more connected main telephone stations [connected
285     therewith, each station with]; and
286          (ii) where each telephone station has a distinctive ring or telephone number.
287          (2) A person is guilty of emergency reporting abuse if [he] the person:
288          (a) intentionally refuses to yield or surrender the use of a party line or a public pay
289     telephone to another person upon being informed that the telephone is needed to report a fire or
290     summon police, medical, or other aid in case of emergency, unless the telephone is likewise
291     being used for an emergency call;
292          (b) asks for or requests the use of a party line or a public pay telephone on the pretext
293     that an emergency exists, knowing that no emergency exists; [or]
294          (c) reports an emergency or causes an emergency to be reported to any public, private,
295     or volunteer entity whose purpose is to respond to fire, police, or medical emergencies, when
296     the [actor] person knows the reported emergency does not exist[.]; or
297          (d) makes a false report, or intentionally aids, abets, or causes a third party to make a
298     false report, to an emergency response service, including a law enforcement dispatcher or a 911
299     emergency response service, if the false report claims that:
300          (i) an ongoing emergency exists;
301          (ii) the emergency described in Subsection (2)(d)(i) currently involves, or involves an
302     imminent threat of, serious bodily injury, serious physical injury, or death; and
303          (iii) the emergency described in Subsection (2)(d)(i) is occurring at a specified
304     location.
305          (3) (a) A violation of Subsection (2)(a) or (b) is a class C misdemeanor.
306          (b) A violation of Subsection (2)(c) is a class B misdemeanor, except as provided
307     under Subsection (3)(c).
308          (c) A violation of Subsection (2)(c) is a second degree felony if the report is regarding a
309     weapon of mass destruction, as defined in Section 76-10-401.
310          (d) A violation of Subsection (2)(d):
311          (i) except as provided in Subsection (3)(d)(ii), is a third degree felony; or
312          (ii) is a second degree felony if, while acting in response to the report, the emergency
313     responders cause physical injury to a person at the location described in Subsection (2)(d)(iii).
314          (4) (a) In addition to any other penalty authorized by law, a court shall order any person
315     convicted of a violation of this section to reimburse:
316          (i) any federal, state, or local unit of government, or any private business, organization,
317     individual, or entity for all expenses and losses incurred in responding to the violation[,
318     unless]; and
319          (ii) any person described in Subsection (3)(d)(ii) for the costs for the treatment of the
320     physical injury and any psychological injury caused by the offense.
321          (b) The court may order that the defendant pay less than the full amount of the costs
322     described in Subsection (4)(a) only if the court states on the record the reasons why the
323     reimbursement would be inappropriate.




Legislative Review Note
Office of Legislative Research and General Counsel