SB-0054, As Passed Senate, March 9, 2005

SUBSTITUTE FOR

SENATE BILL NO. 54

(As amended, March 8, 2005)

     A bill to amend 1979 PA 53, entitled

"An act to prohibit access to computers, computer systems, and

computer networks for certain fraudulent purposes; to prohibit

intentional and unauthorized access, alteration, damage, and

destruction of computers, computer systems, computer networks,

computer software programs, and data; to prohibit the sending of

certain electronic messages; and to prescribe penalties,"

by amending section 7 (MCL 752.797), as amended by 2000 PA 180, and

by adding section 5b.

THE PEOPLE OF THE STATE OF MICHIGAN ENACT:

Sec. 5b. (1) A person shall not <<

>> do any of the following:

     (a) <<INTENTIONALLY AND WITHOUT AUTHORIZATION>> install

or attempt to install spyware into a computer,

computer program, computer system, or computer network belonging to

another person.

     (b) <<INTENTIONALLY AND WITHOUT AUTHORIZATION>> USE or attempt

to use spyware that has been installed into

a computer, computer program, computer system, or computer network

Senate Bill No. 54 as amended March 8, 2005

belonging to another person.

     (c) Manufacture, sell, or possess spyware with the intent that

it be used to violate this act.

     (2) This section does not prohibit the person from being

charged with, convicted of, or sentenced for any other violation of

law arising out of the violation of this section.

     (3) As used in this section:

     (a) "Authorized user" means the owner of a computer, computer

program, computer system, or computer network or a person

authorized by the owner or the lessee to use the computer, computer

program, computer system, or computer network.

     (b) "Cookie" means a nonexecutable text or data file that is

used by, or placed on, the computer, computer program, computer

system, or computer network, by an internet service provider,

interactive computer service, or internet website, to return

information to that provider, service, or website, or to any device

such as a web beacon to facilitate the use of the computer,

computer program, computer system, or computer network by an

authorized user.

     (c) "Deceptively" means to knowingly do any of the following

with the intent to deceive or when unrelated to an authorized use:

     (i) Make a materially false statement or pretense.

     (ii) Omit material information regarding a use or conceal the

existence or purpose from an authorized user.

     (d) "Install" means to attach or insert computer instructions

or a computer program.

     <<(E) "INTERNET" MEANS THAT TERM AS DEFINED IN 47 USC 230.>>

<<(F)>> Except as provided in subsection (4), "spyware" means

computer instructions or a computer program that deceptively

monitors, collects, copies, or transfers copies of or is

deceptively installed to monitor, collect, copy, or transfer copies

of, data or information from or information regarding the use of a

computer, computer program, computer system, or computer network,

including any of the following:

     (i) Keystrokes made by an authorized user.

     (ii) Websites visited by an authorized user, other than

websites of the provider of the software or the originating website

location or uniform resource locator automatically sent to the

destination website when an authorized user changes websites.

     (iii) Other data or information contained on the computer,

computer system, or computer network, such as personally

identifiable files on a hard drive.

     (4) Spyware does not include any of the following:

     (a) Conduct by a person acting pursuant to a valid legal

process within the scope of his or her legal authority.

     (b) A cookie.

     (c) Any of the following:

     (i) Monitoring of, or interaction with, an authorized user's

internet or other network or connection service, or computer by a

telecommunications carrier, cable operator, computer hardware or

software provider, provider of information service, or interactive

computer service.

     (ii) For network or computer security purposes, diagnostics,

technical support, repair, authorized updates of software, or

system firmware.

     (iii) Authorized remote system management.

     (iv) Detection or prevention of the unauthorized use of, or

fraudulent or other illegal activities in connection with, a

network, service, or computer software, including scanning for and

removing software with the reasonable belief that it was installed

in violation of this section.

     Sec. 7. (1) A person who violates section 4 is guilty of a

crime as follows:

     (a) If the violation involves an aggregate amount of less than

$200.00, the person is guilty of a misdemeanor punishable by

imprisonment for not more than 93 days or a fine of not more than

$500.00 or 3 times the aggregate amount, whichever is greater, or

both imprisonment and a fine.

     (b) If any of the following apply, the person is guilty of a

misdemeanor punishable by imprisonment for not more than 1 year or

a fine of not more than $2,000.00 or 3 times the aggregate amount,

whichever is greater, or both imprisonment and a fine:

     (i) The violation involves an aggregate amount of $200.00 or

more but less than $1,000.00.

     (ii) The person violates this act and has a prior conviction.

     (c) If any of the following apply, the person is guilty of a

felony punishable by imprisonment for not more than 5 years or a

fine of not more than $10,000.00 or 3 times the aggregate amount,

whichever is greater, or both imprisonment and a fine:

     (i) The violation involves an aggregate amount of $1,000.00 or

more but less than $20,000.00.

     (ii) The person has 2 prior convictions.

     (d) If any of the following apply, the person is guilty of a

felony punishable by imprisonment for not more than 10 years or a

fine of not more than 3 times the aggregate amount, or both

imprisonment and a fine:

     (i) The violation involves an aggregate amount of $20,000.00 or

more.

     (ii) The person has 3 or more prior convictions.

     (2) A person who violates section 5 or 5b is guilty of a crime

as follows:

     (a) Except as provided in subdivision (b), the person is

guilty of a felony punishable by imprisonment for not more than 5

years or a fine of not more than $10,000.00, or both.

     (b) If the person has a prior conviction, the person is guilty

of a felony punishable by imprisonment for not more than 10 years

or a fine of not more than $50,000.00, or both.

     (3) A person who violates section 6 is guilty of a crime as

follows:

     (a) If the underlying crime is a misdemeanor or a felony with

a maximum term of imprisonment of 1 year or less, the person is

guilty of a misdemeanor punishable by imprisonment for not more

than 1 year or a fine of not more than $5,000.00, or both.

     (b) If the underlying crime is a misdemeanor or a felony with

a maximum term of imprisonment of more than 1 year but less than 2

years, the person is guilty of a felony punishable by imprisonment

for not more than 2 years or a fine of not more than $5,000.00, or

both.

     (c) If the underlying crime is a misdemeanor or a felony with

a maximum term of imprisonment of 2 years or more but less than 4

years, the person is guilty of a felony punishable by imprisonment

for not more than 4 years or a fine of not more than $5,000.00, or

both.

     (d) If the underlying crime is a felony with a maximum term of

imprisonment of 4 years or more but less than 10 years, the person

is guilty of a felony punishable by imprisonment for not more than

7 years or a fine of not more than $5,000.00, or both.

     (e) If the underlying crime is a felony punishable by a

maximum term of imprisonment of 10 years or more but less than 20

years, the person is guilty of a felony punishable by imprisonment

for not more than 10 years or a fine of not more than $10,000.00,

or both.

     (f) If the underlying crime is a felony punishable by a

maximum term of imprisonment of 20 years or more or for life, the

person is guilty of a felony punishable by imprisonment for not

more than 20 years or a fine of not more than $20,000.00, or both.

     (4) The court may order that a term of imprisonment imposed

under subsection (3) be served consecutively to any term of

imprisonment imposed for conviction of the underlying offense.

     (5) If the prosecuting attorney intends to seek an enhanced

sentence under section 4 or section 5 based upon the defendant

having a prior conviction, the prosecuting attorney shall include

on the complaint and information a statement listing that prior

conviction. The existence of the defendant's prior conviction shall

be determined by the court, without a jury, at sentencing. The

existence of a prior conviction may be established by any evidence

relevant for that purpose, including, but not limited to, 1 or more

of the following:

     (a) A copy of the judgment of conviction.

     (b) A transcript of a prior trial, plea-taking, or sentencing.

     (c) Information contained in a presentence report.

     (d) The defendant's statement.

     (6) It is a rebuttable presumption in a prosecution for a

violation of section 5 that the person did not have authorization

from the owner, system operator, or other person who has authority

from the owner or system operator to grant permission to access the

computer program, computer, computer system, or computer network or

has exceeded authorization unless 1 or more of the following

circumstances existed at the time of access:

     (a) Written or oral permission was granted by the owner,

system operator, or other person who has authority from the owner

or system operator to grant permission of the accessed computer

program, computer, computer system, or computer network.

     (b) The accessed computer program, computer, computer system,

or computer network had a pre-programmed access procedure that

would display a bulletin, command, or other message before access

was achieved that a reasonable person would believe identified the

computer program, computer, computer system, or computer network as

within the public domain.

     (c) Access was achieved without the use of a set of

instructions, code, or computer program that bypasses, defrauds, or

otherwise circumvents the pre-programmed access procedure for the

computer program, computer, computer system, or computer network.

     (7) The court may order a person convicted of violating this

act to reimburse this state or a local unit of government of this

state for expenses incurred in relation to the violation in the

same manner that expenses may be ordered to be reimbursed under

section 1f of chapter IX of the code of criminal procedure, 1927 PA

175, MCL 769.1f.

     (8) As used in this section, "prior conviction" means a

violation or attempted violation of section 145d of the Michigan

penal code, 1931 PA 328, MCL 750.145d, or this act or a

substantially similar law of the United States, another state, or a

political subdivision of another state.