SPYWARE: CRIMINAL PENALTIES S.B. 53 & 54: COMMITTEE SUMMARY






Senate Bills 53 and 54 (as introduced 1-25-05)
Sponsor: Senator Cameron S. Brown
Committee: Technology and Energy


Date Completed: 2-14-05

CONTENT Senate Bill 54 would amend Public Act 53 of 1979, which prohibits fraudulent access to computers, computer systems, and computer networks, to prohibit a person from installing or attempting to install spyware on another person's computer without permission, and prescribe penalties for a violation.


Senate Bill 53 would amend the Code of Criminal Procedure to add violations of Senate Bill 54 to the sentencing guidelines.

Senate Bill 53 is tie-barred to Senate Bill 54. The bills are described below in further detail.

Senate Bill 54

Prohibited Activity


 The bill would prohibit a person from installing or attempting to install spyware into a computer program, computer, computer system, or computer network belonging to another person unless all of the following applied:

-- The person provided his or her name and business address and a valid telephone number, e-mail address, or internet service provider (ISP) address where he or she could be reached, or, if the spyware were to be installed on behalf of another person, where that other person could be reached.
-- The person provided specific notice of the intent to install the spyware.
-- If applicable, the person specifically stated that a fee was to be charged or could be incurred and the amount of the fee.
-- If applicable, the person specifically stated the information that was to be obtained from the computer program, computer, computer system, or computer network.
-- If applicable, a statement that sexually explicit material would be displayed.
-- The owner or person responsible for maintaining the computer program, computer, computer system, or computer network affirmatively granted the right to install the spyware.


The notice of intent to install spyware would have to include a statement that instructions or software would be downloaded into the computer program, computer, computer system, or computer network, and how the instructions or software were intended to affect the operation of the program, computer, system, or network. The notice also would have to provide a method by which the owner or person responsible for maintaining the computer
program, computer, computer system, or computer network could refuse installation and require that no further contact be made regarding the installation of spyware.


If the right to install spyware were authorized, the person installing the spyware could not exceed the nature or the scope of the authorization granted. A person could not contact subsequently a person who informed him or her that no further contact was to be made.


The bill also would prohibit a person from manufacturing, creating, distributing, or possessing spyware to be used in violation of the bill's provisions.


Penalties

 A person who violated the bill would be guilty of a misdemeanor punishable by imprisonment for up to 93 days and/or a maximum fine of $1,000. If the violation caused interruption of or interference to the use of the computer program, computer, computer system, or computer network, the person would be guilty of a felony punishable by imprisonment for up to two years and/or a maximum fine of $5,000. If a person had a prior conviction, he or she would be guilty of a felony punishable by imprisonment for up to four years and/or a maximum fine of $10,000.


Definition of "Spyware"


 Under the bill, "spyware" would mean computer instructions or software installed into a computer program, computer, computer system, or computer network for any of the following purposes:

-- Monitoring the use of a computer program, computer, computer system, or computer network.
-- Sending information about the use of a computer program, computer, computer system, or computer network to a remote computer, server, or data collection site or point.
-- Displaying an advertisement or causing an advertisement to be displayed in response to the use of a computer program, computer, computer system, or computer network.


The term would not include any of the following:

-- Computer instructions or software installed by the manufacturer of the computer program, computer, computer system, or computer network that was intended to facilitate ordinary and expected access to and use of the program, computer, system, or network.
-- Computer instructions or software installed by the owner of a computer program, computer, computer system, or computer network, except as otherwise provided in the bill.
-- Computer instructions or software installed by a person maintaining a computer program, computer, computer system, or computer network on behalf of the owner while acting within the scope of his or her authority.
-- An ISP acting within the scope of its authority.
-- A person authorized by law to conduct criminal investigations while acting within the scope of his or her authority.
-- Instructions commonly known as cookies that were intended solely to facilitate recognition of the computer for internet access or use.

Senate Bill 53

The bill would include felony violations of Senate Bill 54 in the sentencing guidelines. Installation or attempted installation of spyware causing interruption or interference would be a Class G property felony punishable by a maximum of two years' imprisonment. Installation or attempted installation with a prior conviction would be a Class F property felony punishable by imprisonment for up to four years.


MCL 777.17c (S.B. 53) 752.797 et al. (S.B. 54)

BACKGROUND

According to webroot.com, Spyware is any application that may track an individual's online and offline computer activity and is capable of saving that information locally or transmitting it to third parties, often without the user's consent or knowledge.


Spyware can be installed on a person's computer through a pop-up window or advertisement, via an instant messenger service, through a file-sharing program, or through spam e-mail or an attachment in an e-mail.


Some spyware programs enable online companies to track a person's activities on a website and tailor pop-up advertising to the person's choices. Other programs are capable of monitoring the person's keystrokes and online screenshots, revealing personal information such as login names, passwords, and social security, credit card, and bank account numbers.


Legislative Analyst: Julie Koval

FISCAL IMPACT
The bills would have an indeterminate fiscal impact on State and local government. There are no data to indicate how many offenders would be convicted of the proposed crimes. An offender convicted of the Class G offense would receive a sentencing guidelines minimum sentence range of 0-3 months to 7-23 months. An offender convicted of the Class F offense would receive a sentencing guidelines minimum sentence range of 0-3 months to 17-30 months. Local units would incur the costs of misdemeanor probation and incarceration in a local facility, both of which vary by county. The State would incur the cost of felony probation at an average annual cost of $2,000, as well as the cost of incarceration in a State facility at an average annual cost of $28,000.

Fiscal Analyst: Bethany Wicksall

Analysis was prepared by nonpartisan Senate staff for use by the Senate in its deliberations and does not constitute an official statement of legislative intent. sb53&54/0506