2/14/02 2631s

17apr02...3257h

5/2/02 3773eba

2002 SESSION

02-3101

04/09

SENATE BILL 360-FN

COMMITTEE: Judiciary

AMENDED ANALYSIS

This bill establishes a criminal offense for the introduction of computer contaminants which result in the impairment of computer operations or the loss of property. The bill also revises the definitions relative to computer related offenses.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Explanation: Matter added to current law appears in bold italics.

Matter removed from current law appears [in brackets and struckthrough.]

Matter which is either (a) all new or (b) repealed and reenacted appears in regular type.

2/14/02 2631s

17apr02...3257h

5/2/02 3773eba

02-3101

04/09

STATE OF NEW HAMPSHIRE

In the Year of Our Lord Two Thousand Two

Be it Enacted by the Senate and House of Representatives in General Court convened:

261:1 Computer Crime; Definitions. RSA 638:16 is repealed and reenacted to read as follows:

638:16 Computer Crime; Definitions. For the purpose of this subdivision:

I. "Access" means to instruct, communicate with, store data in, retrieve data from, intercept data from, or otherwise make use of any computer, computer network, computer program, computer software, computer data, or other computer resources.

II. "Authorization" means the express or implied consent given by a person to another to access or use said person's computer, computer network, computer program, computer software, password, identifying code, or personal identification number.

III. "Computer" means an electronic, magnetic, optical, electrochemical, or other high speed data processing device performing logical, arithmetic, or storage functions, and includes any data storage facility or communication facility directly related to or operating in conjunction with such device. The term "computer" includes any connected or directly-related device, equipment, or facility which enables the computer to store, retrieve, or communicate computer programs, computer data, or the results of computer operations to or from a person, another computer, or another device, but such term does not include an automated typewriter or typesetter, a portable hand-held calculator, or other similar device.

IV. "Computer contaminant" means any set of computer instructions that are designed to modify, damage, destroy, record, or transmit information within a computer, computer system, or computer network without the authorization of the owner of the information. They include, but are not limited to, a group of computer instructions commonly called viruses or worms, that are self-replicating or self-propagating and are designed to contaminate other computer programs or computer data, consume computer resources, modify, destroy, record, or transmit data, or in some other fashion usurp the normal operation of the computer, computer program, computer operations, computer services, or computer network.

V. "Computer data" means any representation of knowledge, facts, concepts, instruction, or other information computed, classified, processed, transmitted, received, retrieved, originated, stored, manifested, measured, detected, recorded, reproduced, handled, or utilized by a computer, computer network, computer program, or computer software, and may be in any medium, including, but not limited to, computer print-outs, microfilm, microfiche, magnetic storage media, optical storage media, punch paper tape, or punch cards, or it may be stored internally in read-only memory or random access memory of a computer or any other peripheral device.

VI. "Computer network" means a set of connected devices and communication facilities, including more than one computer, with the capability to transmit computer data among them through such communication facilities.

VII. "Computer operations" means arithmetic, logical, storage, display, monitoring, or retrieval functions or any combination thereof, and includes, but is not limited to, communication with, storage of data in or to, or retrieval of data from any device and the human manual manipulation of electronic magnetic impulses. A "computer operation" for a particular computer shall also mean any function for which that computer was designed.

VIII. "Computer program" means an ordered set of computer data representing instructions or statements, in a form readable by a computer, which controls, directs, or otherwise influences the functioning of a computer or computer network.

IX. "Computer software" means one or more computer programs, existing in any form, or any associated operational procedures, manuals, or other documentation.

X. "Computer services" means computer access time, computer data processing, or computer data storage, and the computer data processed or stored in connection therewith.

XI. "Computer supplies" means punch cards, paper tape, magnetic tape, magnetic disks or diskettes, optical disks or diskettes, disk or diskette packs, paper, microfilm, and any other tangible input, output, or storage medium used in connection with a computer, computer network, computer data, computer software, or computer program.

XII. "Computer resources" includes, but is not limited to, information retrieval, computer data processing, transmission and storage, and any other functions performed, in whole or in part, by the use of a computer, computer network, computer software, or computer program.

XIII. "Financial instrument" includes, but is not limited to, any check, draft, warrant, money order, note, certificate of deposit, letter of credit, bill of exchange, credit or debit card, transaction authorization mechanism, marketable security, or any computerized representation thereof.

XIV. "Owner" means any person who owns or leases or is a licensee of a computer, computer network, computer data, computer program, computer software, computer resources, or computer supplies.

XV. "Person" means any natural person, general partnership, limited partnership, trust, association, corporation, joint venture, or any state, county, or municipal government and any subdivision, branch, department, or agency thereof.

XVI. "Property" includes:

(a) Real property;

(b) Computers and computer networks;

(c) Financial instruments, computer data, computer programs, computer software and all other personal property regardless of whether they are:

(1) Tangible or intangible;

(2) In a format readable by humans or by a computer;

(3) In transit between computers or within a computer network or between any devices which comprise a computer; or

(4) Located on any paper or in any device on which it is stored by a computer or by a human; and

(d) Computer services.

261:2 Computer Crime Penalties; Computer Contaminants. Amend RSA 638:17 to read as follows:

638:17 Computer Related Offenses.

I. A person is guilty of the computer crime of unauthorized access to a computer [system] or computer network when, knowing that [he] the person is not authorized to do so, he or she knowingly accesses or causes to be accessed any computer [system] or computer network without authorization. It shall be an affirmative defense to a prosecution for unauthorized access to a computer [system] or computer network that:

(a) The person reasonably believed that the owner of the computer [system] or computer network, or a person empowered to license access thereto, had authorized him or her to access; or

(b) The person reasonably believed that the owner of the computer [system] or computer network, or a person empowered to license access thereto, would have authorized [him] the person to access without payment of any consideration; or

(c) The person reasonably could not have known that his or her access was unauthorized.

II. A person is guilty of the computer crime of theft of computer services when he or she knowingly accesses or causes to be accessed or otherwise uses or causes to be used a computer [system] or computer network with the purpose of obtaining unauthorized computer services.

III. A person is guilty of the computer crime of interruption of computer services when [he] the person, without authorization, knowingly or recklessly disrupts or degrades or causes the disruption or degradation of computer services or denies or causes the denial of computer services to an authorized user of a computer [system] or computer network.

IV. A person is guilty of the computer crime of misuse of computer [system] or computer network information when:

(a) As a result of his or her accessing or causing to be accessed a computer [system] or computer network, [he] the person knowingly makes or causes to be made an unauthorized display, use, disclosure, or copy, in any form, of data residing in, communicated by, or produced by a computer [system] or computer network; or

(b) [He] The person knowingly or recklessly and without authorization:

(1) Alters, deletes, tampers with, damages, destroys, or takes data intended for use by a computer [system] or computer network, whether residing within or external to a computer [system] or computer network; or

(2) Intercepts or adds to data residing within a computer [system] or computer network; or

(c) [He] The person knowingly receives or retains data obtained in violation of subparagraph (a) or (b) of this paragraph; or

(d) [He] The person knowingly uses or discloses any data he or she knows or believes was obtained in violation of subparagraph (a) or (b) of this paragraph.

V. A person is guilty of the computer crime of destruction of computer equipment when he or she, without authorization, knowingly or recklessly tampers with, takes, transfers, conceals, alters, damages, or destroys any equipment used in a computer [system] or computer network, or knowingly or recklessly causes any of the foregoing to occur.

VI. A person is guilty of the computer crime of computer contamination if such person knowingly introduces, or causes to be introduced, a computer contaminant into any computer, computer program, or computer network which results in a loss of property or computer services.

(Approved: May 18, 2002)

(Effective Date: January 1, 2003)