California Unauthorized Access To Computers, Computer Systems and Computer Data

502

(a) It is the intent of the Legislature in enacting this section to expand the degree of protection afforded to individuals, businesses, and governmental agencies from tampering, interference, damage, and unauthorized access to lawfully created computer data and computer systems. The Legislature finds and declares that the proliferation of computer technology has resulted in a concomitant proliferation of computer crime and other forms of unauthorized access to computers, computer systems, and computer data. The Legislature further finds and declares that protection of the integrity of all types and forms of lawfully created computers, computer systems, and computer data is vital to the protection of the privacy of individuals as well as to the well-being of financial institutions, business concerns, governmental agencies, and others within this state that lawfully utilize those computers, computer systems, and data.

(b) For the purposes of this section, the following terms have the following meanings:

(1) “Access” means to gain entry to, instruct, or communicate with the logical, arithmetical, or memory function resources of a computer, computer system, or computer network.

(2) “Computer network” means any system which provides communications between one or more computer systems and input/output devices including, but not limited to, display terminals and printers connected by telecommunication facilities.

(3) “Computer program or software” means a set of instructions or statements, and related data, that when executed in actual or modified form, cause a computer, computer system, or computer network to perform specified functions.

(4) “Computer services” includes, but is not limited to, computer time, data processing, or storage functions, or other uses of a computer, computer system, or computer network.

(5) “Computer system” means a device or collection of devices, including support devices and excluding calculators which are not programmable and capable of being used in conjunction with external files, one or more of which contain computer programs, electronic instructions, input data, and output data, that performs functions including, but not limited to, logic, arithmetic, data storage and retrieval, communication, and control.

(6) “Data” means a representation of information, knowledge, facts, concepts, computer software, computer programs or instructions. Data may be in any form, in storage media, or as stored in the memory of the computer or in transit or presented on a display device.

(7) “Supporting documentation” includes, but is not limited to, all information, in any form, pertaining to the design, construction, classification, implementation, use, or modification of a computer, computer system, computer network, computer program, or computer software, which information is not generally available to the public and is necessary for the operation of a computer, computer system, computer network, computer program, or computer software.

(8) “Injury” means any alteration, deletion, damage, or destruction of a computer system, computer network, computer program, or data caused by the access.

(9) “Victim expenditure” means any expenditure reasonably and necessarily incurred by the owner or lessee to verify that a computer system, computer network, computer program, or data was or was not altered, deleted, damaged, or destroyed by the access.

(10) “Computer contaminant” means any set of computer instructions that are designed to modify, damage, destroy, record, or transmit information within a computer, computer system, or computer network without the intent or permission of the owner of the information. They include, but are not limited to, a group of computer instructions commonly called viruses or worms, which are self-replicating or self-propagating and are designed to contaminate other computer programs or computer data, consume computer resources, modify, destroy, record, or transmit data, or in some other fashion usurp the normal operation of the computer, computer system, or computer network.

(c) Except as provided in subdivision (h), any person who commits any of the following acts is guilty of a public offense:

(1) Knowingly accesses and without permission alters, damages, deletes, destroys, or otherwise uses any data, computer, computer system, or computer network in order to either (A) devise or execute any scheme or artifice to defraud, deceive, or extort, or (B) wrongfully control or obtain money, property, or data.

(2) Knowingly accesses and without permission takes, copies, or makes use of any data from a computer, computer system, or computer network, or takes or copies any supporting documentation, whether existing or residing internal or external to a computer, computer system, or computer network.

(3) Knowingly and without permission uses or causes to be used computer services.

(4) Knowingly accesses and without permission adds, alters, damages, deletes, or destroys any data, computer software, or computer programs which reside or exist internal or external to a computer, computer system, or computer network.

(5) Knowingly and without permission disrupts or causes the disruption of computer services or denies or causes the denial of computer services to an authorized user of a computer, computer system, or computer network.

(6) Knowingly and without permission provides or assists in providing a means of accessing a computer, computer system, or computer network in violation of this section.

(7) Knowingly and without permission accesses or causes to be accessed any computer, computer system, or computer network.

(8) Knowingly introduces any computer contaminant into any computer, computer system, or computer network.

(d) (1) Any person who violates any of the provisions of paragraph (1), (2), (4), or (5) of subdivision (c) is punishable by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment in the state prison for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in the county jail not exceeding one year, or by both that fine and imprisonment.

(2) Any person who violates paragraph (3) of subdivision (c) is punishable as follows:

(A) For the first violation which does not result in injury, and where the value of the computer services used does not exceed four hundred dollars ($400), by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in the county jail not exceeding one year, or by both that fine and imprisonment.

(B) For any violation which results in a victim expenditure in an amount greater than five thousand dollars ($5,000) or in an injury, or if the value of the computer services used exceeds four hundred dollars ($400), or for any second or subsequent violation, by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment in the state prison for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in the county jail not exceeding one year, or by both that fine and imprisonment.

(3) Any person who violates paragraph (6), (7), or (8) of subdivision (c) is punishable as follows:

(A) For a first violation which does not result in injury, an infraction punishable by a fine not exceeding two hundred fifty dollars ($250).

(B) For any violation which results in a victim expenditure in an amount not greater than five thousand dollars ($5,000), or for a second or subsequent violation, by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in the county jail not exceeding one year, or by both that fine and imprisonment.

(C) For any violation which results in a victim expenditure in an amount greater than five thousand dollars ($5,000), by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment in the state prison for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in the county jail not exceeding one year, or by both that fine and imprisonment.

(e) (1) In addition to any other civil remedy available, the owner or lessee of the computer, computer system, computer network, computer program, or data may bring a civil action against any person convicted under this section for compensatory damages, including any expenditure reasonably and necessarily incurred by the owner or lessee to verify that a computer system, computer network, computer program, or data was or was not altered, damaged, or deleted by the access. For the purposes of actions authorized by this subdivision, the conduct of an unemancipated minor shall be imputed to the parent or legal guardian having control or custody of the minor, pursuant to the provisions of Section 1714.1 of the Civil Code.

(2) In any action brought pursuant to this subdivision the court may award reasonable attorney’s fees to a prevailing party.

(3) A community college, state university, or academic institution accredited in this state is required to include computer-related crimes as a specific violation of college or university student conduct policies and regulations that may subject a student to disciplinary sanctions up to and including dismissal from the academic institution. This paragraph shall not apply to the University of California unless the Board of Regents adopts a resolution to that effect.

(f) This section shall not be construed to preclude the applicability of any other provision of the criminal law of this state which applies or may apply to any transaction, nor shall it make illegal any employee labor relations activities that are within the scope and protection of state or federal labor laws.

(g) Any computer, computer system, computer network, or any software or data, owned by the defendant, which is used during the commission of any public offense described in subdivision (c) or any computer, owned by the defendant, which is used as a repository for the storage of software or data illegally obtained in violation of subdivision (c) shall be subject to forfeiture, as specified in Section 502.01.

(h) (1) Subdivision (c) does not apply to any person who accesses his or her employer’s computer system, computer network, computer program, or data when acting within the scope of his or her lawful employment.

(2) Paragraph (3) of subdivision (c) does not apply to any employee who accesses or uses his or her employer’s computer system, computer network, computer program, or data when acting outside the scope of his or her lawful employment, so long as the employee’s activities do not cause an injury, as defined in paragraph (8) of subdivision (b), to the employer or another, or so long as the value of supplies and computer services, as defined in paragraph (4) of subdivision (b), which are used do not exceed an accumulated total of one hundred dollars ($100).

(i) No activity exempted from prosecution under paragraph (2) of subdivision (h) which incidentally violates paragraph (2), (4), or (7) of subdivision (c) shall be prosecuted under those paragraphs.

(j) For purposes of bringing a civil or a criminal action under this section, a person who causes, by any means, the access of a computer, computer system, or computer network in one jurisdiction from another jurisdiction is deemed to have personally accessed the computer, computer system, or computer network in each jurisdiction.

(k) In determining the terms and conditions applicable to a person convicted of a violation of this section the court shall consider the following:

(1) The court shall consider prohibitions on access to and use of computers.

(2) Except as otherwise required by law, the court shall consider alternate sentencing, including community service, if the defendant shows remorse and recognition of the wrongdoing, and an inclination not to repeat the offense.

502.01.

(a) As used in this section:

(1) “Property subject to forfeiture” means any property of the defendant that is a computer, computer system, or computer network, and any software or data residing thereon, if the computer, computer system, or computer network was used in committing a violation of subdivision (c) of Section 502 or violation of Section 502.7 or was used as a repository for the storage of software or data obtained in violation of those provisions. If the defendant is a minor, it also includes property of the parent or guardian of the defendant.

(2) “Sentencing court” means the court sentencing a person found guilty of violating subdivision (c) of Section 502 or a violation of Section 502.7 or, in the case of a minor found to be a person described in Section 602 of the Welfare and Institutions Code because of a violation of those provisions, the juvenile court.

(3) “Interest” means any property interest in the property subject to forfeiture.

(4) “Security interest” means an interest that is a lien, mortgage, security interest, or interest under a conditional sales contract.

(b) The sentencing court shall, upon petition by the prosecuting attorney, at any time following sentencing, or by agreement of all parties, at the time of sentencing, conduct a hearing to determine whether any property or property interest is subject to forfeiture under this section. At the forfeiture hearing, the prosecuting attorney shall have the burden of establishing, by a preponderance of the evidence, that the property or property interests are subject to forfeiture. The prosecuting attorney may retain seized property that may be subject to forfeiture until the sentencing hearing.

(c) Prior to the commencement of a forfeiture proceeding, the law enforcement agency seizing the property subject to forfeiture shall make an investigation as to any person other than the defendant who may have an interest in it. At least 30 days before the hearing to determine whether the property should be forfeited, the prosecuting agency shall send notice of the hearing to any person who may have an interest in the property that arose before the seizure. A person claiming an interest in the property shall file a motion for the redemption of that interest at least 10 days before the hearing on forfeiture, and a copy of the motion to the prosecuting agency and to the probation department. If a motion to redeem an interest has been filed, the sentencing court shall hold a hearing to identify all persons who possess valid interests in the property. No person shall hold a valid interest in the property if, by a preponderance of the evidence, the prosecuting agency shows that the person knew or should have known that the property was being used in violation of subdivision (c) of Section 502 or Section 502.7, and that the person did not take reasonable steps to prevent that use, or if the interest is a security interest, the person knew or should have known at the time that the security interest was created that the property would be used for such a violation.

(d) If the sentencing court finds that a person holds a valid interest in the property, the following provisions shall apply:

(1) The court shall determine the value of the property.

(2) The court shall determine the value of each valid interest in the property.

(3) If the value of the property is greater than the value of the interest, the holder of the interest shall be entitled to ownership of the property upon paying the court the difference between the value of the property and the value of the valid interest. If the holder of the interest declines to pay the amount determined under paragraph (2), the court may order the property sold and designate the prosecutor or any other agency to sell the property. The designated agency shall be entitled to seize the property and the holder of the interest shall forward any documentation underlying the interest, including any ownership certificates for that property, to the designated agency. The designated agency shall sell the property and pay the owner of the interest the proceeds, up to the value of that interest.

(4) If the value of the property is less than the value of the interest, the designated agency shall sell the property and pay the owner of the interest the proceeds, up to the value of that interest.

(e) If the defendant was a minor at the time of the offense, this subdivision shall apply to property subject to forfeiture that is the property of the parent or guardian of the minor.

(1) The prosecuting agency shall notify the parent or guardian of the forfeiture hearing at least 30 days before the date set for the hearing.

(2) The computer shall not be subject to forfeiture if the parent or guardian files a signed statement with the court at least 10 days before the date set for the hearing that the minor shall not have access to any computer owned by the agent or guardian for two years after the date on which the minor is sentenced.

(3) If the minor is convicted of a violation of subdivision (c) of Section 502 or Section 502.7 within two years after the date on which the minor is sentenced, and the violation involves a computer owned by the parent or guardian, the original property subject to forfeiture, and the property involved in the new offense, shall be subject to forfeiture notwithstanding paragraph (2).

(f) If the defendant is found to have the only valid interest in the property subject to forfeiture, it shall be distributed as follows:

(1) First, to the victim, if the victim elects to take the property as full or partial restitution for injury, victim expenditures, or compensatory damages, as defined in paragraph (1) of subdivision (e) of Section 502. If the victim elects to receive the property under this paragraph, the value of the property shall be determined by the court and that amount shall be credited against the restitution owed by the defendant. The victim shall not be penalized for electing not to accept the forfeited property in lieu of full or partial restitution.

(2) Second, at the discretion of the court, to one or more of the following agencies or entities:

(A) The prosecuting agency.

(B) The public entity of which the prosecuting agency is a part.

(C) The public entity whose officers or employees conducted the investigation resulting in forfeiture.

(D) Other state and local public entities, including school districts.

(E) Nonprofit charitable organizations.

(g) If the property is to be sold, the court may designate the prosecuting agency or any other agency to sell the property at auction. The proceeds of the sale shall be distributed by the court as follows:

(1) To the bona fide or innocent purchaser or encumbrancer, conditional sales vendor, or mortgagee of the property up to the amount of his or her interest in the property, if the court orders a distribution to that person.

(2) The balance, if any, to be retained by the court, subject to the provisions for distribution under subdivision (f).

502.5.

Every person who, after mortgaging or encumbering by deed of trust any real property, and during the existence of such mortgage or deed of trust, or after such mortgaged or encumbered property shall have been sold under an order and decree of foreclosure or at trustee’s sale, and with intent to defraud or injure the mortgagee or the beneficiary or trustee, under such deed of trust, his representatives, successors or assigns, or the purchaser of such mortgaged or encumbered premises at such foreclosure or trustee’s sale, his representatives, successors or assigns, takes, removes or carries away from such mortgaged or encumbered premises, or otherwise disposes of or permits the taking, removal or carrying away or otherwise disposing of any house, barn, windmill, water tank, pump, engine or other part of the freehold that is attached or affixed to such premises as an improvement thereon, without the written consent of the mortgagee or beneficiary, under deed of trust, his representatives, successors or assigns, or the purchaser at such foreclosure or trustee’s sale, his representatives, successors or assigns, is guilty of larceny and shall be punished accordingly.

502.7

(a) Any person who, knowingly, willfully, and with intent to defraud a person providing telephone or telegraph service, avoids or attempts to avoid, or aids, abets or causes another to avoid the lawful charge, in whole or in part, for telephone or telegraph service by any of the following means is guilty of a misdemeanor or a felony, except as provided in subdivision (g):

(1) By charging the service to an existing telephone number or credit card number without the authority of the subscriber thereto or the lawful holder thereof.

(2) By charging the service to a nonexistent telephone number or credit card number, or to a number associated with telephone service which is suspended or terminated, or to a revoked or canceled (as distinguished from expired) credit card number, notice of the suspension, termination, revocation, or cancellation of the telephone service or credit card having been given to the subscriber thereto or the holder thereof.

(3) By use of a code, prearranged scheme, or other similar stratagem or device whereby the person, in effect, sends or receives information.

(4) By rearranging, tampering with, or making connection with telephone or telegraph facilities or equipment, whether physically, electrically, acoustically, inductively, or otherwise, or by using telephone or telegraph service with knowledge or reason to believe that the rearrangement, tampering, or connection existed at the time of the use.

(5) By using any other deception, false pretense, trick, scheme, device, conspiracy, or means, including the fraudulent use of false, altered, or stolen identification.

(b) Any person who does either of the following is guilty of a misdemeanor or a felony, except as provided in subdivision (g):

(1) Makes, possesses, sells, gives, or otherwise transfers to another, or offers or advertises any instrument, apparatus, or device with intent to use it or with knowledge or reason to believe it is intended to be used to avoid any lawful telephone or telegraph toll charge or to conceal the existence or place of origin or destination of any telephone or telegraph message.

(2) Sells, gives, or otherwise transfers to another or offers, or advertises plans or instructions for making or assembling an instrument, apparatus, or device described in paragraph (1) of this subdivision with knowledge or reason to believe that they may be used to make or assemble the instrument, apparatus, or device.

(c) Any person who publishes the number or code of an existing, canceled, revoked, expired, or nonexistent credit card, or the numbering or coding which is employed in the issuance of credit cards, with the intent that it be used or with knowledge or reason to believe that it will be used to avoid the payment of any lawful telephone or telegraph toll charge is guilty of a misdemeanor. Subdivision (g) shall not apply to this subdivision. As used in this section, “publishes” means the communication of information to any one or more persons, either orally, in person or by telephone, radio, or television, or electronic means, including, but not limited to, a bulletin board system, or in a writing of any kind, including without limitation a letter or memorandum, circular or handbill, newspaper, or magazine article, or book.

(d) Any person who is the issuee of a calling card, credit card, calling code, or any other means or device for the legal use of telecommunications services and who receives anything of value for knowingly allowing another person to use the means or device in order to fraudulently obtain telecommunications services is guilty of a misdemeanor or a felony, except as provided in subdivision (g).

(e) Subdivision (a) applies when the telephone or telegraph communication involved either originates or terminates, or both originates and terminates, in this state, or when the charges for service would have been billable, in normal course, by a person providing telephone or telegraph service in this state, but for the fact that the charge for service was avoided, or attempted to be avoided, by one or more of the means set forth in subdivision (a).

(f) Jurisdiction of an offense under this section is in the jurisdictional territory where the telephone call or telegram involved in the offense originates or where it terminates, or the jurisdictional territory to which the bill for the service is sent or would have been sent but for the fact that the service was obtained or attempted to be obtained by one or more of the means set forth in subdivision (a).

(g) Theft of any telephone or telegraph services under this section by a person who has a prior misdemeanor or felony conviction for theft of services under this section within the past five years, is a felony.

(h) Any person or telephone company defrauded by any acts prohibited under this section shall be entitled to restitution for the entire amount of the charges avoided from any person or persons convicted under this section.

(i) Any instrument, apparatus, device, plans, instructions, or written publication described in subdivision (b) or (c) may be seized under warrant or incident to a lawful arrest, and, upon the conviction of a person for a violation of subdivision (a), (b), or (c), the instrument, apparatus, device, plans, instructions, or written publication may be destroyed as contraband by the sheriff of the county in which the person was convicted or turned over to the person providing telephone or telegraph service in the territory in which it was seized.

(j) Any computer, computer system, computer network, or any software or data, owned by the defendant, which is used during the commission of any public offense described in this section or anycomputer, owned by the defendant, which is used as a repository for the storage of software or data illegally obtained in violation of this section shall be subject to forfeiture.

502.8

(a) Any person who uses a telecommunications device intending to avoid the payment of any lawful charge for service to the device is guilty of a misdemeanor.

(b) Any person found guilty of violating subdivision (a), who has previously been convicted of the same offense, shall be guilty of a felony, punishable by imprisonment in state prison, a fine of up to fifty thousand dollars ($50,000), or both.

(c) Any person who possesses a telecommunications device with intent to sell or offer to sell to another, intending to avoid the payment of any lawful charge for service to the device is guilty of a misdemeanor punishable by one year in a county jail or imprisonment in state prison or a fine of up to ten thousand dollars ($10,000), or both.

(d) Any person who possesses 10 or more telecommunications devices with intent to sell or offer to sell to another, intending to avoid payment of any lawful charge for service to the device, is guilty of a felony, punishable by imprisonment in state prison, a fine of up to fifty thousand dollars ($50,000), or both.

(e) Any person who manufactures 10 or more telecommunications devices and intends to sell them to others intending to avoid the payment of any lawful charge for service to the device is guilty of a felony punishable by imprisonment in state prison or a fine of up to fifty thousand dollars ($50,000), or both.

(f) For purposes of this section a telecommunications device is any type of instrument, device, machine, or equipment that is designed for or capable of transmitting or receiving wireless communications within the radio spectrum allocated to cellular radio telephony.

If you are accused of a cybercrime, you need experienced and competent legal representation. A cybercrime defense lawyer with our firm can assist you.