Relating to ransomware and providing penalties

Description

House File 143 amends Iowa Code chapter 715 to include ransomware protections and provides penalties for ransomware crimes.

The Bill adopts the definition of ransomware and other terms.

Under the Bill, a person is prohibited from intentionally, willfully, and without authorization engaging in the following activities:

• Access, attempt to access, cause to be accessed, or exceed the person’s authorized access to all or a part of a computer network, computer control language, computer, computer software, computer system, or computer database.
• Copy, attempt to copy, possess, or attempt to possess the contents of all or part of a computer database accessed as described above.

A person is prohibited from committing the acts listed above with the following intent:

• To cause the malfunction or interruption of the operation of all or any part of a computer, computer network, computer control language, computer software, computer system, computer service, or computer data.
• To alter, damage, or destroy all or any part of data or a computer program stored, maintained, or produced by a computer, computer network, computer software, computer system, computer service, or computer database.

A person is prohibited from intentionally, willfully, and without authorization engaging in the following activities:

• Possess, identify, or attempt to identify a valid computer access code.
• Publicize or distribute a valid computer access code to an unauthorized person. A person is prohibited from committing an act prohibited by the Bill with the intent to interrupt or impact the functioning of various entities, as listed in the Bill.

The Bill creates an exception for the use of ransomware for research purposes. However, a person is prohibited from knowingly possessing ransomware with the intent to introduce it into the computer, computer network, or computer system of another person without the authorization of the owner.

A violation of the provisions of the Bill is punishable as follows:

• A violation that causes pecuniary losses involving less than $10,000 to the victim is an aggravated misdemeanor.
• A violation that causes pecuniary losses involving at least $10,000 but less than $50,000 to the victim is a Class D felony.
• A violation that causes pecuniary losses involving at least $50,000 to the victim is a Class C felony.

The Bill also permits a person injured by a violation of the Bill to bring a civil action. The Bill also establishes additional exceptions to the prohibitions in Iowa Code chapter 715 related to computer spyware and malware.

Background

An aggravated misdemeanor is punishable by confinement of up to two years and a fine of at least $855 but not more than $8,540. A Class D felony is punishable by confinement of up to five years and a fine of at least $1,025 but not more than $10,245. A Class C felony is punishable by confinement of up to 10 years and a fine of at least $1,370 but not more than $13,660.

Assumptions

• The following will not change over the projection period: charge, conviction, and sentencing patterns and trends; prisoner length of stay (LOS); revocation rates; plea bargaining; and other criminal justice system policies and practices.
• A lag effect of six months is assumed from the effective date of this Bill to the date of first entry of affected offenders into the correctional system.
• Marginal costs for county jails cannot be estimated due to a lack of data. For purposes of this analysis, the marginal cost for county jails is assumed to be $50 per day.

Correctional Impact

House File 143 establishes new criminal offenses. As a result, the correctional impact is difficult for the Department of Corrections (DOC) and the Division of Criminal and Juvenile Justice Planning (CJJP) of the Department of Human Rights to estimate. However, the Bill expands on the crimes in Iowa Code section 715.7, and charges and convictions currently under this section are rare. Because related crimes are rare, HF 143 is estimated to have a minimal correctional impact. Refer to the Legislative Services Agency (LSA) memo addressed to the General Assembly, Cost Estimates Used for Correctional Impact Statements, dated January 20, 2023, for information related to the correctional system.

Minority Impact

House File 143 establishes new criminal offenses. As a result, the CJJP cannot use prior existing data to estimate the minority impact of the Bill. However, as the correctional impact is estimated to be minimal, the minority impact of the Bill would likely be minimal. Refer to the LSA memo addressed to the General Assembly, Minority Impact Statement, dated January 20, 2023, for information related to minorities in the criminal justice system.

Fiscal Impact

House File 143 establishes new criminal offenses, and the fiscal impact cannot be estimated. However, as the correctional impact is estimated to be minimal, the fiscal impact of the Bill would likely be minimal. Table 1 shows the average State cost per offense for a Class C felony, a Class D felony, and an aggravated misdemeanor. Potential impacts to the State General Fund include operating costs incurred by the Judicial Branch, the Indigent Defense Fund, and the DOC. Any costs would be incurred across multiple fiscal years for prison and parole supervision.

Sources

• Criminal and Juvenile Justice Planning Division, Department of Human Rights
• Department of Corrections
• Legislative Services Agency