Relating to ransomware and providing penalties

Description

House File 2461 expands Iowa Code chapter 715 to include ransomware protections and provides penalties for ransomware crimes.

The Bill defines ransomware as a computer or data contaminant, encryption, or lock that is placed or introduced without authorization into a computer, computer network, or computer system that restricts access by an authorized person to a computer, computer data, a computer system, or a computer network in a manner that results in the person responsible for the placement or introduction of the contaminant, encryption, or lock making a demand for payment of money or other consideration to remove the contaminant, encryption, or lock. Under the Bill, a person is not permitted to intentionally, willfully, and without authorization do any of the following:

• Access, attempt to access, cause to be accessed, or exceed the person’s authorized access to all or a part of a computer network, computer control language, computer, computer software, computer system, or computer database.
• Copy, attempt to copy, possess, or attempt to possess the contents of all or part of a computer database accessed through such means.

A person is not permitted to commit the above prohibited acts with the intent to do any of the following:

• Cause the malfunction or interruption of the operation of all or any part of a computer, computer network, computer control language, computer software, computer system, computer service, or computer data.
• Alter, damage, or destroy all or any part of data or a computer program stored, maintained, or produced by a computer, computer network, computer software, computer system, computer service, or computer database.

A person is not permitted to intentionally, willfully, and without authorization, do any of the following:

• Possess, identify, or attempt to identify a valid computer access code.
• Publicize or distribute a valid computer access code to an unauthorized person. A person is not permitted to commit an act prohibited by this Bill with the intent to interrupt or impair the functioning of the State; a service, device, or system related to the production, transmission, delivery, or storage of electricity or natural gas in the State that is owned, operated, or controlled by a person other than a public utility; a service provided in the State by a public utility; a hospital or health care facility; or a public elementary or secondary school, community college, or area education agency.

The Bill creates an exception for the use of ransomware for research purposes. However, a person is not permitted to knowingly possess ransomware with the intent to use it for the purpose of introduction into the computer, computer network, or computer system of another person without the authorization of the other person.

A violation of the provisions of this Bill is punishable as follows:

• A violation that causes pecuniary losses involving less than $10,000 to the victim is an aggravated misdemeanor.
• A violation that causes pecuniary losses involving at least $10,000 but less than $50,000 to the victim is a Class D felony.
• A violation that causes pecuniary losses involving at least $50,000 to the victim is a Class C felony.

The Bill also permits a person injured by a violation of this Bill to bring a civil action.

Background

An aggravated misdemeanor is punishable by up to two years in prison and a fine of at least $855 but not more than $8,540. A Class D felony is punishable by up to five years in prison and a fine of at least $1,025 but not more than $10,245. A Class C felony is punishable by up to 10 years in prison and a fine of at least $1,370 but not more than $13,660.

Assumptions

• The following will not change over the projection period: charge, conviction, and sentencing patterns and trends; prisoner length of stay (LOS); revocation rates; plea bargaining; and other criminal justice system policies and practices.
• A lag effect of six months is assumed from the effective date of this Bill to the date of first entry of affected offenders into the correctional system.
• Marginal costs for county jails cannot be estimated due to a lack of data. For purposes of this analysis, the marginal cost for county jails is assumed to be $50 per day.

Correctional Impact

House File 2461 establishes new criminal offenses, and the correctional impact cannot be estimated for this Bill due to a lack of existing conviction data. Table 1 below shows estimates for sentencing to State prison, parole, probation, or community-based corrections (CBC) residential facilities; LOS under those supervisions; and supervision marginal costs per day for all convictions of Class C felonies, Class D felonies, and aggravated misdemeanors. Refer to the Legislative Services Agency (LSA) memo addressed to the General Assembly, Cost Estimates Used for Correctional Impact Statements, dated January 18, 2022, for information related to the correctional system.

Table 1 — Sentencing Estimates and Length of Stay (LOS)

Minority Impact

House File 2461 establishes new criminal offenses. As a result, the Criminal and Juvenile Justice Planning Division of the Department of Human Rights cannot use prior existing data to estimate the minority impact of HF 2461. Refer to the LSA memo addressed to the General Assembly, Minority Impact Statement, dated January 18, 2022, for information related to minorities in the criminal justice system.

Fiscal Impact

House File 2461 establishes new criminal offenses, and the fiscal impact cannot be estimated due to a lack of existing conviction data. The average State cost per offense for an aggravated misdemeanor ranges from $4,900 to $9,500. The average State cost per offense for a Class D felony ranges from $9,100 to $16,600. The average State cost per offense for a Class C felony ranges from $11,100 to $22,100. The estimated impact to the State General Fund includes operating costs incurred by the Judicial Branch, the Indigent Defense Fund, and the Department of Corrections. The cost would be incurred across multiple fiscal years for prison and parole supervision.

Sources

• Criminal and Juvenile Justice Planning Division, Department of Human Rights
• Department of Corrections
• Legislative Services Agency