SB3440 102ND GENERAL ASSEMBLY

LRB102 21323 RLC 30435 b

102ND GENERAL ASSEMBLY
State of Illinois
2021 and 2022
SB3440

Introduced 1/18/2022, by Sen. John Connor

SYNOPSIS AS INTRODUCED:

720 ILCS 5/17-51	was 720 ILCS 5/16D-3
720 ILCS 5/17-52	was 720 ILCS 5/16D-4

Amends the Criminal Code of 2012. Provides that a person also commits computer tampering when he or she knowingly and without the authorization of a computer's owner or in excess of the authority granted to him or her intentionally introduces ransomware onto a computer, computer system, or computer network. Provides that a violation is a Class 4 felony for a first offense and a Class 3 felony for a second or subsequent offense. Provides that a person also commits aggravated computer tampering when he or she commits computer tampering (rather than computer tampering by accessing or causing to be accessed a computer or any part thereof, a computer network, or a program or data, and damaging or destroying the computer or altering, deleting, or removing a computer program or data) and he or she knowingly causes disruption of or interference with vital services or operations of a health care provider or creates a probability of death or bodily harm to one or more individuals (rather than creates a strong probability of death or great bodily harm to one or more individuals). Defines "ransomware", "health care provider", and "health care facility".

CORRECTIONAL BUDGET AND IMPACT NOTE ACT MAY APPLY

A BILL FOR

AN ACT concerning criminal law.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 5. The Criminal Code of 2012 is amended by changing Sections 17-51 and 17-52 as follows:

(720 ILCS 5/17-51) (was 720 ILCS 5/16D-3)

Sec. 17-51. Computer tampering.

(a) A person commits computer tampering when he or she knowingly and without the authorization of a computer's owner or in excess of the authority granted to him or her:

(1) Accesses or causes to be accessed a computer or any part thereof, a computer network, or a program or data;

(2) Accesses or causes to be accessed a computer or any part thereof, a computer network, or a program or data, and obtains data or services;

(3) Accesses or causes to be accessed a computer or any part thereof, a computer network, or a program or data, and damages or destroys the computer or alters, deletes, or removes a computer program or data;

(4) Inserts or attempts to insert a program into a computer or computer program knowing or having reason to know that such program contains information or commands that will or may:

(A) damage or destroy that computer, or any other computer subsequently accessing or being accessed by that computer;

(B) alter, delete, or remove a computer program or data from that computer, or any other computer program or data in a computer subsequently accessing or being accessed by that computer; or

(C) cause loss to the users of that computer or the users of a computer which accesses or which is accessed by such program; or

(5) Falsifies or forges electronic mail transmission information or other routing information in any manner in connection with the transmission of unsolicited bulk electronic mail through or into the computer network of an electronic mail service provider or its subscribers; or .

(6) Intentionally introduces ransomware onto a computer, computer system, or computer network.

(a-5) Distributing software to falsify routing information. It is unlawful for any person knowingly to sell, give, or otherwise distribute or possess with the intent to sell, give, or distribute software which:

(1) is primarily designed or produced for the purpose of facilitating or enabling the falsification of electronic mail transmission information or other routing information;

(2) has only a limited commercially significant purpose or use other than to facilitate or enable the falsification of electronic mail transmission information or other routing information; or

(3) is marketed by that person or another acting in concert with that person with that person's knowledge for use in facilitating or enabling the falsification of electronic mail transmission information or other routing information.

(a-10) For purposes of subsection (a), accessing a computer network is deemed to be with the authorization of a computer's owner if:

(1) the owner authorizes patrons, customers, or guests to access the computer network and the person accessing the computer network is an authorized patron, customer, or guest and complies with all terms or conditions for use of the computer network that are imposed by the owner;

(2) the owner authorizes the public to access the computer network and the person accessing the computer network complies with all terms or conditions for use of the computer network that are imposed by the owner; or

(3) the person accesses the computer network in compliance with the Revised Uniform Fiduciary Access to Digital Assets Act (2015).

(b) Sentence.

(1) A person who commits computer tampering as set forth in subdivision (a)(1) or (a)(5) or subsection (a-5) of this Section is guilty of a Class B misdemeanor.

(2) A person who commits computer tampering as set forth in subdivision (a)(2) of this Section is guilty of a Class A misdemeanor and a Class 4 felony for the second or subsequent offense.

(3) A person who commits computer tampering as set forth in subdivision (a)(3), or (a)(4), or (a)(6) of this Section is guilty of a Class 4 felony and a Class 3 felony for the second or subsequent offense.

(4) If an injury arises from the transmission of unsolicited bulk electronic mail, the injured person, other than an electronic mail service provider, may also recover attorney's fees and costs, and may elect, in lieu of actual damages, to recover the lesser of $10 for each unsolicited bulk electronic mail message transmitted in violation of this Section, or $25,000 per day. The injured person shall not have a cause of action against the electronic mail service provider that merely transmits the unsolicited bulk electronic mail over its computer network.

(5) If an injury arises from the transmission of unsolicited bulk electronic mail, an injured electronic mail service provider may also recover attorney's fees and costs, and may elect, in lieu of actual damages, to recover the greater of $10 for each unsolicited electronic mail advertisement transmitted in violation of this Section, or $25,000 per day.

(6) The provisions of this Section shall not be construed to limit any person's right to pursue any additional civil remedy otherwise allowed by law.

(c) Whoever suffers loss by reason of a violation of subdivision (a)(4) of this Section may, in a civil action against the violator, obtain appropriate relief. In a civil action under this Section, the court may award to the prevailing party reasonable attorney's fees and other litigation expenses.

(d) As used in this Section, "ransomware" means a computer contaminant or lock that restricts access by an unauthorized person to a computer, computer system, or computer network or any data in a computer, computer system, or computer network under circumstances in which a person demands money, property, or a service to remove the computer contaminant or lock, restore access to the computer, computer system, computer network, or data, or otherwise remediate the impact of the computer contaminant or lock.

(Source: P.A. 99-775, eff. 8-12-16.)

(720 ILCS 5/17-52) (was 720 ILCS 5/16D-4)

Sec. 17-52. Aggravated computer tampering.

(a) A person commits aggravated computer tampering when he or she commits computer tampering as set forth in subsection (a) paragraph (a)(3) of Section 17-51 and he or she knowingly:

(1) causes disruption of or interference with vital services or operations of State or local government, or a public utility,or a health care provider; or

(2) creates a strong probability of death or great bodily harm to one or more individuals.

(b) Sentence.

(1) A person who commits aggravated computer tampering as set forth in paragraph (a)(1) of this Section is guilty of a Class 3 felony.

(2) A person who commits aggravated computer tampering as set forth in paragraph (a)(2) of this Section is guilty of a Class 2 felony.

(c) In this Section:

"Health care facility" means a type of health care provider commonly known by a wide variety of titles, including, but not limited to, a hospital, medical center, nursing home, rehabilitation center, long term or tertiary care facility, physician office, or other facility established to administer health care in its ordinary course of business or practice.

"Health care provider" means a person who is licensed, certified, or otherwise authorized or permitted by the law of this State to administer health care in the ordinary course of business or practice of a profession, including, but not limited to, a physician, nurse, health care facility, or any employee, officer, director, agent, or person under contract with such a person.

(Source: P.A. 96-1551, eff. 7-1-11.)