7 LONG TITLE
8 General Description:
9 This bill amends criminal provisions relating to cybercrime and making a false report.
10 Highlighted Provisions:
11 This bill:
12 ▸ defines terms;
13 ▸ modifies the elements, penalties, and defenses for computer crime;
14 ▸ makes it a crime to interrupt or interfere with critical infrastructure;
15 ▸ amends and enacts reporting requirements relating to computer crime or the
16 interruption of, or interference with, critical infrastructure;
17 ▸ amends provisions relating to raising a false alarm or filing a false report;
18 ▸ amends the elements of electronic communication harrassment; and
19 ▸ makes technical and conforming changes.
20 Money Appropriated in this Bill:
22 Other Special Clauses:
24 Utah Code Sections Affected:
26 76-6-702, as last amended by Laws of Utah 2005, Chapter 72
27 76-6-703, as last amended by Laws of Utah 2010, Chapter 193
28 76-6-705, as last amended by Laws of Utah 1993, Chapter 38
29 76-9-105, as last amended by Laws of Utah 2002, Chapter 166
30 76-9-201, as last amended by Laws of Utah 2009, Chapter 326
31 76-9-202, as last amended by Laws of Utah 2002, Chapter 166
33 Be it enacted by the Legislature of the state of Utah:
34 Section 1. Section 76-6-702 is amended to read:
35 76-6-702. Definitions.
36 As used in this part:
37 (1) "Access" means to directly or indirectly use, attempt to use, instruct, communicate
38 with, cause input to, cause output from, or otherwise make use of any resources of a computer,
39 computer system, computer network, or any means of communication with any of them.
40 (2) "Authorization" means having the express or implied consent or permission of the
41 owner, or of the person authorized by the owner to give consent or permission to access a
42 computer, computer system, or computer network in a manner not exceeding the consent or
44 (3) "Computer" means any electronic device or communication facility that stores,
46 (4) "Computer system" means a set of related, connected or unconnected, devices,
47 software, or other related computer equipment.
48 (5) "Computer network" means:
49 (a) the interconnection of communication or telecommunication lines between:
50 (i) computers; or
51 (ii) computers and remote terminals; or
52 (b) the interconnection by wireless technology between:
53 (i) computers; or
54 (ii) computers and remote terminals.
55 (6) "Computer property" includes electronic impulses, electronically produced data,
56 information, financial instruments, software, or programs, in either machine or human readable
57 form, any other tangible or intangible item relating to a computer, computer system, computer
58 network, and copies of any of them.
59 (7) "Computer technology" includes:
60 (a) a computer;
61 (b) a computer network;
62 (c) computer hardware;
63 (d) a computer system;
64 (e) a computer program;
65 (f) computer services;
66 (g) computer software; or
67 (h) computer data.
69 security system that clearly evidences that the owner or custodian intends that it not be
70 available to others without the owner's or custodian's permission.
71 (9) "Critical infrastructure" includes:
72 (a) a financial or banking system;
73 (b) any railroad, airline, airport, airway, highway, bridge, waterway, fixed guideway, or
74 other transportation system intended for the transportation of persons or property;
75 (c) any public utility service, including a power, energy, gas, or water supply system;
76 (d) a sewage or water treatment system;
77 (e) a health care facility, as that term is defined in Section 26-21-2;
78 (f) an emergency fire, medical, or law enforcement response system;
79 (g) a public health facility or system;
80 (h) a food distribution system;
81 (i) a government computer system or network;
82 (j) a school; or
83 (k) other government facilities, operations, or services.
84 (10) "Denial of service attack" means an attack or intrusion that is intended to disrupt
85 legitimate access to, or use of, a network resource, a machine, or computer technology.
87 deposit, letter of credit, bill of exchange, electronic fund transfer, automated clearing house
88 transaction, credit card, or marketable security.
90 (a) through use of:
91 (i) an electronic product identification or tracking system; or
92 (ii) other technology used by a retailer to identify, track, or price goods; and
93 (b) by a retailer through the use of equipment designed to read the electronic product
94 identification or tracking system data located within the retailer's location.
95 (13) "Interactive computer service" means an information service, system, or access
96 software provider that provides or enables computer access by multiple users to a computer
97 server, including a service or system that provides access to the Internet or a system operated,
98 or services offered, by a library or an educational institution.
100 (a) licenses, certificates, and permits granted by governments;
101 (b) degrees, diplomas, and grades awarded by educational institutions;
102 (c) military ranks, grades, decorations, and awards;
103 (d) membership and standing in organizations and religious institutions;
104 (e) certification as a peace officer;
105 (f) credit reports; and
106 (g) another record or datum upon which a person may be reasonably expected to rely in
107 making decisions that will have a direct benefit or detriment to another.
109 computer property that has some form of access control technology implemented, such as
110 encryption, password protection, other forced authentication, or access control designed to keep
111 out unauthorized persons.
113 (17) "Service provider" means a telecommunications carrier, cable operator, computer
114 hardware or software provider, or a provider of information service or interactive computer
117 form acceptable to a computer, relating to the operations of the computer, or permitting the
118 functioning of a computer system in a manner designed to provide results including system
119 control programs, application programs, or copies of any of them.
120 Section 2. Section 76-6-703 is amended to read:
121 76-6-703. Computer crimes and penalties -- Interfering with critical
128 (1) It is unlawful for a person to:
129 (a) without authorization, or in excess of the person's authorization, access or attempt
130 to access computer technology if the access or attempt to access results in:
131 (i) the alteration, damage, destruction, copying, transmission, discovery, or disclosure
132 of computer technology;
133 (ii) interference with or interruption of:
134 (A) the lawful use of computer technology; or
135 (B) the transmission of data;
136 (iii) physical damage to or loss of real, personal, or commercial property;
137 (iv) audio, video, or other surveillance of another person; or
138 (v) economic loss to any person or entity;
139 (b) after accessing computer technology that the person is authorized to access,
140 knowingly take or attempt to take unauthorized or unlawful action that results in:
141 (i) the alteration, damage, destruction, copying, transmission, discovery, or disclosure
142 of computer technology;
143 (ii) interference with or interruption of:
144 (A) the lawful use of computer technology; or
145 (B) the transmission of data;
146 (iii) physical damage to or loss of real, personal, or commercial property;
147 (iv) audio, video, or other surveillance of another person; or
148 (v) economic loss to any person or entity; or
149 (c) knowingly engage in a denial of service attack.
150 (2) A person who violates Subsection (1) is guilty of:
151 (a) a class B misdemeanor when:
152 (i) the economic loss or other loss or damage caused or the value of the money,
153 property, or benefit obtained or sought to be obtained is less than $500; or
154 (ii) the information obtained is not confidential;
155 (b) a class A misdemeanor when the economic loss or other loss or damage caused or
156 the value of the money, property, or benefit obtained or sought to be obtained is or exceeds
157 $500 but is less than $1,500;
158 (c) a third degree felony when the economic loss or other loss or damage caused or the
159 value of the money, property, or benefit obtained or sought to be obtained is or exceeds $1,500
160 but is less than $5,000;
161 (d) a second degree felony when the economic loss or other loss or damage caused or
162 the value of the money, property, or benefit obtained or sought to be obtained is or exceeds
163 $5,000; or
164 (e) a third degree felony when:
165 (i) the property or benefit obtained or sought to be obtained is a license or entitlement;
166 (ii) the damage is to the license or entitlement of another person; [
167 (iii) the information obtained is confidential; or
168 (iv) in gaining access the person breaches or breaks through a security system.
170 knowingly and without authorization gains or attempts to gain access to a computer, computer
171 network, computer property, or computer system under circumstances not otherwise
172 constituting an offense under this section is guilty of a class B misdemeanor.
173 (b) Notwithstanding Subsection [
174 identification or tracking system, or other technology, to identify, track, or price goods is not
175 guilty of a violation of Subsection [
176 product identification or tracking system data and used by the retailer to identify, track, or price
177 goods is located within the retailer's location.
179 computer network, computer property, or computer system, program, or software to devise or
180 execute any artifice or scheme to defraud or to obtain money, property, services, or other things
181 of value by false pretenses, promises, or representations, is guilty of an offense based on the
182 value of the money, property, services, or things of value, in the degree set forth in Subsection
187 (5) A person is guilty of a third degree felony if the person intentionally or knowingly,
188 and without lawful authorization, interferes with or interrupts critical infrastructure.
190 that a person obtained access or attempted to obtain access:
191 (a) in response to, and for the purpose of protecting against or investigating, a prior
192 attempted or successful breach of security of [
194 entitled to protect, and the access attempted or obtained was no greater than reasonably
195 necessary for that purpose[
196 (b) pursuant to a search warrant or a lawful exception to the requirement to obtain a
197 search warrant.
198 (7) (a) An interactive computer service is not guilty of violating this section if aperson
199 violates this section using the interactive computer service and the interactive computer service
200 did not knowingly assist the person to commit the violation.
201 (b) A service provider is not guilty of violating this section for:
202 (i) action taken in relation to a customer of the service provider, for a legitimate
203 business purpose, to install software on, monitor, or interact with the customer's Internet or
204 other network connection, service, or computer for network or computer security purposes,
205 authentication, diagnostics, technical support, maintenance, repair, network management,
206 updates of computer software or system firmware, or remote system management; or
207 (ii) action taken, including scanning and removing computer software, to detect or
208 prevent the following:
209 (A) unauthorized or fraudulent use of a network, service, or computer software;
210 (B) illegal activity; or
211 (C) infringement of intellectual property rights.
212 Section 3. Section 76-6-705 is amended to read:
213 76-6-705. Reporting violations.
215 (1) Each person who has reason to believe that the provisions of Section 76-6-703 are
216 being or have been violated shall report the suspected violation to:
217 (a) the attorney general, or county attorney, or, if within a prosecution district, the
218 district attorney of the county or prosecution district in which part or all of the violations
220 (b) a state or local law enforcement agency.
221 (2) Subsection (1) does not apply to the extent that the person is prohibited from
222 reporting by a statutory or common law privilege.
223 Section 4. Section 76-9-105 is amended to read:
224 76-9-105. Making a false alarm -- Penalties.
225 (1) A person is guilty of making a false alarm if he initiates or circulates a report or
226 warning of any fire, impending bombing, or other crime or catastrophe, knowing that the report
227 or warning is false or baseless and is likely to cause evacuation of any building, place of
228 assembly, or facility of public transport, to cause public inconvenience or alarm or action of
229 any sort by any official or volunteer agency organized to deal with emergencies.
230 (2) (a) [
231 false alarm relating to a weapon of mass destruction as defined in Section 76-10-401 [
233 (b) A person is guilty of a third degree felony if:
234 (i) the person makes a false alarm alleging on ongoing act or event, or an imminent
235 threat; and
236 (ii) the false alarm causes or threatens to cause bodily harm, serious bodily injury, or
237 death to another person.
240 (3) In addition to any other penalty authorized by law, a court shall order any person
241 convicted of a felony violation of this section to reimburse any federal, state, or local unit of
242 government, or any private business, organization, individual, or entity for all expenses and
243 losses incurred in responding to the violation, unless the court states on the record the reasons
244 why the court finds the reimbursement would be inappropriate.
245 Section 5. Section 76-9-201 is amended to read:
246 76-9-201. Electronic communication harassment -- Definitions -- Penalties.
247 (1) As used in this section:
248 (a) "Adult" means a person 18 years of age or older.
249 (b) "Electronic communication" means any communication by electronic,
250 electro-mechanical, or electro-optical communication device for the transmission and reception
251 of audio, image, or text but does not include broadcast transmissions or similar
252 communications that are not targeted at any specific individual.
253 (c) "Electronic communication device" includes a telephone, a facsimile machine,
254 electronic mail, [
255 communicate electronically.
256 (d) "Minor" means a person who is younger than 18 years of age.
257 (e) "Personal identifying information" means the same as that term is defined in
258 Section 76-6-1102.
259 (2) A person is guilty of electronic communication harassment and subject to
260 prosecution in the jurisdiction where the communication originated or was received if with
261 intent to [
262 electronic communications of another, the person:
263 (a) (i) makes repeated contact by means of electronic communications, regardless of
264 whether [
265 (ii) after the recipient has requested or informed the person not to contact the recipient,
266 and the person repeatedly or continuously:
267 (A) contacts the electronic communication device of the recipient; or
268 (B) causes an electronic communication device of the recipient to ring or to receive
269 other notification of attempted contact by means of electronic communication;
270 (b) makes contact by means of electronic communication and insults, taunts, or
271 challenges the recipient of the communication or any person at the receiving location in a
272 manner likely to provoke a violent or disorderly response;
273 (c) makes contact by means of electronic communication and threatens to inflict injury,
274 physical harm, or damage to any person or the property of any person; [
275 (d) causes disruption, jamming, or overload of an electronic communication system
276 through excessive message traffic or other means utilizing an electronic communication
278 (e) electronically publishes, posts, or otherwise discloses personal identifying
279 information of another person, in a public online site or forum, without that person's
281 (3) (a) (i) Electronic communication harassment committed against an adult is a class
282 B misdemeanor, except under Subsection (3)(a)(ii).
283 (ii) A second or subsequent offense under Subsection (3)(a)(i) is a:
284 (A) class A misdemeanor if all prior violations of this section were committed against
285 adults; and
286 (B) a third degree felony if any prior violation of this section was committed against a
288 (b) (i) Electronic communication harassment committed against a minor is a class A
289 misdemeanor, except under Subsection (3)(b)(ii).
290 (ii) A second or subsequent offense under Subsection (3)(b)(i) is a third degree felony,
291 regardless of whether any prior violation of this section was committed against a minor or an
293 (4) (a) Except under Subsection (4)(b), criminal prosecution under this section does not
294 affect an individual's right to bring a civil action for damages suffered as a result of the
295 commission of any of the offenses under this section.
296 (b) This section does not create any civil cause of action based on electronic
297 communications made for legitimate business purposes.
298 Section 6. Section 76-9-202 is amended to read:
299 76-9-202. Emergency reporting -- Interference -- False report.
300 (1) As used in this section:
301 (a) "Emergency" means a situation in which property or human life is in jeopardy and
302 the prompt summoning of aid is essential to the preservation of human life or property.
303 (b) "Party line" means a subscriber's line or telephone circuit [
304 (i) that consists of two or more connected main telephone stations [
306 (ii) where each telephone station has a distinctive ring or telephone number.
307 (2) A person is guilty of emergency reporting abuse if [
308 (a) intentionally refuses to yield or surrender the use of a party line or a public pay
309 telephone to another person upon being informed that the telephone is needed to report a fire or
310 summon police, medical, or other aid in case of emergency, unless the telephone is likewise
311 being used for an emergency call;
312 (b) asks for or requests the use of a party line or a public pay telephone on the pretext
313 that an emergency exists, knowing that no emergency exists; [
314 (c) reports an emergency or causes an emergency to be reported to any public, private,
315 or volunteer entity whose purpose is to respond to fire, police, or medical emergencies, when
316 the [
317 (d) makes a false report, or intentionally aids, abets, or causes a third party to make a
318 false report, to an emergency response service, including a law enforcement dispatcher or a 911
319 emergency response service, if the false report claims that:
320 (i) an ongoing emergency exists;
321 (ii) the emergency described in Subsection (2)(d)(i) currently involves, or involves an
322 imminent threat of, serious bodily injury, serious physical injury, or death; and
323 (iii) the emergency described in Subsection (2)(d)(i) is occurring at a specified
325 (3) (a) A violation of Subsection (2)(a) or (b) is a class C misdemeanor.
326 (b) A violation of Subsection (2)(c) is a class B misdemeanor, except as provided
327 under Subsection (3)(c).
328 (c) A violation of Subsection (2)(c) is a second degree felony if the report is regarding a
329 weapon of mass destruction, as defined in Section 76-10-401.
330 (d) A violation of Subsection (2)(d):
331 (i) except as provided in Subsection (3)(d)(ii), is a third degree felony; or
332 (ii) is a second degree felony if, while acting in response to the report, the emergency
333 responders cause physical injury to a person at the location described in Subsection (2)(d)(iii).
334 (4) (a) In addition to any other penalty authorized by law, a court shall order any person
335 convicted of a violation of this section to reimburse:
336 (i) any federal, state, or local unit of government, or any private business, organization,
337 individual, or entity for all expenses and losses incurred in responding to the violation[
339 (ii) any person described in Subsection (3)(d)(ii) for the costs for the treatment of the
340 physical injury and any psychological injury caused by the offense.
341 (b) The court may order that the defendant pay less than the full amount of the costs
342 described in Subsection (4)(a) only if the court states on the record the reasons why the
343 reimbursement would be inappropriate.