Florida Senate - 2009 COMMITTEE AMENDMENT
Bill No. SB 164
Barcode 146914
LEGISLATIVE ACTION
Senate . House
Comm: FAV .
02/19/2009 .
.
.
.
—————————————————————————————————————————————————————————————————
—————————————————————————————————————————————————————————————————
The Committee on Commerce (Rich) recommended the following:
1 Senate Amendment (with title amendment)
2
3 Delete everything after the enacting clause
4 and insert:
5 Section 1. Section 815.03, Florida Statutes, is amended to
6 read:
7 815.03 Definitions.—As used in this chapter, unless the
8 context clearly indicates otherwise:
9 (1) “Access” means to approach, instruct, communicate with,
10 store data in, retrieve data from, or otherwise make use of any
11 resources of a computer, computer system, or computer network.
12 (2) “Cause to be copied” means to distribute or transfer
13 computer software or any component thereof. The term does not
14 include:
15 (a) Transmission, routing, provision of intermediate
16 temporary storage, or caching of software;
17 (b) A storage or hosting medium, such as a compact disk,
18 website, or computer server through which the software was
19 distributed by a third party; or
20 (c) An information-location tool, such as a directory,
21 index, reference, pointer, or hypertext link, through which the
22 user of the computer locates software.
23 (3)(2) “Computer” means an internally programmed, automatic
24 device that performs data processing.
25 (4)(3) “Computer contaminant” means any set of computer
26 instructions designed to modify, damage, destroy, record, or
27 transmit information within a computer, computer system, or
28 computer network without the intent or permission of the owner
29 of the information. The term includes, but is not limited to, a
30 group of computer instructions commonly called viruses or worms
31 which are self-replicating or self-propagating and which are
32 designed to contaminate other computer programs or computer
33 data; consume computer resources; modify, destroy, record, or
34 transmit data; or in some other fashion usurp the normal
35 operation of the computer, computer system, or computer network.
36 (5)(4) “Computer network” means any system that provides
37 communications between one or more computer systems and its
38 input or output devices, including, but not limited to, display
39 terminals and printers that are connected by telecommunication
40 facilities.
41 (6)(5) “Computer program or computer software” means a set
42 of instructions or statements and related data which, when
43 executed in actual or modified form, cause a computer, computer
44 system, or computer network to perform specified functions.
45 (7)(6) “Computer services” include, but are not limited to,
46 computer time; data processing or storage functions; or other
47 uses of a computer, computer system, or computer network.
48 (8)(7) “Computer system” means a device or collection of
49 devices, including support devices, one or more of which contain
50 computer programs, electronic instructions, or input data and
51 output data, and which perform functions, including, but not
52 limited to, logic, arithmetic, data storage, retrieval,
53 communication, or control. The term does not include calculators
54 that are not programmable and that are not capable of being used
55 in conjunction with external files.
56 (9) “Computer virus” means a computer program or other set
57 of instructions that is designed to degrade the performance of
58 or disable a computer or computer network and is designed to
59 have the ability to replicate itself on other computers or
60 computer networks without the authorization of the owners of
61 those computers or computer networks.
62 (10) “Damage” means any significant impairment to the
63 integrity or availability of data, software, a system, or
64 information.
65 (11)(8) “Data” means a representation of information,
66 knowledge, facts, concepts, computer software, computer
67 programs, or instructions. Data may be in any form, in storage
68 media or stored in the memory of the computer, or in transit or
69 presented on a display device.
70 (12) “Deceptive” means any of the following:
71 (a) A materially false or fraudulent statement.
72 (b) A statement or description that intentionally omits or
73 misrepresents material information in order to deceive an owner
74 or operator of a computer.
75 (c) A material failure to provide a notice to an owner or
76 operator regarding the installation or execution of computer
77 software for the purpose of deceiving the owner or operator.
78 (13) “Execute,” when used with respect to computer
79 software, means the performance of the functions or the carrying
80 out of the instructions of the computer software.
81 (14)(9) “Financial instrument” means any check, draft,
82 money order, certificate of deposit, letter of credit, bill of
83 exchange, credit card, or marketable security.
84 (15)(10) “Intellectual property” means data, including
85 programs.
86 (16) “Internet” means the global information system that is
87 logically linked together by a globally unique address space
88 based on the Internet protocol (IP), or its subsequent
89 extensions, and that is able to support communications using the
90 transmission control protocol/Internet protocol (TCP/IP) suite,
91 or its subsequent extensions, or other IP-compatible protocols,
92 and that provides, uses, or makes accessible, publicly or
93 privately, high-level services layered on the communications and
94 related infrastructure described in this chapter.
95 (17) “Owner or operator” means the owner or lessee of a
96 computer, or a person using such computer with the owner or
97 lessee's authorization, but does not include a person who owned
98 a computer before the first retail sale of the computer.
99 (18) “Message” means a graphical, text, voice, or audible
100 communication presented to an authorized user of a computer.
101 (19) “Person” means any individual, partnership,
102 corporation, limited liability company, or other organization,
103 or any combination thereof.
104 (20) “Personally identifiable information” means any of the
105 following information if it allows the entity holding the
106 information to identify the owner or operator of a computer:
107 (a) The first name or first initial in combination with the
108 last name.
109 (b) A home or other physical address including street name.
110 (c) Personal identification code in conjunction with a
111 password required to access an identified account, other than a
112 password, personal identification number, or other
113 identification number transmitted by an authorized user to the
114 issuer of the account or its agent.
115 (d) Social security number, tax identification number,
116 driver's license number, passport number, or any other
117 government-issued identification number.
118 (e) Account balance, bank account number, or credit card
119 numbers, overdraft history, or payment history that personally
120 identifies an owner or operator of a computer.
121 (21)(11) “Property” means anything of value as defined in
122 s. 812.011 and includes, but is not limited to, financial
123 instruments, information, including electronically produced data
124 and computer software and programs in either machine-readable or
125 human-readable form, and any other tangible or intangible item
126 of value.
127 Section 2. Section 815.051, Florida Statutes, is created to
128 read:
129 815.051 Prohibitions; use of software.—A person who is not
130 an owner or operator of a computer may not cause computer
131 software to be copied on a computer knowingly or with conscious
132 avoidance of actual knowledge or willfully, and without
133 authorization, or to use such software to do any of the
134 following:
135 (1) Modify, through deceptive means, settings of a computer
136 which control any of the following:
137 (a) The webpage that appears when an owner or operator
138 launches an Internet browser or similar computer software used
139 to access and navigate the Internet.
140 (b) The default provider or web proxy that an owner or
141 operator uses to access or search the Internet.
142 (c) An owner's or an operator's list of bookmarks used to
143 access web pages.
144 (2) Collect, through deceptive means, personally
145 identifiable information through any of the following means:
146 (a) The use of a keystroke-logging function that records
147 all or substantially all keystrokes made by an owner or operator
148 of a computer and transfers that information from the computer
149 to another person.
150 (b) In a manner that correlates personally identifiable
151 information with data regarding all or substantially all of the
152 websites visited by an owner or operator, other than websites
153 operated by the person providing the software, if the computer
154 software was installed in a manner designed to conceal from all
155 authorized users of the computer the fact that the software is
156 being installed.
157 (c) By extracting from the hard drive of an owner's or an
158 operator's computer, an owner's or an operator's social security
159 number, tax identification number, driver's license number,
160 passport number, any other government-issued identification
161 number, account balances, bank account numbers or credit card
162 numbers, or overdraft history for a purpose unrelated to any of
163 the purposes of the software or service described to an
164 authorized user.
165 (3) Prevent, through deceptive means, an owner's or an
166 operator's reasonable efforts to block the installation of or
167 execution of, or to disable, computer software by causing
168 computer software that the owner or operator has properly
169 removed or disabled to automatically reinstall or reactivate on
170 the computer without the authorization of an authorized user.
171 (4) Deceptively misrepresent that computer software will be
172 uninstalled or disabled by an owner's or an operator's action.
173 (5) Through deceptive means, remove, disable, or render
174 inoperative security, antispyware, or antivirus computer
175 software installed on an owner's or an operator's computer.
176 (6) Enable the use of an owner's or an operator's computer
177 to do any of the following:
178 (a) Access or use a modem or Internet service for the
179 purpose of causing damage to an owner's or an operator's
180 computer or causing an owner or operator, or a third party
181 affected by such conduct, to incur financial charges for a
182 service that the owner or operator did not authorize.
183 (b) Open multiple, sequential, or stand-alone messages in
184 an owner's or an operator's computer without the authorization
185 of an owner or operator and with knowledge that a reasonable
186 computer user could not close the messages without turning off
187 the computer or closing the software application in which the
188 messages appear; however, this paragraph does not apply to
189 communications originated by the computer’s operating system,
190 originated by a software application that the user chooses to
191 activate, originated by a service provider that the user chooses
192 to use, or presented for any of the purposes described in s.
193 815.06(6).
194 (c) Transmit or relay commercial electronic mail or a
195 computer virus from the computer, if the transmission or
196 relaying is initiated by a person other than the authorized user
197 and without the authorization of an authorized user.
198 (7) Use deceptive means to modify any of the following
199 settings related the computer’s access to, or use of, the
200 Internet:
201 (a) Settings that protect information about an owner or
202 operator for the purpose of obtaining personally identifiable
203 information of the owner or operator.
204 (b) Security settings for the purpose of causing damage to
205 a computer.
206 (c) Settings that protect the computer from the uses
207 identified in subsection (6).
208 (8) Use deceptive means to prevent, without the
209 authorization of an owner or operator, an owner's or an
210 operator's reasonable efforts to block the installation of, or
211 to disable, computer software by doing any of the following:
212 (a) Presenting the owner or operator with an option to
213 decline installation of computer software with knowledge that,
214 when the option is selected by the authorized user, the
215 installation nevertheless proceeds.
216 (b) Falsely representing that computer software has been
217 disabled.
218 (c) Requiring in a deceptive manner the user to access the
219 Internet to remove the software with knowledge or reckless
220 disregard of the fact that the software frequently operates in a
221 manner that prevents the user from accessing the Internet.
222 (d) Changing the name, location, or other designation
223 information of the software for the purpose of preventing an
224 authorized user from locating the software in order to remove
225 it.
226 (e) Using randomized or deceptive filenames, directory
227 folders, formats, or registry entries for the purpose of
228 avoiding detection and removal of the software by an authorized
229 user.
230 (f) Causing the installation of software in a particular
231 computer directory or computer memory for the purpose of evading
232 authorized users’ attempts to remove the software from the
233 computer.
234 (g) Requiring, without the authority of the owner of the
235 computer, that an authorized user obtain a special code or
236 download software from a third party in order to uninstall the
237 software.
238 Section 3. Section 815.053, Florida Statutes, is created to
239 read:
240 815.053 Other prohibitions.—A person who is not an owner or
241 operator of a computer may not do any of the following with
242 regard to the computer:
243 (1) Induce an owner or operator to install a computer
244 software component onto the owner's or operator's computer by
245 deceptively misrepresenting that installing computer software is
246 necessary for security or privacy reasons or in order to open,
247 view, or play a particular type of content.
248 (2) Using deceptive means to cause the execution of a
249 computer software component with the intent of causing the
250 computer to use such component in a manner that violates any
251 other provision of this chapter.
252 Section 4. Section 815.055, Florida Statutes, is created to
253 read:
254 815.055 Exceptions.—
255 (1) Sections 815.051 and 815.053 do not apply to the
256 monitoring of, or interaction with, an owner's or an operator’s
257 Internet or other network connection, service, or computer by a
258 telecommunications carrier, cable operator, computer hardware or
259 software provider, or provider of information service or
260 interactive computer service for purposes of network or computer
261 security, diagnostics, technical support, maintenance, repair,
262 network management, authorized updates of computer software or
263 system firmware, authorized remote system management, or
264 detection or prevention of the unauthorized use of, or
265 fraudulent or other illegal activities in connection with, a
266 network, service, or computer software, including scanning for
267 and removing computer software proscribed under this chapter.
268 (2) This section does not provide a defense to liability
269 under the common law or any other state or federal law, and may
270 not be construed to be an affirmative grant of authority to
271 engage in any of the activities listed in this section.
272 (3) This section does not impose liability on any
273 communications service providers as defined in s. 202.11(2),
274 commercial mobile service providers, or providers of information
275 services, including, but not limited to, Internet access service
276 providers and hosting service providers, if they provide the
277 transmission, storage, or caching of electronic communications
278 or messages of others or provide other related
279 telecommunications, commercial mobile radio service, or
280 information services used by others in violation of this
281 chapter. This exemption from liability is consistent with and in
282 addition to any liability exemption provided under 47 U.S.C. s.
283 230.
284 (4) This section does not prohibit or criminalize the use
285 of software by parents or guardians to monitor Internet or
286 computer usage of their minor children.
287 Section 5. Section 815.06, Florida Statutes, is amended to
288 read:
289 815.06 Offenses against computer users.—
290 (1) Whoever willfully, knowingly, and without
291 authorization:
292 (a) Accesses or causes to be accessed any computer,
293 computer system, or computer network;
294 (b) Disrupts or denies or causes the denial of computer
295 system services to an authorized user of such computer system
296 services, which, in whole or part, is owned by, under contract
297 to, or operated for, on behalf of, or in conjunction with
298 another;
299 (c) Destroys, takes, injures, or damages equipment or
300 supplies used or intended to be used in a computer, computer
301 system, or computer network;
302 (d) Destroys, injures, or damages any computer, computer
303 system, or computer network; or
304 (e) Violates s. 815.051 or s. 815.053; or
305 (f)(e) Introduces any computer contaminant into any
306 computer, computer system, or computer network,
307 commits an offense against computer users.
308 (2)(a) Except as provided in paragraphs (b) and (c),
309 whoever violates subsection (1) commits a felony of the third
310 degree, punishable as provided in s. 775.082, s. 775.083, or s.
311 775.084.
312 (b) Whoever violates subsection (1) and:
313 1. Damages a computer, computer equipment, computer
314 supplies, a computer system, or a computer network, and the
315 monetary damage or loss incurred as a result of the violation is
316 $5,000 or greater;
317 2. Commits the offense for the purpose of devising or
318 executing any scheme or artifice to defraud or obtain property;
319 or
320 3. Interrupts or impairs a governmental operation or public
321 communication, transportation, or supply of water, gas, or other
322 public service,
323 commits a felony of the second degree, punishable as provided in
324 s. 775.082, s. 775.083, or s. 775.084.
325 (c) Whoever violates subsection (1) and the violation
326 endangers human life commits a felony of the first degree,
327 punishable as provided in s. 775.082, s. 775.083, or s. 775.084.
328 (3) Whoever willfully, knowingly, and without authorization
329 modifies equipment or supplies used or intended to be used in a
330 computer, computer system, or computer network commits a
331 misdemeanor of the first degree, punishable as provided in s.
332 775.082 or s. 775.083.
333 (4) The Department of Legal Affairs or a state attorney may
334 file a civil action on behalf of the people of this state for
335 injunctive relief against any person or group violating
336 subsection (1) to restrain the prohibited activity. The court
337 may award court costs and reasonable attorney's fees to the
338 prevailing party. The court may also impose a civil penalty that
339 may not exceed $10,000 for each violation of subsection (1), and
340 the total penalties may not exceed $1 million per defendant.
341 (5)(4)(a) In addition to any other civil remedy available,
342 the owner or lessee of the computer, computer system, computer
343 network, computer program, computer equipment, computer
344 supplies, or computer data may bring a civil action against any
345 person convicted under this section for compensatory damages.
346 (b) In any action brought under this subsection, the court
347 may award reasonable attorney's fees to the prevailing party.
348 (6)(5) Any computer, computer system, computer network,
349 computer software, or computer data owned by a defendant which
350 is used during the commission of any violation of this section
351 or any computer owned by the defendant which is used as a
352 repository for the storage of software or data obtained in
353 violation of this section is subject to forfeiture as provided
354 under ss. 932.701-932.704.
355 (7)(6) This section does not apply to any person who
356 accesses his or her employer's computer system, computer
357 network, computer program, or computer data when acting within
358 the scope of his or her lawful employment.
359 (8)(7) For purposes of bringing a civil or criminal action
360 under this section, a person who causes, by any means, the
361 access to a computer, computer system, or computer network in
362 one jurisdiction from another jurisdiction is deemed to have
363 personally accessed the computer, computer system, or computer
364 network in both jurisdictions.
365 (9) This section does not prohibit a private litigant from
366 filing a civil action for damages arising under this section.
367 Section 5. This act shall take effect July 1, 2009.
368
369 ================= T I T L E A M E N D M E N T ================
370 And the title is amended as follows:
371 Delete everything before the enacting clause
372 and insert:
373
374 A bill to be entitled
375 An act relating to offenses against computer users;
376 amending s. 815.03, F.S.; defining terms for purposes
377 of the Florida Computer Crimes Act; creating s.
378 815.051, F.S.; providing that a person who is not an
379 owner or operator of a computer may not cause computer
380 software to be copied on a computer knowingly or with
381 conscious avoidance of actual knowledge or willfully,
382 and without authorization, to undertake specified
383 actions to a computer; creating s. 815.053, F.S.;
384 prohibiting a person who is not an owner or operator
385 of a computer from inducing an owner or operator to
386 install a computer software component onto the owner's
387 or operator's computer by deceptively misrepresenting
388 that installing computer software is necessary for
389 security or privacy reasons or by using deceptive
390 means to cause the execution of a computer software
391 component with the intent of causing the computer to
392 use the component in a harmful manner; creating s.
393 815.055, F.S.; providing exceptions; amending s.
394 815.06, F.S.; providing that a violation of the act is
395 a felony of the third degree; providing criminal
396 penalties; providing enhanced criminal penalties under
397 certain circumstances; authorizing the Department of
398 Legal Affairs or a state attorney to file a civil
399 action for injunctive relief against any person or
400 group to restrain prohibited activities; authorizing a
401 court to award court costs and attorney's fees to the
402 prevailing party; permitting a court to impose a civil
403 penalty not to exceed a stated amount for each offense
404 against computer users; providing for civil actions by
405 private litigants; providing an effective date.