------------------------------ Date: August 15, 1990 From: Moderators Subject: Proposed changees in Computer Abuse Act (S.2476) ******************************************************************** *** CuD #2.01: File 2 of 6: Computer Abuse Act Amendment *** ******************************************************************** +++++++++++++++++++++++++ Proposed amendments in the computer abuse act, reported previously in CuD, do not seem to go far enough in removing the ambiguity from the language of the Act that currently gives broad powers to federal agents to target those they perceive as "dangerous" who in fact may not be. Following is the text of the revision. We invite responses (moderators). ++++++++++++++++++++++++ ******************************************************************* The following is the text of S.2476, a bill proposed to amend Title 18. For more information, contact: Committee on the Judiciary United States Senate Washington, DC 20510-6275 A summary of the changes follows the text of the bill. ******************************************************************* 101st CONGRESS 2D Session S.2476 To amend title 18 of the United States Code to clarify and expand legal prohibitions against computer abuse ------------------------------------ IN THE SENATE OF THE UNITED STATES April 19 (legislative day, April 18), 1990 Mr. Leahy (for himself, Mr. Humphrey, and Mr. Kohl) introduced the following bill; which was read twice and referred to the Committee on the Judiciary ------------------------------------ A BILL To amend title 18 of the United States Code to clarify and expand legal prohibitions against computer abuse. 1 Be it enacted by the Senate and House of Representa- 2 tives of the United States of America in Congress assembled, 3 SECTION 1. SHORT TITLE. 4 This Act may be cited as the "Computer Abuse Amend- 5 mends Act of 1990". 6 SEC.2. FINDINGS. 7 The Congress finds that-- 8 (1) the maintenance of the security and integrity 9 computer systems has become increasingly critical to 10 national security, interstate and foreign commerce, - 2 - 1 communications, education, science, and technology in 2 the United States; 3 (2) the deliberate abuse of computers and comput- 4 er systems to cause damage, disruption, and interfer- 5 ence with the efficient functioning of computer systems 6 has created significant problems for both government 7 and nongovernment computer systems, and such abuse 8 creates real and potential problems for national securi- 9 ty, commerce, business, science, and education, and 10 imposes significant burdens on interstate and foreign 11 commerce; 12 (3) in light of rapid developments in computer 13 technology, it is necessary to revise and clarify existing 14 Federal laws governing computer security and abuse to 15 assure that novel forms of serious computer abuse are 16 clearly prohibited; and 17 (4) it is the intent of this Act to exercise the full 18 scope of the powers of Congress under the Commerce 19 Clause of the United States Constitution to regulate 20 forms of computer abuse which arise in connection 21 with, and have a significant effect upon, interstate or 22 foreign commerce. - 3 - 1 SEC.3. AMENDMENTS TO THE COMPUTER FRAUD AND ABUSE 2 ACT. 3 (a) PROHIBITION.--Section 1030)(a)(5) of title 18, 4 United States Code, is amended to read as follows: 5 "(5)(A) through means of or in a manner affecting 6 a computer used in interstate commerce or communica- 7 tions, knowingly causes the transmission of a program, 8 information, code, or command to a computer or 9 a computer system if the person causing the transmission 10 intends that such program, information, code or 11 command will damage, disrupt, alter, destroy, or mis- 12 appropriate the functioning, use, programs, systems, 13 databases, or other information of or contained in the 14 affected computer or computer system and the trans- 15 mission of the harmful component of the program, 16 information, code, or command-- 17 "(i) occured without the knowledge and au- 18 thorization of the persons or entities who own or 19 are responsible for the computer system receiving 20 the program, information, code, or command; and 21 "(ii)(I) causes loss or damage to one or more 22 other persons of a value aggregating $1,000 or 23 more during any one-year period; or 24 "(II) modifies or impairs, or potentially modi- 25 fies or impairs, the medical examination, medical - 4 - 1 diagnosis, medical treatment, or medical care of 2 one or more individuals; or 3 "(B) through means of or in a manner affecting a 4 computer used in interstate commerce or communica- 5 tions, knowingly causes the transmission of a program, 6 information, code or command to a computer or com- 7 puter system if the person caused the transmission with 8 reckless disregard for whether the transmission will 9 damage, disrupt, alter, destroy or misappropriate the 10 functioning, use programs, systems, databases, or other 11 information of or contained in the affected computer or 12 computer system and the transmission of the harmful 13 component of the program, information, code, or com- 14 mand-- 15 "(i) occured without the knowledge and au- 16 thorization of the persons or entities who own or 17 are responsible for the computer system receiving 18 the program, information, code, or command; and 19 "(ii)(I) causes loss or damage to one or more 20 other persons of a value aggregating $1,000 or 21 more during any one-year period; or 22 "(II) modifies or impairs, or potentially modi- 23 fies or impairs, the medical examination, medical 24 diagnosis, medical treatment, or medical care of 25 one or more individuals; or". - 5 - 1 (b) PENALTY.--Section 1030(c) of title 18, United 2States Code is amended-- 3 (1) by striking "and" after the semicolon at the 4 end of paragraph (2)(B); 5 (2) in paragraph (3)(A) by inserting "(A)" after 6 "(a)(5)"; and 7 (3) in paragraph (3)(B) by striking the period at 8 the end thereof and inserting "; and"; and 9 (4) inserting at the end thereof the following: 10 "(4) a fine under this title or imprisonment for not 11 more than 1 year, or both, in the case of an offense 12 under subsection (a)(5)(B).". 13 (c) DEFINITION.--Section 1030(e) of title 18, United 14States Code, is amended-- 15 (1) in paragraph (6), by striking "and" after the 16 semicolon; 17 (2) in paragraph (7), by striking the period and in- 18 serting "; and"; 19 (3) by adding after paragraph (7) the following 20 new paragraph: 21 "(8) the term 'access' means-- 22 "(A) to gain access to the stored or displayed 23 information or to the functions of a computer or 24 computer system in such a way that infor- - 6 - 1 mation can be seen or otherwise deciphered or 2 such functions can be performed; or 3 "(B) to transmit, or cause the transmission 4 of, a program, information, code, or command to a 5 computer or computer system under circumstances 6 where the person causing the transmission in- 7 tends, or reasonably expects, that such program, 8 information, or command will significantly 9 damage, disrupt, alter, destroy, or misappropriate 10 the functioning, use, programs, systems, data- 11 bases, or other information of or contained in that 12 computer or computer systems, whether or not 13 the persons causing th transmission gains access 14 in the manner described in subparagraph (A).". 15 (d) CIVIL ACTION.--Section 1 3 of title 18, United 16 States Code, is amended by adding at the end thereof the 17 following new subsection: 18 "(g) Any person who suffers damage or loss by reason 19 of a violation of this section may maintain a civil action against 20 the violator to obtain compensatory damages and injunctive 21 relief or other equitable relief.". <> ******************************************************************** SUMMARY OF LEAHY/HUMPHREY COMPUTER ABUSE AMENDMENTS ACT OF 1990 (Provided by Senator Leahy's office) ******************************************************************** NEW CRIME Makes it a felony intentionally to cause harm to a computer or the information stored in it by transmitting a computer program or code (including computer viruses) without the knowledge and authorization of the person responsible for the computer attacked. Makes it a misdemeanor recklessly to cause harm to a computer or the information stored in it by transmitting a computer program or code (including computer viruses) without the knowledge and authorization of the person responsible for the computer attacked. JURISDICTION Covers harm to any computer or program that involves $1,000 worth of damage or tampering with medical records. PENALTY Find and/or imprisonment for up to five years for the felony. Fine and/or imprisonment for up to one yer for the misdemeanor. CIVIL CAUSE OF ACTION Creates a new, civil cause of action for those harmed by a violation of the Act for compensatory or injunctive relief. DEFINITION OF "ACCESS" Defines "access" -- a term used throughout the Computer Fraud and Abuse Ace -- to cover the remote transmission of a program to affect a computer or the information stored in it. *************************************************************************** >> END OF THIS FILE << ***************************************************************************