Relating to ransomware and providing penalties

The bill provides that a person shall not do any of the following with the intent to cause the malfunction or interruption of the operation of, or alter, damage, or destroy, all or any part of a computer, computer network, computer control language, computer software, computer system, computer service, or computer data: intentionally, willfully, and without authorization access, attempt to access, cause to be accessed, or exceed the person’s authorized access to all or a part of a computer network, computer control language, computer, computer software, computer system, or computer database; or copy, attempt to copy, possess, or attempt to possess the contents of all or part of a computer database. The bill provides that a person shall not intentionally, willfully, and without authorization possess, identify, or attempt to identify a valid access code or publicize or distribute a valid access code to an unauthorized person. The bill provides that a person shall not commit a prohibited act with the intent to interrupt or impair the functioning of the state government; a service, device, or system related to the production, transmission, delivery, or storage of electricity or natural gas in the state that is owned, operated, or controlled by a person other than a public utility as defined in Code chapter 476; a service provided in the state by a public utility as defined in Code chapter 476; a hospital or health care facility; or a public elementary or secondary school, community college, or area education agency under the supervision of the department of education. The bill does not apply to the use of ransomware for research purposes by a person who has a bona fide scientific, educational, governmental, testing, news, or other similar justification for possessing ransomware. However, a person shall not knowingly possess ransomware with the intent to use the ransomware for the purpose of introduction into the computer, computer network, or computer system of another person without the authorization of the other person. The bill provides that a person who has suffered a specific and direct injury because of a violation of the bill may bring a civil action in a court of competent jurisdiction, and the court may award actual damages, reasonable attorney fees, and court costs. A conviction for an offense under the bill is not a prerequisite for the filing of a civil action. The bill provides that a person who commits a violation of the bill and who causes pecuniary losses involving less than $10,000 to a victim of the unlawful act is guilty of an aggravated misdemeanor. A person who commits a violation of the bill and who causes pecuniary losses involving at least $10,000 but less than $50,000 to a victim of the unlawful act is guilty of a class “D” felony. A person who commits a violation of the bill and who causes pecuniary losses involving at least $50,000 to a victim of the unlawful act is guilty of a class “C” felony. An aggravated misdemeanor is punishable by confinement for no more than two years and a fine of at least $855 but not more than $8,540. A class “D” felony is punishable by confinement for no more than five years and a fine of at least $1,025 but not more than $10,245. A class “C” felony is punishable by confinement for no more than years and a fine of at least $1,370 but not more than $13,660. The bill provides that for the purpose of determining venue, a violation of the bill shall be considered to have been committed in any county where the defendant performed the unlawful act, where the defendant resides, or where the accessed computer is located.