House bill NO. 161

P2#yIS1 INTRODUCED BY F. Nave

By Request of the Department of Justice

A BILL FOR AN ACT ENTITLED: "AN ACT GENERALLY REVISING COMPUTER CRIME LAWS; PROVIDING DEFINITIONS; REVISING THE OFFENSE OF UNLAWFUL USE OF A COMPUTER; providing exceptions; and AMENDING SECTIONS 45-6-310 AND 45-6-311, MCA.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MONTANA:

Section 1. Section 45-6-310, MCA, is amended to read:

"45-6-310. Definition Definitions -- computer use. As used in 45-6-311 and this section, the term following definitions apply:

(1) "Access" means to approach, instruct, communicate with, store data in, retrieve data from, or otherwise make use of any resources of a computer, computer system, computer network, or electronic device.

(2) "Authorization" means a process ensuring that correctly authenticated users can access only those resources for which the owner of the resource has given the users explicit permission.

(3) "Computer" means an electronic device used to create, receive, transmit, store, or process data of any kind, or to run programs stored on hardware or software, and includes any device attached physically or connected intangibly to the computer.

(4) "Computer contaminant" means any set of computer instructions designed to modify, damage, destroy, record, or transmit information within a computer, computer system, or computer network without the intent or permission of the owner of the information. The term includes but is not limited to a group of computer instructions, commonly called viruses or worms, that are self-replicating or self-propagating and that are designed to contaminate other computer programs or computer data, consume computer resources, modify destroy, record, or transmit data, or in some other fashion usurp or interfere with the normal operation of the computer, computer system, or computer network.

(5) "Computer credential" means:

(a) a password, token code, or other means of limiting access; or

(b) an account, address, username, handle, avatar, or other digital representation of a person.

(6) "Computer network" means a system that provides a medium for communication between one or more computer systems or electronic devices, including communication with an input or output device such as a display terminal, printer, or any other electronic equipment that is connected to the computer systems or electronic devices by physical or wireless technologies.

(7) "Computer system" means a device or collection of devices, including support or peripheral devices, one or more of which contain computer programs, electronic instructions, or input data and output data, and which perform functions, including but not limited to logic, arithmetic, data storage, data retrieval, data processing, communication, or control.

(8) "Data" means a representation of information, knowledge, facts, concepts, computer software, computer programs, or instructions. Data may be in any form, in storage media or stored in the memory of the computer, or in transit or presented on a display device.

(9) "Electronic device" means a device or a portion of a device that is designed for and capable of communicating across a computer network with other computers or devices for the purpose of transmitting, receiving, or storing data, including but not limited to a cellular telephone, tablet, or other portable device designed for and capable of communicating with or across a computer network and that is actually used for that purpose.

(10) "Encrypt" means the use of any process of data encryption including but not limited to cryptography, enciphering, or encoding of data, programs, information, image, signal, sound, computer, computer networks, or other electronic devices.

(11) "obtain "Obtain the use of" means to instruct, communicate with, store data in, retrieve data from, cause input to, cause output from, or otherwise make use of any resources of a computer, computer system, or computer network or to cause another to instruct, communicate with, store data in, retrieve data from, cause input to, cause output from, or otherwise make use of any resources of a computer, computer system, or computer network.

(12) "Trade secret" has the meaning provided in 30-14-402."

Section 2. Section 45-6-311, MCA, is amended to read:

"45-6-311. Unlawful use of a computer -- exceptions. (1) A Except as provided in subsections (3) (4), (5), and (7), a person commits the offense of unlawful use of a computer if the when the person knowingly or purposely and without authorization:

(a) destroys or renders inoperable a computer, computer system, computer network or any part of a computer system or network with the purpose of making the device or system physically inaccessible or to render the data, programs, or supporting documentation inaccessible or unusable;

(a)(b) obtains the use or access of any computer, computer system, or computer network without consent of the owner;

(b) alters or destroys or causes another to alter or destroy a computer program or computer software without consent of the owner; or

(c) obtains the use of or alters or destroys a computer, computer system, computer network, or any part thereof as part of a deception for the purpose of obtaining money, property, or computer services from the owner of the computer, computer system, computer network, or part thereof or from any other person.

(c) introduces a computer contaminant that deletes, modifies, or renders unavailable data, programs, or supporting documentation residing or existing internal or external to a computer, computer system, computer network, or electronic device;

(d) destroys data, programs, or supporting documentation residing or existing internal or external to a computer, computer system, computer network, or electronic device;

(e) discloses or takes data, programs, or supporting documentation that is a trade secret, confidential, or otherwise protected as provided by law or is data that materially compromises the security, confidentiality, or integrity of personal information as defined in 30-14-1704 residing or existing internal or external to a computer, computer system, computer network, or electronic device;

(f) introduces a computer contaminant to gain access to data, programs, supporting documentation, computer systems, including peripheral devices, or computer networks to delete, encrypt, modify, append, or otherwise render unavailable data, programs, supporting documentation, computer systems, including peripheral devices, computer networks, or electronic devices owned or operated by a governmental or private entity or person;

(g) uses or changes in any way another person's computer credentials without the person's permission; or

(h) uses another person's computer or computer credentials to track that person's movements or monitor that person's communications without that person's consent.

(2) A person convicted of the offense of unlawful use of a computer involving loss of property not exceeding $1,500 in value or when no loss can be articulated shall be fined not to exceed $1,500 or be imprisoned in the county jail for a term not to exceed 6 months, or both. A person convicted of the offense of unlawful use of a computer involving loss of property exceeding $1,500 in value shall be fined not more than 2 1/2 times the value of the property used, altered, destroyed, or obtained or be imprisoned in the state prison for a term not to exceed 10 years, or both.

(3) A person is not in violation of this section if the person encrypts or modifies another person's computer, computer system, electronic device, or computer credentials without permission or consent for the purposes of complying with a court order or a warrant from federal, state, or local law enforcement.

(4) This section does not apply to an individual who modifies, accesses, or destroys the individual's personal computer, computer network, computer system, or electronic device.

(5) A person may not:

(a) encrypt or modify another person's computer, computer system, or electronic device;

(b) restrict access to personal data by any means; or

(6) Except as provided in subsection (5) and (7), a person may enforce the terms of a legal contract between the persons.

(7) A person may only enforce nonpayment under the terms of a legal contract concerning digital software through modification of credentials."