Representative Lee B. Perry proposes the following substitute bill:


1     
CRIMINAL LAW AMENDMENTS

2     
2017 GENERAL SESSION

3     
STATE OF UTAH

4     
Chief Sponsor: Daniel W. Thatcher

5     
House Sponsor: Lee B. Perry

6     

7     LONG TITLE
8     General Description:
9          This bill amends criminal provisions relating to cybercrime and making a false report.
10     Highlighted Provisions:
11          This bill:
12          ▸     defines terms;
13          ▸     modifies the elements, penalties, and defenses for computer crime;
14          ▸     makes it a crime to interrupt or interfere with critical infrastructure;
15          ▸     amends and enacts reporting requirements relating to computer crime or the
16     interruption of, or interference with, critical infrastructure;
17          ▸     amends provisions relating to raising a false alarm or filing a false report;
18          ▸     amends the elements of electronic communication harrassment; and
19          ▸     makes technical and conforming changes.
20     Money Appropriated in this Bill:
21          None
22     Other Special Clauses:
23          None
24     Utah Code Sections Affected:
25     AMENDS:
26          76-6-702, as last amended by Laws of Utah 2005, Chapter 72
27          76-6-703, as last amended by Laws of Utah 2010, Chapter 193
28          76-6-705, as last amended by Laws of Utah 1993, Chapter 38
29          76-9-105, as last amended by Laws of Utah 2002, Chapter 166
30          76-9-201, as last amended by Laws of Utah 2009, Chapter 326
31          76-9-202, as last amended by Laws of Utah 2002, Chapter 166
32     

33     Be it enacted by the Legislature of the state of Utah:
34          Section 1. Section 76-6-702 is amended to read:
35          76-6-702. Definitions.
36          As used in this part:
37          (1) "Access" means to directly or indirectly use, attempt to use, instruct, communicate
38     with, cause input to, cause output from, or otherwise make use of any resources of a computer,
39     computer system, computer network, or any means of communication with any of them.
40          (2) "Authorization" means having the express or implied consent or permission of the
41     owner, or of the person authorized by the owner to give consent or permission to access a
42     computer, computer system, or computer network in a manner not exceeding the consent or
43     permission.
44          (3) "Computer" means any electronic device or communication facility that stores,
45     [retrieves,] processes, [or] transmits, or facilitates the transmission of data.
46          (4) "Computer system" means a set of related, connected or unconnected, devices,
47     software, or other related computer equipment.
48          (5) "Computer network" means:
49          (a) the interconnection of communication or telecommunication lines between:
50          (i) computers; or
51          (ii) computers and remote terminals; or
52          (b) the interconnection by wireless technology between:
53          (i) computers; or
54          (ii) computers and remote terminals.
55          (6) "Computer property" includes electronic impulses, electronically produced data,
56     information, financial instruments, software, or programs, in either machine or human readable
57     form, any other tangible or intangible item relating to a computer, computer system, computer
58     network, and copies of any of them.
59          (7) "Computer technology" includes:
60          (a) a computer;
61          (b) a computer network;
62          (c) computer hardware;
63          (d) a computer system;
64          (e) a computer program;
65          (f) computer services;
66          (g) computer software; or
67          (h) computer data.
68          [(7)] (8) "Confidential" means data, text, or computer property that is protected by a
69     security system that clearly evidences that the owner or custodian intends that it not be
70     available to others without the owner's or custodian's permission.
71          (9) "Critical infrastructure" includes:
72          (a) a financial or banking system;
73          (b) any railroad, airline, airport, airway, highway, bridge, waterway, fixed guideway, or
74     other transportation system intended for the transportation of persons or property;
75          (c) any public utility service, including a power, energy, gas, or water supply system;
76          (d) a sewage or water treatment system;
77          (e) a health care facility, as that term is defined in Section 26-21-2;
78          (f) an emergency fire, medical, or law enforcement response system;
79          (g) a public health facility or system;
80          (h) a food distribution system;
81          (i) a government computer system or network;
82          (j) a school; or
83          (k) other government facilities, operations, or services.
84          (10) "Denial of service attack" means an attack or intrusion that is intended to disrupt
85     legitimate access to, or use of, a network resource, a machine, or computer technology.
86          [(12)] (11) "Financial instrument" includes any check, draft, money order, certificate of
87     deposit, letter of credit, bill of exchange, electronic fund transfer, automated clearing house
88     transaction, credit card, or marketable security.
89          [(8)] (12) "Information" does not include information obtained:
90          (a) through use of:
91          (i) an electronic product identification or tracking system; or
92          (ii) other technology used by a retailer to identify, track, or price goods; and
93          (b) by a retailer through the use of equipment designed to read the electronic product
94     identification or tracking system data located within the retailer's location.
95          (13) "Interactive computer service" means an information service, system, or access
96     software provider that provides or enables computer access by multiple users to a computer
97     server, including a service or system that provides access to the Internet or a system operated,
98     or services offered, by a library or an educational institution.
99          [(9)] (14) "License or entitlement" includes:
100          (a) licenses, certificates, and permits granted by governments;
101          (b) degrees, diplomas, and grades awarded by educational institutions;
102          (c) military ranks, grades, decorations, and awards;
103          (d) membership and standing in organizations and religious institutions;
104          (e) certification as a peace officer;
105          (f) credit reports; and
106          (g) another record or datum upon which a person may be reasonably expected to rely in
107     making decisions that will have a direct benefit or detriment to another.
108          [(10)] (15) "Security system" means a computer, computer system, network, or
109     computer property that has some form of access control technology implemented, such as
110     encryption, password protection, other forced authentication, or access control designed to keep
111     out unauthorized persons.
112          [(11)] (16) "Services" include computer time, data manipulation, and storage functions.
113          (17) "Service provider" means a telecommunications carrier, cable operator, computer
114     hardware or software provider, or a provider of information service or interactive computer
115     service.
116          [(13)] (18) "Software" or "program" means a series of instructions or statements in a
117     form acceptable to a computer, relating to the operations of the computer, or permitting the
118     functioning of a computer system in a manner designed to provide results including system
119     control programs, application programs, or copies of any of them.
120          Section 2. Section 76-6-703 is amended to read:
121          76-6-703. Computer crimes and penalties -- Interfering with critical
122     infrastructure.
123          [(1) A person who without authorization gains or attempts to gain access to and alters,
124     damages, destroys, discloses, or modifies any computer, computer network, computer property,
125     computer system, computer program, computer data or software, and thereby causes damage to
126     another, or obtains money, property, information, or a benefit for any person without legal
127     right, is guilty of:]
128          (1) It is unlawful for a person to:
129          (a) without authorization, or in excess of the person's authorization, access or attempt
130     to access computer technology if the access or attempt to access results in:
131          (i) the alteration, damage, destruction, copying, transmission, discovery, or disclosure
132     of computer technology;
133          (ii) interference with or interruption of:
134          (A) the lawful use of computer technology; or
135          (B) the transmission of data;
136          (iii) physical damage to or loss of real, personal, or commercial property;
137          (iv) audio, video, or other surveillance of another person; or
138          (v) economic loss to any person or entity;
139          (b) after accessing computer technology that the person is authorized to access,
140     knowingly take or attempt to take unauthorized or unlawful action that results in:
141          (i) the alteration, damage, destruction, copying, transmission, discovery, or disclosure
142     of computer technology;
143          (ii) interference with or interruption of:
144          (A) the lawful use of computer technology; or
145          (B) the transmission of data;
146          (iii) physical damage to or loss of real, personal, or commercial property;
147          (iv) audio, video, or other surveillance of another person; or
148          (v) economic loss to any person or entity; or
149          (c) knowingly engage in a denial of service attack.
150          (2) A person who violates Subsection (1) is guilty of:
151          (a) a class B misdemeanor when:
152          (i) the economic loss or other loss or damage caused or the value of the money,
153     property, or benefit obtained or sought to be obtained is less than $500; or
154          (ii) the information obtained is not confidential;
155          (b) a class A misdemeanor when the economic loss or other loss or damage caused or
156     the value of the money, property, or benefit obtained or sought to be obtained is or exceeds
157     $500 but is less than $1,500;
158          (c) a third degree felony when the economic loss or other loss or damage caused or the
159     value of the money, property, or benefit obtained or sought to be obtained is or exceeds $1,500
160     but is less than $5,000;
161          (d) a second degree felony when the economic loss or other loss or damage caused or
162     the value of the money, property, or benefit obtained or sought to be obtained is or exceeds
163     $5,000; or
164          (e) a third degree felony when:
165          (i) the property or benefit obtained or sought to be obtained is a license or entitlement;
166          (ii) the damage is to the license or entitlement of another person; [or]
167          (iii) the information obtained is confidential; or
168          (iv) in gaining access the person breaches or breaks through a security system.
169          [(2)] (3) (a) [Except as provided in Subsection (2)(b), a] A person who intentionally or
170     knowingly and without authorization gains or attempts to gain access to a computer, computer
171     network, computer property, or computer system under circumstances not otherwise
172     constituting an offense under this section is guilty of a class B misdemeanor.
173          (b) Notwithstanding Subsection [(2)] (3)(a), a retailer that uses an electronic product
174     identification or tracking system, or other technology, to identify, track, or price goods is not
175     guilty of a violation of Subsection [(2)] (3)(a) if the equipment designed to read the electronic
176     product identification or tracking system data and used by the retailer to identify, track, or price
177     goods is located within the retailer's location.
178          [(3)] (4) A person who uses or knowingly allows another person to use any computer,
179     computer network, computer property, or computer system, program, or software to devise or
180     execute any artifice or scheme to defraud or to obtain money, property, services, or other things
181     of value by false pretenses, promises, or representations, is guilty of an offense based on the
182     value of the money, property, services, or things of value, in the degree set forth in Subsection
183     76-10-1801(1).
184          [(4) A person who intentionally or knowingly and without authorization, interferes
185     with or interrupts computer services to another authorized to receive the services is guilty of a
186     class A misdemeanor.]
187          (5) A person is guilty of a third degree felony if the person intentionally or knowingly,
188     and without lawful authorization, interferes with or interrupts critical infrastructure.
189          [(5)] (6) It is an affirmative defense to [Subsections] Subsection (1) [and], (2), or (3)
190     that a person obtained access or attempted to obtain access:
191          (a) in response to, and for the purpose of protecting against or investigating, a prior
192     attempted or successful breach of security of [a computer, computer network, computer
193     property, computer system] computer technology whose security the person is authorized or
194     entitled to protect, and the access attempted or obtained was no greater than reasonably
195     necessary for that purpose[.]; or
196          (b) pursuant to a search warrant or a lawful exception to the requirement to obtain a
197     search warrant.
198          (7) (a) An interactive computer service is not guilty of violating this section if aperson
199     violates this section using the interactive computer service and the interactive computer service
200     did not knowingly assist the person to commit the violation.
201          (b) A service provider is not guilty of violating this section for:
202          (i) action taken in relation to a customer of the service provider, for a legitimate
203     business purpose, to install software on, monitor, or interact with the customer's Internet or
204     other network connection, service, or computer for network or computer security purposes,
205     authentication, diagnostics, technical support, maintenance, repair, network management,
206     updates of computer software or system firmware, or remote system management; or
207          (ii) action taken, including scanning and removing computer software, to detect or
208     prevent the following:
209          (A) unauthorized or fraudulent use of a network, service, or computer software;
210          (B) illegal activity; or
211          (C) infringement of intellectual property rights.
212          Section 3. Section 76-6-705 is amended to read:
213          76-6-705. Reporting violations.
214          [Every person, except those to whom a statutory or common law privilege applies,]
215          (1) Each person who has reason to believe that the provisions of Section 76-6-703 are
216     being or have been violated shall report the suspected violation to:
217          (a) the attorney general, or county attorney, or, if within a prosecution district, the
218     district attorney of the county or prosecution district in which part or all of the violations
219     occurred[.]; or
220          (b) a state or local law enforcement agency.
221          (2) Subsection (1) does not apply to the extent that the person is prohibited from
222     reporting by a statutory or common law privilege.
223          Section 4. Section 76-9-105 is amended to read:
224          76-9-105. Making a false alarm -- Penalties.
225          (1) A person is guilty of making a false alarm if he initiates or circulates a report or
226     warning of any fire, impending bombing, or other crime or catastrophe, knowing that the report
227     or warning is false or baseless and is likely to cause evacuation of any building, place of
228     assembly, or facility of public transport, to cause public inconvenience or alarm or action of
229     any sort by any official or volunteer agency organized to deal with emergencies.
230          (2) (a) [Making] A person is guilty of a second degree felony if the person makes a
231     false alarm relating to a weapon of mass destruction as defined in Section 76-10-401 [is a
232     second degree felony].
233          (b) A person is guilty of a third degree felony if:
234          (i) the person makes a false alarm alleging on ongoing act or event, or an imminent
235     threat; and
236          (ii) the false alarm causes or threatens to cause bodily harm, serious bodily injury, or
237     death to another person.
238          [(b)] (c) Making a false alarm other than under Subsection (2)(a) or (b) is a class B
239     misdemeanor.
240          (3) In addition to any other penalty authorized by law, a court shall order any person
241     convicted of a felony violation of this section to reimburse any federal, state, or local unit of
242     government, or any private business, organization, individual, or entity for all expenses and
243     losses incurred in responding to the violation, unless the court states on the record the reasons
244     why the court finds the reimbursement would be inappropriate.
245          Section 5. Section 76-9-201 is amended to read:
246          76-9-201. Electronic communication harassment -- Definitions -- Penalties.
247          (1) As used in this section:
248          (a) "Adult" means a person 18 years of age or older.
249          (b) "Electronic communication" means any communication by electronic,
250     electro-mechanical, or electro-optical communication device for the transmission and reception
251     of audio, image, or text but does not include broadcast transmissions or similar
252     communications that are not targeted at any specific individual.
253          (c) "Electronic communication device" includes a telephone, a facsimile machine,
254     electronic mail, [or] a pager, a computer, or any other device or medium that can be used to
255     communicate electronically.
256          (d) "Minor" means a person who is younger than 18 years of age.
257          (e) "Personal identifying information" means the same as that term is defined in
258     Section 76-6-1102.
259          (2) A person is guilty of electronic communication harassment and subject to
260     prosecution in the jurisdiction where the communication originated or was received if with
261     intent to [annoy, alarm,] intimidate, [offend,] abuse, threaten, harass, frighten, or disrupt the
262     electronic communications of another, the person:
263          (a) (i) makes repeated contact by means of electronic communications, regardless of
264     whether [or not] a conversation ensues; or
265          (ii) after the recipient has requested or informed the person not to contact the recipient,
266     and the person repeatedly or continuously:
267          (A) contacts the electronic communication device of the recipient; or
268          (B) causes an electronic communication device of the recipient to ring or to receive
269     other notification of attempted contact by means of electronic communication;
270          (b) makes contact by means of electronic communication and insults, taunts, or
271     challenges the recipient of the communication or any person at the receiving location in a
272     manner likely to provoke a violent or disorderly response;
273          (c) makes contact by means of electronic communication and threatens to inflict injury,
274     physical harm, or damage to any person or the property of any person; [or]
275          (d) causes disruption, jamming, or overload of an electronic communication system
276     through excessive message traffic or other means utilizing an electronic communication
277     device[.]; or
278          (e) electronically publishes, posts, or otherwise discloses personal identifying
279     information of another person, in a public online site or forum, without that person's
280     permission.
281          (3) (a) (i) Electronic communication harassment committed against an adult is a class
282     B misdemeanor, except under Subsection (3)(a)(ii).
283          (ii) A second or subsequent offense under Subsection (3)(a)(i) is a:
284          (A) class A misdemeanor if all prior violations of this section were committed against
285     adults; and
286          (B) a third degree felony if any prior violation of this section was committed against a
287     minor.
288          (b) (i) Electronic communication harassment committed against a minor is a class A
289     misdemeanor, except under Subsection (3)(b)(ii).
290          (ii) A second or subsequent offense under Subsection (3)(b)(i) is a third degree felony,
291     regardless of whether any prior violation of this section was committed against a minor or an
292     adult.
293          (4) (a) Except under Subsection (4)(b), criminal prosecution under this section does not
294     affect an individual's right to bring a civil action for damages suffered as a result of the
295     commission of any of the offenses under this section.
296          (b) This section does not create any civil cause of action based on electronic
297     communications made for legitimate business purposes.
298          Section 6. Section 76-9-202 is amended to read:
299          76-9-202. Emergency reporting -- Interference -- False report.
300          (1) As used in this section:
301          (a) "Emergency" means a situation in which property or human life is in jeopardy and
302     the prompt summoning of aid is essential to the preservation of human life or property.
303          (b) "Party line" means a subscriber's line or telephone circuit [consisting]:
304          (i) that consists of two or more connected main telephone stations [connected
305     therewith, each station with]; and
306          (ii) where each telephone station has a distinctive ring or telephone number.
307          (2) A person is guilty of emergency reporting abuse if [he] the person:
308          (a) intentionally refuses to yield or surrender the use of a party line or a public pay
309     telephone to another person upon being informed that the telephone is needed to report a fire or
310     summon police, medical, or other aid in case of emergency, unless the telephone is likewise
311     being used for an emergency call;
312          (b) asks for or requests the use of a party line or a public pay telephone on the pretext
313     that an emergency exists, knowing that no emergency exists; [or]
314          (c) reports an emergency or causes an emergency to be reported to any public, private,
315     or volunteer entity whose purpose is to respond to fire, police, or medical emergencies, when
316     the [actor] person knows the reported emergency does not exist[.]; or
317          (d) makes a false report, or intentionally aids, abets, or causes a third party to make a
318     false report, to an emergency response service, including a law enforcement dispatcher or a 911
319     emergency response service, if the false report claims that:
320          (i) an ongoing emergency exists;
321          (ii) the emergency described in Subsection (2)(d)(i) currently involves, or involves an
322     imminent threat of, serious bodily injury, serious physical injury, or death; and
323          (iii) the emergency described in Subsection (2)(d)(i) is occurring at a specified
324     location.
325          (3) (a) A violation of Subsection (2)(a) or (b) is a class C misdemeanor.
326          (b) A violation of Subsection (2)(c) is a class B misdemeanor, except as provided
327     under Subsection (3)(c).
328          (c) A violation of Subsection (2)(c) is a second degree felony if the report is regarding a
329     weapon of mass destruction, as defined in Section 76-10-401.
330          (d) A violation of Subsection (2)(d):
331          (i) except as provided in Subsection (3)(d)(ii), is a third degree felony; or
332          (ii) is a second degree felony if, while acting in response to the report, the emergency
333     responders cause physical injury to a person at the location described in Subsection (2)(d)(iii).
334          (4) (a) In addition to any other penalty authorized by law, a court shall order any person
335     convicted of a violation of this section to reimburse:
336          (i) any federal, state, or local unit of government, or any private business, organization,
337     individual, or entity for all expenses and losses incurred in responding to the violation[,
338     unless]; and
339          (ii) any person described in Subsection (3)(d)(ii) for the costs for the treatment of the
340     physical injury and any psychological injury caused by the offense.
341          (b) The court may order that the defendant pay less than the full amount of the costs
342     described in Subsection (4)(a) only if the court states on the record the reasons why the
343     reimbursement would be inappropriate.