HSB 13

Topics:Courts & civil law Crime & corrections Technology & privacy

Same legislation: SSB 1072, HF 143, SF 203

Write your legislators about itWhat changed before it passed

Official bill page Lobbyist declarations One-pager to print

Where it is now

Done: IntroducedJanuary 12, 2023
Done: SubcommitteeJanuary 12, 2023
Done: House committeeJanuary 25, 2023
Skipped: Passes the HouseContinued as HF 143
Next: Senate committee
Next: Passes the Senate
Next: To the Governor
Next: Signed into law

Became HF 143 → Its progress continues under the new number. Go to HF 143 What’s a funnel?

What’s in it

AI summary New laws would make it illegal to use ransomware or unauthorized access to damage computers, networks, or data. These rules specifically protect state government systems, schools, hospitals, and utility services from being interrupted or harmed. People who break these laws could face criminal charges or be sued for damages in court.¹

Read the official explanation

This bill relates to ransomware. The bill defines “ransomware” as a computer or data contaminant, encryption, or lock that is placed or introduced without authorization into a computer, computer network, or a computer system that restricts access by an authorized person to a computer, computer data, a computer network, or a computer system in a manner that results in the person responsible for the placement or introduction of the contaminant, encryption, or lock making a demand for payment of money or other consideration to remove the contaminant, encryption, or lock. The bill provides that a person shall not do any of the following with the intent to cause the malfunction or interruption of the operation of, or alter, damage, or destroy, all or any part of a computer, computer network, computer control language, computer software, computer system, computer service, or computer data: intentionally, willfully, and without authorization access, attempt to access, cause to be accessed, or exceed the person’s authorized access to all or a part of a computer network, computer control language, computer, computer software, computer system, or computer database; or copy, attempt to copy, possess, or attempt to possess the contents of all or part of a computer database. _____ distribute a valid access code to an unauthorized person. The bill provides that a person shall not commit a prohibited act with the intent to interrupt or impair the functioning of the state government; a service, device, or system related to the production, transmission, delivery, or storage of electricity or natural gas in the state that is owned, operated, or controlled by a person other than a public utility as defined in Code chapter 476; a service provided in the state by a public utility as defined in Code chapter 476; a hospital or health care facility; or a public elementary or secondary school, community college, or area education agency under the supervision of the department of education. The bill does not apply to the use of ransomware for research purposes by a person who has a bona fide scientific, educational, governmental, testing, news, or other similar justification for possessing ransomware. However, a person shall not knowingly possess ransomware with the intent to use the ransomware for the purpose of introduction into the computer, computer network, or computer system of another person without the authorization of the other person. The bill provides that a person who has suffered a specific and direct injury because of a violation of the bill may bring a civil action in a court of competent jurisdiction, and the court may award actual damages, reasonable attorney fees, and court costs. A conviction for an offense under the bill is not a prerequisite for the filing of a civil action. The bill provides that a person who commits a violation of the bill and who causes pecuniary losses involving less than $10,000 to a victim of the unlawful act is guilty of an aggravated misdemeanor. A person who commits a violation of the bill and who causes pecuniary losses involving at least $10,000 but less than $50,000 to a victim of the unlawful act is guilty of a class “D” felony. _____ class “C” felony. An aggravated misdemeanor is punishable by confinement for no more than two years and a fine of at least $855 but not more than $8,540. A class “D” felony is punishable by confinement for no more than five years and a fine of at least $1,025 but not more than $10,245. A class “C” felony is punishable by confinement for no more than years and a fine of at least $1,370 but not more than $13,660. The bill provides that for the purpose of determining venue, a violation of the bill shall be considered to have been committed in any county where the defendant performed the unlawful act, where the defendant resides, or where the accessed computer is located.

Changed since by amendment H-1005; see Amendments.

Full bill text · What changed before it passed²

House subcommittee

Named January 12, 2023. On January 18, 2023 it recommended passage. Vote Total: 3-0.

Three legislators hear a bill first and recommend what the committee should do; it’s the best time to weigh in. How to take part

1 written public comment to its subcommittee: January 31, 2023 (1) · on the Legislature’s site

Fiscal note

AI summary This bill creates new criminal offenses and penalties for ransomware crimes. The fiscal impact of the bill cannot be estimated, but because the correctional impact is estimated to be minimal, the overall fiscal impact would likely be minimal for the state's General Fund.³

Read the fiscal note

Description

House File 143 amends Iowa Code chapter 715 to include ransomware protections and provides penalties for ransomware crimes.

The Bill adopts the definition of ransomware and other terms.

Under the Bill, a person is prohibited from intentionally, willfully, and without authorization engaging in the following activities:

Access, attempt to access, cause to be accessed, or exceed the person’s authorized access to all or a part of a computer network, computer control language, computer, computer software, computer system, or computer database.
Copy, attempt to copy, possess, or attempt to possess the contents of all or part of a computer database accessed as described above.

A person is prohibited from committing the acts listed above with the following intent:

To cause the malfunction or interruption of the operation of all or any part of a computer, computer network, computer control language, computer software, computer system, computer service, or computer data.
To alter, damage, or destroy all or any part of data or a computer program stored, maintained, or produced by a computer, computer network, computer software, computer system, computer service, or computer database.

A person is prohibited from intentionally, willfully, and without authorization engaging in the following activities:

Possess, identify, or attempt to identify a valid computer access code.
Publicize or distribute a valid computer access code to an unauthorized person. A person is prohibited from committing an act prohibited by the Bill with the intent to interrupt or impact the functioning of various entities, as listed in the Bill.

The Bill creates an exception for the use of ransomware for research purposes. However, a person is prohibited from knowingly possessing ransomware with the intent to introduce it into the computer, computer network, or computer system of another person without the authorization of the owner.

A violation of the provisions of the Bill is punishable as follows:

A violation that causes pecuniary losses involving less than $10,000 to the victim is an aggravated misdemeanor.
A violation that causes pecuniary losses involving at least $10,000 but less than $50,000 to the victim is a Class D felony.
A violation that causes pecuniary losses involving at least $50,000 to the victim is a Class C felony.

The Bill also permits a person injured by a violation of the Bill to bring a civil action. The Bill also establishes additional exceptions to the prohibitions in Iowa Code chapter 715 related to computer spyware and malware.

Background

An aggravated misdemeanor is punishable by confinement of up to two years and a fine of at least $855 but not more than $8,540. A Class D felony is punishable by confinement of up to five years and a fine of at least $1,025 but not more than $10,245. A Class C felony is punishable by confinement of up to 10 years and a fine of at least $1,370 but not more than $13,660.

Assumptions

The following will not change over the projection period: charge, conviction, and sentencing patterns and trends; prisoner length of stay (LOS); revocation rates; plea bargaining; and other criminal justice system policies and practices.
A lag effect of six months is assumed from the effective date of this Bill to the date of first entry of affected offenders into the correctional system.
Marginal costs for county jails cannot be estimated due to a lack of data. For purposes of this analysis, the marginal cost for county jails is assumed to be $50 per day.

Correctional Impact

House File 143 establishes new criminal offenses. As a result, the correctional impact is difficult for the Department of Corrections (DOC) and the Division of Criminal and Juvenile Justice Planning (CJJP) of the Department of Human Rights to estimate. However, the Bill expands on the crimes in Iowa Code section 715.7, and charges and convictions currently under this section are rare. Because related crimes are rare, HF 143 is estimated to have a minimal correctional impact. Refer to the Legislative Services Agency (LSA) memo addressed to the General Assembly, Cost Estimates Used for Correctional Impact Statements, dated January 20, 2023, for information related to the correctional system.

Minority Impact

House File 143 establishes new criminal offenses. As a result, the CJJP cannot use prior existing data to estimate the minority impact of the Bill. However, as the correctional impact is estimated to be minimal, the minority impact of the Bill would likely be minimal. Refer to the LSA memo addressed to the General Assembly, Minority Impact Statement, dated January 20, 2023, for information related to minorities in the criminal justice system.

Fiscal Impact

House File 143 establishes new criminal offenses, and the fiscal impact cannot be estimated. However, as the correctional impact is estimated to be minimal, the fiscal impact of the Bill would likely be minimal. Table 1 shows the average State cost per offense for a Class C felony, a Class D felony, and an aggravated misdemeanor. Potential impacts to the State General Fund include operating costs incurred by the Judicial Branch, the Indigent Defense Fund, and the DOC. Any costs would be incurred across multiple fiscal years for prison and parole supervision.