Relating to ransomware and providing penalties

The bill provides that the monitoring of, or interaction with, an owner’s or operator’s internet or other network connection, service, or computer is not prohibited for support or maintenance, the investigation of illegal activities, the nonpayment or violation of the terms of a contract, or for complying with federal, state, and local law enforcement requests. The bill provides that a person shall not do any of the following with the intent to cause the malfunction or interruption of the operation of, or alter, damage, or destroy, all or any part of a computer, computer network, computer control language, computer software, computer system, computer service, or computer data: intentionally, willfully, and without authorization access, attempt to access, cause to be accessed, or exceed the person’s authorized access to all or a part of a computer network, computer control language, computer, computer software, computer system, or computer database; or copy, attempt to copy, possess, or attempt to possess the contents of all or part of a computer database. The bill provides that a person shall not intentionally, willfully, and without authorization possess, identify, or attempt to identify a valid access code or publicize or distribute a valid access code to an unauthorized person.1(3); a service provided in the state by a public utility as defined in Code chapter 476; a hospital or health care facility; a public elementary or secondary school, community college, or area education agency under the supervision of the department of education; a city, city utility, or city service; or an aviation authority. The bill does not apply to the use of ransomware for research purposes by a person who has a bona fide scientific, educational, governmental, testing, news, or other similar justification for possessing ransomware. However, a person shall not knowingly possess ransomware with the intent to use the ransomware for the purpose of introduction into the computer, computer network, or computer system of another person without the authorization of the other person. The bill provides that a person who has suffered a specific and direct injury because of a violation of the bill may bring a civil action in a court of competent jurisdiction, and the court may award actual damages, reasonable attorney fees, and court costs. A conviction for an offense under the bill is not a prerequisite for the filing of a civil action. The bill provides that a person who commits a violation of the bill and who causes pecuniary losses involving less than $10,000 to a victim of the unlawful act is guilty of an aggravated misdemeanor. A person who commits a violation of the bill and who causes pecuniary losses involving at least $10,000 but less than $50,000 to a victim of the unlawful act is guilty of a class “D” felony. A person who commits a violation of the bill and who causes pecuniary losses involving at least $50,000 to a victim of the unlawful act is guilty of a class “C” felony. An aggravated misdemeanor is punishable by confinement for no more than two years and a fine of at least $855 but not more than $8,540. A class “D” felony is punishable by confinement for no more than five years and a fine of at least $1,025 but not more than $10,245. A class “C” felony is punishable by confinement for no more than years and a fine of at least $1,370 but not more than $13,660. The bill provides that for the purpose of determining venue, a violation of the bill shall be considered to have been committed in any county where the defendant performed the unlawful act, where the defendant resides, or where the accessed computer is located.