Bill Text: CA AB32 | 2015-2016 | Regular Session | Amended

NOTE: There are more recent revisions of this legislation. Read Latest Draft

---

Bill Title: Computer crimes.

Spectrum: Slight Partisan Bill (Republican 3-1)

Status: (Passed) 2015-10-08 - Chaptered by Secretary of State - Chapter 614, Statutes of 2015. [AB32 Detail]

Download: California-2015-AB32-Amended.html

---

BILL NUMBER: AB 32	AMENDED
	BILL TEXT

	AMENDED IN ASSEMBLY  APRIL 7, 2015

INTRODUCED BY   Assembly Member Waldron
    (   Coauthors:   Assembly Members 
 Chávez   and Jones   ) 
    (   Coauthor:   Senator   Allen
  ) 

                        DECEMBER 1, 2014

   An act to amend Sections 502 and 803 of the Penal Code, relating
to computer crimes.


	LEGISLATIVE COUNSEL'S DIGEST


   AB 32, as amended, Waldron. Computer crimes.
   Existing law establishes various crimes relating to computer
services and systems, including to knowingly and without permission
disrupt or cause the disruption of computer services including
government computer services or public safety infrastructure computer
system computer services, add, alter, damage, delete, or destroy any
computer data, software, or program, introduce a computer
contaminant, use the Internet domain name or profile of another.
Existing law makes a violation of these provisions punishable by
specified fines or terms of imprisonment, or by both those fines and
imprisonment. Existing law establishes the time  limitations
  limitation  during which a criminal complaint
 for a violation of these provisions  may be filed. 

   This bill would make the commission of any of those crimes that
involves acquiring, copying, or distributing a digital image of a
person that displays an intimate body part, as defined, of the person
additionally punishable by a fine not exceeding $10,000 per each
digital image acquired, copied, or distributed. The bill would,
notwithstanding any of those other time limitations, permit a
criminal complaint alleging a violation described in the bill to be
filed within one year of the date on which that violation was
discovered.  
   This bill would increase the fine for a misdemeanor violation of
those crimes from a fine not exceeding $5,000 to a fine not exceeding
$10,000. The bill would toll, until discovery of the offense, the
time for filing a criminal complaint for a violation of those
provisions when it is alleged that the defendant acquired, copied, or
distributed a digital image of an intimate body part, as defined, of
a person. 
   Vote: majority. Appropriation: no. Fiscal committee: no.
State-mandated local program: no.


THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS:

  SECTION 1.  Section 502 of the Penal Code is amended to read:
   502.  (a) It is the intent of the Legislature in enacting this
section to expand the degree of protection afforded to individuals,
businesses, and governmental agencies from tampering, interference,
damage, and unauthorized access to lawfully created computer data and
computer systems. The Legislature finds and declares that the
proliferation of computer technology has resulted in a concomitant
proliferation of computer crime and other forms of unauthorized
access to computers, computer systems, and computer data.
   The Legislature further finds and declares that protection of the
integrity of all types and forms of lawfully created computers,
computer systems, and computer data is vital to the protection of the
privacy of individuals as well as to the well-being of financial
institutions, business concerns, governmental agencies, and others
within this state that lawfully utilize those computers, computer
systems, and data.
   (b) For the purposes of this section, the following terms have the
following meanings:
   (1) "Access" means to gain entry to, instruct, cause input to,
cause output from, cause data processing with, or communicate with,
the logical, arithmetical, or memory function resources of a
computer, computer system, or computer network.
   (2) "Computer network" means any system that provides
communications between one or more computer systems and input/output
 devices   devices,  including, but not
limited to, display terminals, remote systems, mobile devices, and
printers connected by telecommunication facilities.
   (3) "Computer program or software" means a set of instructions or
statements, and related data, that when executed in actual or
modified form, cause a computer, computer system, or computer network
to perform specified functions.
   (4) "Computer services" includes, but is not limited to, computer
time, data processing, or storage functions, Internet services,
electronic mail services, electronic message services, or other uses
of a computer, computer system, or computer network.
   (5) "Computer system" means a device or collection of devices,
including support devices and excluding calculators that are not
programmable and capable of being used in conjunction with external
files, one or more of which contain computer programs, electronic
instructions, input data, and output data, that performs 
functions   functions,  including, but not limited
to, logic, arithmetic, data storage and retrieval, communication, and
control.
   (6) "Government computer system" means any computer system, or
part thereof, that is owned, operated, or used by any federal, state,
or local governmental entity.
   (7) "Public safety infrastructure computer system" means any
computer system, or part thereof, that is necessary for the health
and safety of the public including computer systems owned, operated,
or used by drinking water and wastewater treatment facilities,
hospitals, emergency service providers, telecommunication companies,
and gas and electric utility companies.
   (8) "Data" means a representation of information, knowledge,
facts, concepts, computer software, computer programs or
instructions. Data may be in any form, in storage media, or as stored
in the memory of the computer or in transit or presented on a
display device.
   (9) "Supporting documentation" includes, but is not limited to,
all information, in any form, pertaining to the design, construction,
classification, implementation, use, or modification of a computer,
computer system, computer network, computer program, or computer
software, which information is not generally available to the public
and is necessary for the operation of a computer, computer system,
computer network, computer program, or computer software.
   (10) "Injury" means any alteration, deletion, damage, or
destruction of a computer system, computer network, computer program,
or data caused by the access, or the denial of access to legitimate
users of a computer system, network, or program.
   (11) "Victim expenditure" means any expenditure reasonably and
necessarily incurred by the owner or lessee to verify that a computer
system, computer network, computer program, or data was or was not
altered, deleted, damaged, or destroyed by the access.
   (12) "Computer contaminant" means any set of computer instructions
that are designed to modify, damage, destroy, record, or transmit
information within a computer, computer system, or computer network
without the intent or permission of the owner of the information.
They include, but are not limited to, a group of computer
instructions commonly called viruses or worms, that are
self-replicating or self-propagating and are designed to contaminate
other computer programs or computer data, consume computer resources,
modify, destroy, record, or transmit data, or in some other fashion
usurp the normal operation of the computer, computer system, or
computer network.
   (13) "Internet domain name" means a globally unique, hierarchical
reference to an Internet host or service, assigned through
centralized Internet naming authorities, comprising a series of
character strings separated by periods, with the rightmost character
string specifying the top of the hierarchy.
   (14) "Electronic mail" means an electronic message or computer
file that is transmitted between two or more telecommunications
devices; computers; computer networks, regardless of whether the
network is a local, regional, or global network; or electronic
devices capable  or   of  receiving
electronic messages, regardless of whether the message is converted
to hard copy format after receipt, viewed upon transmission, or
stored for later retrieval.
   (15) "Profile" means either of the following:
   (A) A configuration of user data required by a computer so that
the user may access programs or services and have the desired
functionality on that computer.
   (B) An Internet Web site user's personal page or section of a page
that is made up of data, in text  of   or 
graphical form, that displays significant, unique, or identifying
information, including, but not limited to, listing acquaintances,
interests, associations, activities, or personal statements.
   (c) Except as provided in subdivision (h), any person who commits
any of the following acts is guilty of a public offense:
   (1) Knowingly accesses and without permission alters, damages,
deletes, destroys, or otherwise uses any data, computer, computer
system, or computer network in order to either (A) devise or execute
any scheme or artifice to defraud, deceive, or extort, or (B)
wrongfully control or obtain money, property, or data.
   (2) Knowingly accesses and without permission takes, copies, or
makes use of any data from a computer, computer system, or computer
network, or takes or copies any supporting documentation, whether
existing or residing internal or external to a computer, computer
system, or computer network.
   (3) Knowingly and without permission uses or causes to be used
computer services.
   (4) Knowingly accesses and without permission adds, alters,
damages, deletes, or destroys any data, computer software, or
computer programs which reside or exist internal or external to a
computer, computer system, or computer network.
   (5) Knowingly and without permission disrupts or causes the
disruption of computer services or denies or causes the denial of
computer services to an authorized user of a computer, computer
system, or computer network.
   (6) Knowingly and without permission provides or assists in
providing a means of accessing a computer, computer system, or
computer network in violation of this section.
   (7) Knowingly and without permission accesses or causes to be
accessed any computer, computer system, or computer network.
   (8) Knowingly introduces any computer contaminant into any
computer, computer system, or computer network.
   (9) Knowingly and without permission uses the Internet domain name
or profile of another individual, corporation, or entity in
connection with the sending of one or more electronic mail messages
or posts and thereby damages or causes damage to a computer, computer
data, computer system, or computer network.
   (10) Knowingly and without permission disrupts or causes the
disruption of government computer services or denies or causes the
denial of government computer services to an authorized user of a
government computer, computer system, or computer network.
   (11) Knowingly accesses and without permission adds, alters,
damages, deletes, or destroys any data, computer software, or
computer programs which reside or exist internal or external to a
public safety infrastructure computer system computer, computer
system, or computer network.
   (12) Knowingly and without permission disrupts or causes the
disruption of public safety infrastructure computer system computer
services or denies or causes the denial of computer services to an
authorized user of a public safety infrastructure computer system
computer, computer system, or computer network.
   (13) Knowingly and without permission provides or assists in
providing a means of accessing a computer, computer system, or public
safety infrastructure computer system computer, computer system, or
computer network in violation of this section.
   (14) Knowingly introduces any computer contaminant into any public
safety infrastructure computer system computer, computer system, or
computer network.
   (d) (1) Any person who violates any of the provisions of paragraph
(1), (2), (4), (5), (10), (11), or (12) of subdivision (c) is
punishable by a fine not exceeding ten thousand dollars ($10,000), or
by imprisonment pursuant to subdivision (h) of Section 1170 for 16
months, or two or three years, or by both that fine and imprisonment,
or by a fine not exceeding  five thousand dollars ($5,000),
  ten thousand dollars ($10,000),  or by
imprisonment in a county jail not exceeding one year, or by both that
fine and imprisonment.
   (2) Any person who violates paragraph (3) of subdivision (c) is
punishable as follows:
   (A) For the first violation that does not result in injury, and
where the value of the computer services used does not exceed nine
hundred fifty dollars ($950), by a fine not exceeding  five
thousand dollars ($5,000),   ten thousand dollars
($10,000),  or by imprisonment in a county jail not exceeding
one year, or by both that fine and imprisonment.
   (B) For any violation that results in a victim expenditure in an
amount greater than five thousand dollars ($5,000) or in an injury,
or if the value of the computer services used exceeds nine hundred
fifty dollars ($950), or for any second or subsequent violation, by a
fine not exceeding ten thousand dollars ($10,000), or by
imprisonment pursuant to subdivision (h) of Section 1170 for 16
months, or two or three years, or by both that fine and imprisonment,
or by a fine not exceeding  five thousand dollars ($5,000),
  ten thousand dollars ($10,000),  or by
imprisonment in a county jail not exceeding one year, or by both that
fine and imprisonment.
   (3) Any person who violates paragraph (6), (7), or (13) of
subdivision (c) is punishable as follows:
   (A) For a first violation that does not result in injury, an
infraction punishable by a fine not exceeding one thousand dollars
($1,000).
   (B) For any violation that results in a victim expenditure in an
amount not greater than five thousand dollars ($5,000), or for a
second or subsequent violation, by a fine not exceeding  five
thousand dollars ($5,000),   ten thousand dollars
($10,000),  or by imprisonment in a county jail not exceeding
one year, or by both that fine and imprisonment.
   (C) For any violation that results in a victim expenditure in an
amount greater than five thousand dollars ($5,000), by a fine not
exceeding ten thousand dollars ($10,000), or by imprisonment pursuant
to subdivision (h) of Section 1170 for 16 months, or two or three
years, or by both that fine and imprisonment, or by a fine not
exceeding  five thousand dollars ($5,000),   ten
thousand dollars ($10,000),  or by imprisonment in a county
jail not exceeding one year, or by both that fine and imprisonment.
   (4) Any person who violates paragraph (8) or (14) of subdivision
(c) is punishable as follows:
   (A) For a first violation that does not result in injury, a
misdemeanor punishable by a fine not exceeding  five thousand
dollars ($5,000),   ten thousand dollars ($10,000),
 or by imprisonment in a county jail not exceeding one year, or
by both that fine and imprisonment.
   (B) For any violation that results in injury, or for a second or
subsequent violation, by a fine not exceeding ten thousand dollars
($10,000), or by imprisonment in a county jail not exceeding one
year, or by imprisonment pursuant to subdivision (h) of Section 1170,
or by both that fine and imprisonment.
   (5) Any person who violates paragraph (9) of subdivision (c) is
punishable as follows:
   (A) For a first violation that does not result in injury, an
infraction punishable by a fine not exceeding one thousand dollars
($1,000).
   (B) For any violation that results in injury, or for a second or
subsequent violation, by a fine not exceeding  five thousand
dollars ($5,000),   ten thousand dollars ($10,000),
 or by imprisonment in a county jail not exceeding one year, or
by both that fine and imprisonment.
   (e) (1) In addition to any other civil remedy available, the owner
or lessee of the computer, computer system, computer network,
computer program, or data who suffers damage or loss by reason of a
violation of any of the provisions of subdivision (c) may bring a
civil action against the violator for compensatory damages and
injunctive relief or other equitable relief. Compensatory damages
shall include any expenditure reasonably and necessarily incurred by
the owner or lessee to verify that a computer system, computer
network, computer program, or data was or was not altered, damaged,
or deleted by the access. For the purposes of actions authorized by
this subdivision, the conduct of an unemancipated minor shall be
imputed to the parent or legal guardian having control or custody of
the minor, pursuant to the provisions of Section 1714.1 of the Civil
Code.
   (2) In any action brought pursuant to this subdivision the court
may award reasonable attorney's fees.
   (3) A community college, state university, or academic institution
accredited in this state is required to include computer-related
crimes as a specific violation of college or university student
conduct policies and regulations that may subject a student to
disciplinary sanctions up to and including dismissal from the
academic institution. This paragraph shall not apply to the
University of California unless the Board of Regents adopts a
resolution to that effect.
   (4) In any action brought pursuant to this subdivision for a
willful violation of the provisions of subdivision (c), where it is
proved by clear and convincing evidence that a defendant has been
guilty of oppression, fraud, or malice as defined in subdivision (c)
of Section 3294 of the Civil Code, the court may additionally award
punitive or exemplary damages.
   (5) No action may be brought pursuant to this subdivision unless
it is initiated within three years of the date of the act complained
of, or the date of the discovery of the damage, whichever is later.
   (f) This section shall not be construed to preclude the
applicability of any other provision of the criminal law of this
state which applies or may apply to any transaction, nor shall it
make illegal any employee labor relations activities that are within
the scope and protection of state or federal labor laws.
   (g) Any computer, computer system, computer network, or any
software or data, owned by the defendant, that is used during the
commission of any public offense described in subdivision (c) or any
computer, owned by the defendant, which is used as a repository for
the storage of software or data illegally obtained in violation of
subdivision (c) shall be subject to forfeiture, as specified in
Section 502.01.
   (h) (1) Subdivision (c) does not apply to punish any acts which
are committed by a person within the scope of his or her lawful
employment. For purposes of this section, a person acts within the
scope of his or her employment when he or she performs acts which are
reasonably necessary to the performance of his or her work
assignment.
   (2) Paragraph (3) of subdivision (c) does not apply to penalize
any acts committed by a person acting outside of his or her lawful
employment, provided that the employee's activities do not cause an
injury, to the employer or another, or provided that the value of
supplies or computer services which are used does not exceed an
accumulated total of two hundred fifty dollars ($250).
   (i) No activity exempted from prosecution under paragraph (2) of
subdivision (h) which incidentally violates paragraph (2), (4), or
(7) of subdivision (c) shall be prosecuted under those paragraphs.
   (j) For purposes of bringing a civil or a criminal action under
this section, a person who causes, by any means, the access of a
computer, computer system, or computer network in one jurisdiction
from another jurisdiction is deemed to have personally accessed the
computer, computer system, or computer network in each jurisdiction.
   (k) In determining the terms and conditions applicable to a person
convicted of a violation of this section the court shall consider
the following:
   (1) The court shall consider prohibitions on access to and use of
computers.
   (2) Except as otherwise required by law, the court shall consider
alternate sentencing, including community service, if the defendant
shows remorse and recognition of the wrongdoing, and an inclination
not to repeat the offense. 
   (l) (1) A person who commits a violation of this section that
involves acquiring, copying, or distributing one or more digital
images of a person that displays an intimate body part of the person
is subject to a fine not exceeding ten thousand dollars ($10,000) per
each image acquired, copied, or distributed.  
   (2) A fine imposed pursuant to this subdivision is in addition to
any other penalty or punishment provided for conduct that violates
this subdivision.  
   (3) A fine pursuant to this subdivision may be imposed only
pursuant to an action brought by a district attorney. 

   (4) As used in this subdivision, "intimate body part" means any
portion of the genitals, the anus, and in the case of a female also
includes any portion of the breasts below the top of the areola, that
is either uncovered or clearly visible through clothing. 
  SEC. 2.  Section 803 of the Penal Code is amended to read:
   803.  (a) Except as provided in this section, a limitation of time
prescribed in this chapter is not tolled or extended for any reason.

   (b) No time during which prosecution of the same person for the
same conduct is pending in a court of this state is a part of a
limitation of time prescribed in this chapter.
   (c) A limitation of time prescribed in this chapter does not
commence to run until the discovery of an offense described in this
subdivision. This subdivision applies to an offense punishable by
imprisonment in the state prison or imprisonment pursuant to
subdivision (h) of Section 1170, a material element of which is fraud
or breach of a fiduciary obligation, the commission of the crimes of
theft or embezzlement upon an elder or dependent adult, or the basis
of which is misconduct in office by a public officer, employee, or
appointee, including, but not limited to, the following offenses:
   (1) Grand theft of any type, forgery, falsification of public
records, or acceptance of a bribe by a public official or a public
employee.
   (2) A violation of Section 72, 118, 118a, 132, 134, or 186.10.
   (3) A violation of Section 25540, of any type, or Section 25541 of
the Corporations Code.
   (4) A violation of Section 1090 or 27443 of the Government Code.
   (5) Felony welfare fraud or Medi-Cal fraud in violation of Section
11483 or 14107 of the Welfare and Institutions Code.
   (6) Felony insurance fraud in violation of Section 548 or 550 of
this code or  former Section 1871.1, or  Section 1871.4 of
the Insurance Code.
   (7) A violation of Section 580, 581, 582, 583, or 584 of the
Business and Professions Code.
   (8) A violation of Section 22430 of the Business and Professions
Code.
   (9) A violation of Section 103800 of the Health and Safety Code.
   (10) A violation of Section 529a.
   (11) A violation of subdivision (d) or (e) of Section 368.
   (d) If the defendant is out of the state when or after the offense
is committed, the prosecution may be commenced as provided in
Section 804 within the limitations of time prescribed by this
chapter, and no time up to a maximum of three years during which the
defendant is not within the state shall be a part of those
limitations.
   (e) A limitation of time prescribed in this chapter does not
commence to run until the offense has been discovered, or could have
reasonably been discovered, with regard to offenses under Division 7
(commencing with Section 13000) of the Water Code, under Chapter 6.5
(commencing with Section 25100) of, Chapter 6.7 (commencing with
Section 25280) of, or Chapter 6.8 (commencing with Section 25300) of,
Division 20 of, or Part 4 (commencing with Section 41500) of
Division 26 of, the Health and Safety Code, or under Section 386, or
offenses under Chapter 5 (commencing with Section 2000) of Division 2
of, Chapter 9 (commencing with Section 4000) of Division 2 of,
Section 6126 of, Chapter 10 (commencing with Section 7301) of
Division 3 of, or Chapter 19.5 (commencing with Section 22440) of
Division 8 of, the Business and Professions Code.
   (f) (1) Notwithstanding any other limitation of time described in
this chapter, a criminal complaint may be filed within one year of
the date of a report to a California law enforcement agency by a
person of any age alleging that he or she, while under the age of 18
years, was the victim of a crime described in Section 261, 286, 288,
288a, 288.5, or  289.   289, or Section 289.5 as
enacted by Chapter 293 of the Statutes of 1991 relating to
penetration by an unknown object. 
   (2) This subdivision applies only if all of the following occur:
   (A) The limitation period specified in Section 800, 801, or 801.1,
whichever is later, has expired.
   (B) The crime involved substantial sexual conduct, as described in
subdivision (b) of Section 1203.066, excluding masturbation that is
not mutual.
   (C) There is independent evidence that corroborates the victim's
allegation. If the victim was 21 years of age or older at the time of
the report, the independent evidence shall clearly and convincingly
corroborate the victim's allegation.
   (3) No evidence may be used to corroborate the victim's allegation
that otherwise would be inadmissible during trial. Independent
evidence does not include the opinions of mental health
professionals.
   (4) (A) In a criminal investigation involving any of the crimes
listed in paragraph (1) committed against a child, when the
applicable limitations period has not expired, that period shall be
tolled from the time a party initiates litigation challenging a grand
jury subpoena until the end of the litigation, including any
associated writ or appellate proceeding, or until the final
disclosure of evidence to the investigating or prosecuting agency, if
that disclosure is ordered pursuant to the subpoena after the
litigation.
   (B) Nothing in this subdivision affects the definition or
applicability of any evidentiary privilege.
   (C) This subdivision shall not apply where a court finds that the
grand jury subpoena was issued or caused to be issued in bad faith.
   (g) (1) Notwithstanding any other limitation of time described in
this chapter, a criminal complaint may be filed within one year of
the date on which the identity of the suspect is conclusively
established by DNA testing, if both of the following conditions are
met:
   (A) The crime is one that is described in subdivision (c) of
Section 290.
   (B) The offense was committed prior to January 1, 2001, and
biological evidence collected in connection with the offense is
analyzed for DNA type no later than January 1, 2004, or the offense
was committed on or after January 1, 2001, and biological evidence
collected in connection with the offense is analyzed for DNA type no
later than two years from the date of the offense.
   (2) For purposes of this section, "DNA" means deoxyribonucleic
acid.
   (h) For any crime, the proof of which depends substantially upon
evidence that was seized under a warrant, but which is unavailable to
the prosecuting authority under the procedures described in People
v. Superior Court (Laff) (2001) 25 Cal.4th 703, People v. Superior
Court (Bauman & Rose) (1995) 37 Cal.App.4th 1757, or subdivision (c)
of Section 1524, relating to claims of evidentiary privilege or
attorney work product, the limitation of time prescribed in this
chapter shall be tolled from the time of the seizure until final
disclosure of the evidence to the prosecuting authority. Nothing in
this section otherwise affects the definition or applicability of any
evidentiary privilege or attorney work product.
   (i) Notwithstanding any other limitation of time described in this
chapter, a criminal complaint may be filed within one year of the
date on which a hidden recording is discovered related to a violation
of paragraph (2) or (3) of subdivision (j) of Section 647.
   (j) Notwithstanding any other limitation of time described in this
chapter, if a person flees the scene of an accident that caused
death or permanent, serious injury, as defined in subdivision (d) of
Section 20001 of the Vehicle Code, a criminal complaint brought
pursuant to paragraph (2) of subdivision (b) of Section 20001 of the
Vehicle Code may be filed within the applicable time period described
in Section 801 or 802 or one year after the person is initially
identified by law enforcement as a suspect in the commission of the
offense, whichever is later, but in no case later than six years
after the commission of the offense. 
   (k) Notwithstanding any other limitation of time described in this
chapter, a criminal complaint alleging a violation described in
subdivision (l) of Section 502 may be filed within one year of
                                             the date on which the
alleged violation is discovered. 
    (k)     (1)     A
limitation of time prescribed in this chapter for an offense
described in subdivision (c) of Section 502 for which it is alleged
the defendant acquired, copied, or distributed one or more digital
images of a person that displays an intimate body part of the person
shall not commence to run until the discove   ry of the
offense.  
   (2) As used in this subdivision, "intimate body part" means any
portion of the genitals, the anus, and in the case of a female also
includes any portion of the breasts below the top of the areola, that
is either uncovered or clearly visible through clothing.  
   (3) As used in this subdivision, "digital images of a person" do
not include representational images, artwork, or cartoon drawings.