Texas 2009 - 81st Regular

Texas Senate Bill SB28 Compare Versions

The same version is selected twice. Please select two different versions to compare.

Version 1 (Old)

Version 2 (New)

Old	New	Differences
1	1	S.B. No. 28
2	2
3	3
4	4	AN ACT
5	5	relating to the use of a computer for an unauthorized purpose;
6	6	providing a civil penalty.
7	7	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
8	8	SECTION 1. Section 324.002, Business & Commerce Code, as
9	9	effective April 1, 2009, is amended by adding Subdivisions (1-a)
10	10	and (9) to read as follows:
11	11	(1-a) "Botnet" means a collection of two or more
12	12	zombies.
13	13	(9) "Zombie" means a computer that, without the
14	14	knowledge and consent of the computer's owner or operator, has been
15	15	compromised to give access or control to a program or person other
16	16	than the computer's owner or operator.
17	17	SECTION 2. Subsection (a), Section 324.003, Business &
18	18	Commerce Code, as effective April 1, 2009, is amended to read as
19	19	follows:
20	20	(a) Section 324.052, other than Subdivision (1) of that
21	21	section, and Sections 324.053(4), [and] 324.054, and 324.055 do not
22	22	apply to a telecommunications carrier, cable operator, computer
23	23	hardware or software provider, or provider of information service
24	24	or interactive computer service that monitors or has interaction
25	25	with a subscriber's Internet or other network connection or service
26	26	or a protected computer for:
27	27	(1) a network or computer security purpose;
28	28	(2) diagnostics, technical support, or a repair
29	29	purpose;
30	30	(3) an authorized update of computer software or
31	31	system firmware;
32	32	(4) authorized remote system management; or
33	33	(5) detection or prevention of unauthorized use of or
34	34	fraudulent or other illegal activity in connection with a network,
35	35	service, or computer software, including scanning for and removing
36	36	software proscribed under this chapter.
37	37	SECTION 3. Section 324.005, Business & Commerce Code, as
38	38	effective April 1, 2009, is amended to read as follows:
39	39	Sec. 324.005. KNOWING VIOLATION. A person knowingly
40	40	violates Section 324.051, 324.052, [or] 324.053, or 324.055 if the
41	41	person:
42	42	(1) acts with actual knowledge of the facts that
43	43	constitute the violation; or
44	44	(2) consciously avoids information that would
45	45	establish actual knowledge of those facts.
46	46	SECTION 4. Subchapter B, Chapter 324, Business & Commerce
47	47	Code, as effective April 1, 2009, is amended by adding Section
48	48	324.055 to read as follows:
49	49	Sec. 324.055. UNAUTHORIZED CREATION OF, ACCESS TO, OR USE
50	50	OF ZOMBIES OR BOTNETS; PRIVATE ACTION. (a) In this section:
51	51	(1) "Internet service provider" means a person
52	52	providing connectivity to the Internet or another wide area
53	53	network.
54	54	(2) "Person" has the meaning assigned by Section
55	55	311.005, Government Code.
56	56	(b) A person who is not the owner or operator of the computer
57	57	may not knowingly cause or offer to cause a computer to become a
58	58	zombie or part of a botnet.
59	59	(c) A person may not knowingly create, have created, use, or
60	60	offer to use a zombie or botnet to:
61	61	(1) send an unsolicited commercial electronic mail
62	62	message, as defined by Section 321.001;
63	63	(2) send a signal to a computer system or network that
64	64	causes a loss of service to users;
65	65	(3) send data from a computer without authorization by
66	66	the owner or operator of the computer;
67	67	(4) forward computer software designed to damage or
68	68	disrupt another computer or system;
69	69	(5) collect personally identifiable information; or
70	70	(6) perform an act for another purpose not authorized
71	71	by the owner or operator of the computer.
72	72	(d) A person may not:
73	73	(1) purchase, rent, or otherwise gain control of a
74	74	zombie or botnet created by another person; or
75	75	(2) sell, lease, offer for sale or lease, or otherwise
76	76	provide to another person access to or use of a zombie or botnet.
77	77	(e) The following persons may bring a civil action against a
78	78	person who violates this section:
79	79	(1) a person who is acting as an Internet service
80	80	provider and whose network is used to commit a violation under this
81	81	section; or
82	82	(2) a person who has incurred a loss or disruption of
83	83	the conduct of the person's business, including for-profit or
84	84	not-for-profit activities, as a result of the violation.
85	85	(f) A person bringing an action under this section may, for
86	86	each violation:
87	87	(1) seek injunctive relief to restrain a violator from
88	88	continuing the violation;
89	89	(2) subject to Subsection (g), recover damages in an
90	90	amount equal to the greater of:
91	91	(A) actual damages arising from the violation; or
92	92	(B) $100,000 for each zombie used to commit the
93	93	violation; or
94	94	(3) obtain both injunctive relief and damages.
95	95	(g) The court may increase an award of damages, statutory or
96	96	otherwise, in an action brought under this section to an amount not
97	97	to exceed three times the applicable damages if the court finds that
98	98	the violations have occurred with such a frequency as to constitute
99	99	a pattern or practice.
100	100	(h) A plaintiff who prevails in an action brought under this
101	101	section is entitled to recover court costs and reasonable
102	102	attorney's fees, reasonable fees of experts, and other reasonable
103	103	costs of litigation.
104	104	(i) A remedy authorized by this section is not exclusive but
105	105	is in addition to any other procedure or remedy provided for by
106	106	other statutory or common law.
107	107	(j) Nothing in this section may be construed to impose
108	108	liability on the following persons with respect to a violation of
109	109	this section committed by another person:
110	110	(1) an Internet service provider;
111	111	(2) a provider of interactive computer service, as
112	112	defined by Section 230, Communications Act of 1934 (47 U.S.C.
113	113	Section 230);
114	114	(3) a telecommunications provider, as defined by
115	115	Section 51.002, Utilities Code; or
116	116	(4) a video service provider or cable service
117	117	provider, as defined by Section 66.002, Utilities Code.
118	118	SECTION 5. Subsection (a), Section 324.101, Business &
119	119	Commerce Code, as effective April 1, 2009, is amended to read as
120	120	follows:
121	121	(a) Any of the following persons, if adversely affected by
122	122	the violation, may bring a civil action against a person who
123	123	violates Section 324.051, 324.052, 324.053, or 324.054 [this
124	124	chapter]:
125	125	(1) a provider of computer software;
126	126	(2) an owner of a web page or trademark;
127	127	(3) a telecommunications carrier;
128	128	(4) a cable operator; or
129	129	(5) an Internet service provider.
130	130	SECTION 6. The changes in law made by this Act apply only to
131	131	conduct that occurs on or after the effective date of this Act.
132	132	Conduct that occurs before the effective date of this Act is
133	133	governed by the law in effect at the time the conduct occurred, and
134	134	that law is continued in effect for that purpose.
135	135	SECTION 7. This Act takes effect September 1, 2009.
136	136	______________________________ ______________________________
137	137	President of the Senate Speaker of the House
138	138	I hereby certify that S.B. No. 28 passed the Senate on
139	139	April 14, 2009, by the following vote: Yeas 30, Nays 0; and that
140	140	the Senate concurred in House amendments on May 28, 2009, by the
141	141	following vote: Yeas 31, Nays 0.
142	142	______________________________
143	143	Secretary of the Senate
144	144	I hereby certify that S.B. No. 28 passed the House, with
145	145	amendments, on May 19, 2009, by the following vote: Yeas 143,
146	146	Nays 0, two present not voting.
147	147	______________________________
148	148	Chief Clerk of the House
149	149	Approved:
150	150	______________________________
151	151	Date
152	152	______________________________
153	153	Governor