Ch. 13: Review

Computer Fraud and Abuse Act, 18 USC § 1030 (2000)

(a) Whoever -
     (1) having knowingly accessed a computer without authorization
     or exceeding authorized access, and by means of such conduct
     having obtained information that has been determined by the
     United States Government pursuant to an Executive order or
     statute to require protection against unauthorized disclosure for
     reasons of national defense or foreign relations, or any
     restricted data, as defined in paragraph y. of section 11 of the
     Atomic Energy Act of 1954, with reason to believe that such
     information so obtained could be used to the injury of the United
     States, or to the advantage of any foreign nation willfully
     communicates, delivers, transmits, or causes to be communicated,
     delivered, or transmitted, or attempts to communicate, deliver,
     transmit or cause to be communicated, delivered, or transmitted
     the same to any person not entitled to receive it, or willfully
     retains the same and fails to deliver it to the officer or
     employee of the United States entitled to receive it;

     (2) intentionally accesses a computer without authorization or
     exceeds authorized access, and thereby obtains -
          (A) information contained in a financial record of a
          financial institution, or of a card issuer as defined in
          section 1602(n) of title 15, or contained in a file of a
          consumer reporting agency on a consumer, as such terms are
          defined in the Fair Credit Reporting Act (15 U.S.C. 1681 et
          seq.);
          (B) information from any department or agency of the United
          States; or
          (C) information from any protected computer if the conduct
          involved an interstate or foreign communication;

     (3) intentionally, without authorization to access any
     nonpublic computer of a department or agency of the United
     States, accesses such a computer of that department or agency
     that is exclusively for the use of the Government of the United
     States or, in the case of a computer not exclusively for such
     use, is used by or for the Government of the United States and
     such conduct affects that use by or for the Government of the
     United States;

     (4) knowingly and with intent to defraud, accesses a protected
     computer without authorization, or exceeds authorized access, and
     by means of such conduct furthers the intended fraud and obtains
     anything of value, unless the object of the fraud and the thing
     obtained consists only of the use of the computer and the value
     of such use is not more than $5,000 in any 1-year period;

     (5)
          (A) knowingly causes the transmission of a program,
          information, code, or command, and as a result of such
          conduct, intentionally causes damage without authorization, to
          a protected computer;
          (B) intentionally accesses a protected computer without
          authorization, and as a result of such conduct, recklessly
          causes damage; or
          (C) intentionally accesses a protected computer without
          authorization, and as a result of such conduct, causes damage;

     (6) knowingly and with intent to defraud traffics (as defined
     in section 1029) in any password or similar information through
     which a computer may be accessed without authorization, if -
          (A) such trafficking affects interstate or foreign commerce;
          or
          (B) such computer is used by or for the Government of the
          United States; [1]

     (7) with intent to extort from any person, firm, association,
     educational institution, financial institution, government
     entity, or other legal entity, any money or other thing of value,
     transmits in interstate or foreign commerce any communication
     containing any threat to cause damage to a protected computer;

     shall be punished as provided in subsection (c) of this section.

(b) Whoever attempts to commit an offense under subsection (a) of this
section shall be punished as provided in subsection (c) of this section.

(c) The punishment for an offense under subsection (a) or (b) of this
section is -

     (1)
         (A) a fine under this title or imprisonment for not more
         than ten years, or both, in the case of an offense under
         subsection (a)(1) of this section which does not occur after a
         conviction for another offense under this section, or an
         attempt to commit an offense punishable under this
         subparagraph; and
         (B) a fine under this title or imprisonment for not more than
         twenty years, or both, in the case of an offense under
         subsection (a)(1) of this section which occurs after a
         conviction for another offense under this section, or an
         attempt to commit an offense punishable under this
         subparagraph;

     (2)
         (A) a fine under this title or imprisonment for not more
         than one year, or both, in the case of an offense under
         subsection (a)(2), (a)(3), (a)(5)(C), or (a)(6) of this section
         which does not occur after a conviction for another offense
         under this section, or an attempt to commit an offense
         punishable under this subparagraph; and [2]
         (B) a fine under this title or imprisonment for not more than 5
         years, or both, in the case of an offense under subsection
         (a)(2), if -
             (i) the offense was committed for purposes of commercial
             advantage or private financial gain;
             (ii) the offense was committed in furtherance of any
             criminal or tortious act in violation of the Constitution
             or laws of the United States or of any State; or
             (iii) the value of the information obtained exceeds $5,000;
             [3]
         (C) a fine under this title or imprisonment for not more than
         ten years, or both, in the case of an offense under subsection
         (a)(2), (a)(3) or (a)(6) of this section which occurs after a
         conviction for another offense under this section, or an
         attempt to commit an offense punishable under this
         subparagraph; and
     (3) (A) a fine under this title or imprisonment for not more
         than five years, or both, in the case of an offense under
         subsection (a)(4), (a)(5)(A), (a)(5)(B), or (a)(7) of this
         section which does not occur after a conviction for another
         offense under this section, or an attempt to commit an offense
         punishable under this subparagraph; and
         (B) a fine under this title or imprisonment for not more than

         ten years, or both, in the case of an offense under subsection
         (a)(4), (a)(5)(A), (a)(5)(B), (a)(5)(C), or (a)(7) of this
         section which occurs after a conviction for another offense
         under this section, or an attempt to commit an offense
         punishable under this subparagraph; and [4]

. . . .

(e) As used in this section -

. . . .

     (2) the term "protected computer" means a computer -
         (A) exclusively for the use of a financial institution or the
         United States Government, or, in the case of a computer not
         exclusively for such use, used by or for a financial
         institution or the United States Government and the conduct
         constituting the offense affects that use by or for the
         financial institution or the Government; or
         (B) which is used in interstate or foreign commerce or
         communication;

. . . .

     (6) the term "exceeds authorized access" means to access a
     computer with authorization and to use such access to obtain or
     alter information in the computer that the accesser is not
     entitled so to obtain or alter;

     (8) the term "damage" means any impairment to the integrity
     or availability of data, a program, a system, or information,
     that -
         (A) causes loss aggregating at least $5,000 in value during
         any 1-year period to one or more individuals;
         (B) modifies or impairs, or potentially modifies or impairs,
         the medical examination, diagnosis, treatment, or care of one
         or more individuals;
         (C) causes physical injury to any person; or
         (D) threatens public health or safety; and

. . . .

(f) This section does not prohibit any lawfully authorized
investigative, protective, or intelligence activity of a law enforcement
agency of the United States, a State, or a political subdivision of a
State, or of an intelligence agency of the United States.

(g) Any person who suffers damage or loss by reason of a violation of
this section may maintain a civil action against the violator to obtain
compensatory damages and injunctive relief or other equitable relief.
Damages for violations involving damage as defined in subsection
(e)(8)(A) are limited to economic damages. No action may be brought
under this subsection unless such action is begun within 2 years of the
date of the act complained of or the date of the discovery of the
damage.

. . . .

     Footnotes

     [1] So in original. Probably should be followed by "or".
     [2] So in original. The word "and" probably should not appear.
     [3] So in original. Probably should be followed by "and".
     [4] So in original. The "; and" probably should be a period.
     [5] See References in Text note below.
     [6] So in original. The period probably should be a semicolon.

Computer Fraud and Abuse Act, 18 USC § 1030 (2000)

   (a) It is the intent of the Legislature in enacting this
section to expand the degree of protection afforded to individuals,
businesses, and governmental agencies from tampering, interference,
damage, and unauthorized access to lawfully created computer data and
computer systems.  The Legislature finds and declares that the
proliferation of computer technology has resulted in a concomitant
proliferation of computer crime and other forms of unauthorized
access to computers, computer systems, and computer data.
   The Legislature further finds and declares that protection of the
integrity of all types and forms of lawfully created computers,
computer systems, and computer data is vital to the protection of the
privacy of individuals as well as to the well-being of financial
institutions, business concerns, governmental agencies, and others
within this state that lawfully utilize those computers, computer
systems, and data.
   (b) For the purposes of this section, the following terms have the
following meanings:
      (1) "Access" means to gain entry to, instruct, or communicate
with the logical, arithmetical, or memory function resources of a
computer, computer system, or computer network.

. . . .

      (8) "Injury" means any alteration, deletion, damage, or
destruction of a computer system, computer network, computer program,
or data caused by the access.
      (9) "Victim expenditure" means any expenditure reasonably and
necessarily incurred by the owner or lessee to verify that a computer
system, computer network, computer program, or data was or was not
altered, deleted, damaged, or destroyed by the access.
      (10) "Computer contaminant" means any set of computer 
instructions that are designed to modify, damage, destroy, record, or
transmit information within a computer, computer system, or computer
network without the intent or permission of the owner of the
information.  They include, but are not limited to, a group of
computer instructions commonly called viruses or worms, that are
self-replicating or self-propagating and are designed to contaminate
other computer programs or computer data, consume computer resources,
modify, destroy, record, or transmit data, or in some other fashion
usurp the normal operation of the computer, computer system, or
computer network.

. . . .

   (c) Except as provided in subdivision (h), any person who commits
any of the following acts is guilty of a public offense:
      (1) Knowingly accesses and without permission alters, damages,
deletes, destroys, or otherwise uses any data, computer, computer
system, or computer network in order to either (A) devise or execute
any scheme or artifice to defraud, deceive, or extort, or (B)
wrongfully control or obtain money, property, or data.
      (2) Knowingly accesses and without permission takes, copies,
or makes use of any data from a computer, computer system, or 
computer network, or takes or copies any supporting documentation,
whether existing or residing internal or external to a computer,
computer system, or computer network.
      (3) Knowingly and without permission uses or causes to be
used computer services.
      (4) Knowingly accesses and without permission adds, alters,
damages, deletes, or destroys any data, computer software, or
computer programs which reside or exist internal or external to a
computer, computer system, or computer network.
      (5) Knowingly and without permission disrupts or causes the
disruption of computer services or denies or causes the denial of
computer services to an authorized user of a computer, computer
system, or computer network.
      (6) Knowingly and without permission provides or assists in
providing a means of accessing a computer, computer system, or
computer network in violation of this section.
      (7) Knowingly and without permission accesses or causes to
be accessed any computer, computer system, or computer network.
      (8) Knowingly introduces any computer contaminant into any
computer, computer system, or computer network.
      (9) Knowingly and without permission uses the Internet domain
name of another individual, corporation, or entity in connection with
the sending of one or more electronic mail messages, and thereby
damages or causes damage to a computer, computer system, or computer
network.
   (d) (1) Any person who violates any of the provisions of paragraph
(1), (2), (4), or (5) of subdivision (c) is punishable by a fine not
exceeding ten thousand dollars ($10,000), or by imprisonment in the
state prison for 16 months, or two or three years, or by both that
fine and imprisonment, or by a fine not exceeding five thousand
dollars ($5,000), or by imprisonment in a county jail not exceeding
one year, or by both that fine and imprisonment.
      (2) Any person who violates paragraph (3) of subdivision (c) is
punishable as follows:
         (A) For the first violation that does not result in injury,
and where the value of the computer services used does not exceed
four hundred dollars ($400), by a fine not exceeding five thousand
dollars ($5,000), or by imprisonment in a county jail not exceeding
one year, or by both that fine and imprisonment.
         (B) For any violation that results in a victim expenditure
in an amount greater than five thousand dollars ($5,000) or in an
injury, or if the value of the computer services used exceeds four
hundred dollars ($400), or for any second or subsequent violation,
by a fine not exceeding ten thousand dollars ($10,000), or by
imprisonment in the state prison for 16 months, or two or three
years, or by both that fine and imprisonment, or by a fine not
exceeding five thousand dollars ($5,000), or by imprisonment in a
county jail not exceeding one year, or by both that fine and
imprisonment.
      (3) Any person who violates paragraph (6), (7), or (8) of
subdivision (c) is punishable as follows:
         (A) For a first violation that does not result in injury,
an infraction punishable by a fine not exceeding two hundred fifty
dollars ($250).
         (B) For any violation that results in a victim expenditure
in an amount not greater than five thousand dollars ($5,000), or for
a second or subsequent violation, by a fine not exceeding five
thousand dollars ($5,000), or by imprisonment in a county jail not
exceeding one year, or by both that fine and imprisonment.
         (C) For any violation that results in a victim expenditure
in an amount greater than five thousand dollars ($5,000), by a fine
not exceeding ten thousand dollars ($10,000), or by imprisonment in
the state prison for 16 months, or two or three years, or by both
that fine and imprisonment, or by a fine not exceeding five thousand
dollars ($5,000), or by imprisonment in a county jail not exceeding
one year, or by both that fine and imprisonment.
      (4) Any person who violates paragraph (9) of subdivision (c)
is punishable as follows:
         (A) For a first violation that does not result in injury,
an infraction punishable by a fine not exceeding two hundred fifty
dollars ($250).
         (B) For any violation that results in injury, or for a second
or subsequent violation, by a fine not exceeding five thousand dollars
($5,000), or by imprisonment in a county jail not exceeding one year,
or by both that fine and imprisonment.
   (e) (1) In addition to any other civil remedy available, the owner
or lessee of the computer, computer system, computer network,
computer program, or data may bring a civil action against any person
convicted under this section for compensatory damages, including any
expenditure reasonably and necessarily incurred by the owner or
lessee to verify that a computer system, computer network, computer
program, or data was or was not altered, damaged, or deleted by the
access.  For the purposes of actions authorized by this subdivision,
the conduct of an unemancipated minor shall be imputed to the parent
or legal guardian having control or custody of the minor, pursuant to
the provisions of Section 1714.1 of the Civil Code.
      (2) In any action brought pursuant to this subdivision the
court may award reasonable attorney's fees to a prevailing party.

. . . .

   (f) This section shall not be construed to preclude the
applicability of any other provision of the criminal law of this
state which applies or may apply to any transaction, nor shall it
make illegal any employee labor relations activities that are within
the scope and protection of state or federal labor laws.
   (g) Any computer, computer system, computer network, or any
software or data, owned by the defendant, that is used during the
commission of any public offense described in subdivision (c) or any
computer, owned by the defendant, which is used as a repository for
the storage of software or data illegally obtained in violation of
subdivision (c) shall be subject to forfeiture, as specified in
Section 502.01.

. . . .

      (2) Paragraph (3) of subdivision (c) does not apply to
penalize any acts committed by a person acting outside of his or her
lawful employment, provided that the employee's activities do not
cause an injury, as defined in paragraph (8) of subdivision (b), to
the employer or another, or provided that the value of supplies or
computer services, as defined in paragraph (4) of subdivision (b),
which are used does not exceed an accumulated total of one hundred
dollars ($100).
   (i) No activity exempted from prosecution under paragraph (2) of
subdivision (h) which incidentally violates paragraph (2), (4), or
(7) of subdivision (c) shall be prosecuted under those paragraphs.
   (j) For purposes of bringing a civil or a criminal action under
this section, a person who causes, by any means, the access of a
computer, computer system, or computer network in one jurisdiction
from another jurisdiction is deemed to have personally accessed the
computer, computer system, or computer network in each jurisdiction.

. . . .