New Jersey-2010-S631-Introduced

An Act concerning computer crimes, amending and supplementing P.L.1984, c.184.

Be It Enacted by the Senate and General Assembly of the State of New Jersey:

1. Section 4 of P.L. 1984, c.184 (C.2C:20-25) is amended to read as follows:

4. A person is guilty of computer criminal activity if the person purposely or knowingly and without authorization, or in excess of authorization:

a. Accesses any data, data base, computer storage medium, computer program, computer software, computer equipment, computer, computer system or computer network;

b. Alters, damages or destroys any data, data base, computer, computer storage medium, computer program, computer software, computer system or computer network, or denies, disrupts or impairs computer services, including access to any part of the Internet, that are available to any other user of the computer services;

c. Accesses or attempts to access any data, data base, computer, computer storage medium, computer program, computer software, computer equipment, computer system or computer network for the purpose of executing a scheme to defraud, or to obtain services, property, personal identifying information, or money, from the owner of a computer or any third party, including a scheme by means of a knowing misrepresentation as to the identity or authority of the person requesting the information;

d. (Deleted by amendment, P.L.2003, c.39).

e. Obtains, takes, copies or uses any data, data base, computer program, computer software, personal identifying information, or other information stored in a computer, computer network, computer system, computer equipment or computer storage medium;

f. Accesses and recklessly alters, damages or destroys any data, data base, computer, computer storage medium, computer program, computer software, computer equipment, computer system or computer network.

g. A violation of subsection a. of this section is a crime of the third degree. A violation of subsection b. is a crime of the second degree. A violation of subsection c. is a crime of the third degree, except that it is a crime of the second degree if the value of the services, property, personal identifying information, or money obtained or sought to be obtained exceeds $5,000. A violation of subsection e. is a crime of the third degree, except that it is a crime of the second degree if the data, data base, computer program, computer software, or information:

(1) is or contains personal identifying information, medical diagnoses, treatments or other medical information concerning an identifiable person;

(2) is or contains governmental records or other information that is protected from disclosure by law, court order or rule of court; or

(3) has a value exceeding $5,000.

A violation of subsection f. is a crime of the fourth degree, except that it is a crime of the third degree if the value of the damage exceeds $5,000.

A violation of any subsection of this section is a crime of the first degree if the offense results in:

(1) a substantial interruption or impairment of public communication, transportation, supply of water, gas or power, or other public service. The term "substantial interruption or impairment" shall mean such interruption or impairment that:

(a) affects 10 or more structures or habitations;

(b) lasts for two or more hours; or

(2) damages or loss in excess of $250,000; or

(3) significant bodily injury to any person.

Every sentence of imprisonment for a crime of the first degree committed in violation of this section shall include a minimum term of one-third to one-half of the sentence imposed, during which term the defendant shall not be eligible for parole.

h. Every sentence imposed upon a conviction pursuant to this section shall, if the victim is a government agency, include a period of imprisonment. The period of imprisonment shall include a minimum term of one-third to one-half of the sentence imposed, during which term the defendant shall not be eligible for parole. The victim shall be deemed to be a government agency if a computer, computer network, computer storage medium, computer system, computer equipment, computer program, computer software, computer data or data base that is a subject of the crime is owned, operated or maintained by or on behalf of a governmental agency or unit of State or local government or a public authority. The defendant shall be strictly liable under this subsection and it shall not be a defense that the defendant did not know or intend that the victim was a government agency, or that the defendant intended that there be other victims of the crime.

A violation of any subsection of this section shall be a distinct offense from a violation of any other subsection of this section, and a conviction for a violation of any subsection of this section shall not merge with a conviction for a violation of any other subsection of this section or section 10 of P.L.1984, c.184 (C.2C:20-31), or for conspiring or attempting to violate any subsection of this section or section 10 of P.L.1984, c.184 (C.2C:20-31), and a separate sentence shall be imposed for each such conviction.

When a violation of any subsection of this section involves an offense committed against a person under 18 years of age, the violation shall constitute an aggravating circumstance to be considered by the court when determining the appropriate sentence to be imposed.

(cf: P.L. 2003, c.39, s.3)

2. (New section) Any person who violates the provisions of section 4 of P.L. 1984, c.184 (C.2C:20-25) by acquiring, obtaining, taking or copying personal identifying information and sells or distributes such personal identifying information to another or uses such personal identifying information in the commission of another crime commits a crime of the third degree.

3. This act shall take effect immediately.

STATEMENT

This bill amends N.J.S.A. 2C:20-25, to provide that a person commits the crime of computer criminal activity if the person knowingly and without authorization, or in excess of authorization accesses or attempts to access any data, data base, computer, computer storage medium, computer program, computer software, computer equipment, computer system or computer network with the intent to defraud, or to obtain personal identifying information, services, property, or money, from the owner of a computer or any third party, by means of a knowing misrepresentation as to the identity or authority of the person requesting the information. This offense is graded as a crime of the third degree which is punishable by up to five years imprisonment, a fine of up to $15,000, or both. The offense is graded as a crime of the second degree if the value of the services, property, personal identifying information, or money obtained or sought to be obtained exceeds $5,000. A crime of the second degree is punishable by up to 10 years imprisonment, a fine of up to $150,000 or both.

Section two of the bill provides that any person who violates the provisions of N.J.S.A. 2C:20-25 by acquiring, obtaining, taking or copying personal identifying information and sells or distributes such personal identifying information to another or uses such personal identifying information in the commission of another crime commits a crime of the third degree.

This bill is based on a recent Virginia enactment relating to computer crimes, VA Code Section 18:2-152.5.1 (Gathering personal information by deception). This practice is known as phishing.