By: West S.B. No. 1477
A BILL TO BE ENTITLED
AN ACT
relating to ransomware; creating a criminal offense.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
SECTION 1. Chapter 33, Penal Code, is amended by adding
Section 33.023 to read as follows:
Sec. 33.023. RANSOMWARE ATTACK AND EXTORTION. (a) In this
section:
(1) "Privileged information" means:
(A) protected health information, as that term is
defined by Section 182.002, Health and Safety Code;
(B) information that is subject to the
attorney-client privilege; or
(C) information that is subject to the
accountant-client privilege under Section 901.457, Occupations
Code, or other law, if the information is on a computer, computer
network, or computer system owned by a person possessing a license
issued under Subchapter H, Chapter 901, Occupations Code.
(2) "Ransomware" means computer software that:
(A) is introduced onto a computer, computer
network, or computer system; and
(B) prevents the owner of the computer, computer
network, or computer system, or another person with the effective
consent of the owner, from accessing information on that computer,
computer network, or computer system.
(b) A person commits an offense if the person intentionally:
(1) introduces ransomware or causes ransomware to be
introduced onto a computer, computer network, or computer system
without the effective consent of the owner; and
(2) demands payment or other consideration to:
(A) remove the ransomware;
(B) restore the owner's access to the computer,
computer network, or computer system; or
(C) otherwise mitigate the effects of the
ransomware.
(c) Except as provided by Subsection (d), an offense under
this section is:
(1) a Class C misdemeanor if the value of the payment
or other consideration demanded is less than $100 or cannot be
determined;
(2) a Class B misdemeanor if the value of the payment
or other consideration demanded is $100 or more but less than $750;
(3) a Class A misdemeanor if the value of the payment
or other consideration demanded is $750 or more but less than
$2,500;
(4) a state jail felony if the value of the payment or
other consideration demanded is $2,500 or more but less than
$30,000;
(5) a felony of the third degree if the value of the
payment or other consideration demanded is $30,000 or more but less
than $150,000;
(6) a felony of the second degree if the value of the
payment or other consideration demanded is $150,000 or more but
less than $300,000; and
(7) a felony of the first degree if the value of the
payment or other consideration demanded is $300,000 or more.
(d) If it is shown on the trial of the offense that the
defendant knowingly restricted a victim's access to privileged
information, an offense under this section is:
(1) a state jail felony if the value of the payment or
other consideration demanded is less than $2,500;
(2) a felony of the third degree if:
(A) the value of the payment or other
consideration demanded is $2,500 or more but less than $30,000; or
(B) a client or patient of a victim suffered harm
attributable to the offense;
(3) a felony of the second degree if:
(A) the value of the payment or other
consideration demanded is $30,000 or more but less than $150,000;
or
(B) a client or patient of a victim suffered
bodily injury attributable to the offense; and
(4) a felony of the first degree if:
(A) the value of the payment or other
consideration demanded is $150,000 or more; or
(B) a client or patient of a victim suffered
serious bodily injury or death attributable to the offense.
(e) A person who is subject to prosecution under this
section and any other section of this code may be prosecuted under
either section or both sections.
(f) For purposes of calculating the value of the payment or
other consideration under Subsection (c) or (d), the exchange rate
between a foreign currency and the United States dollar is
established at the earlier of:
(1) the date the demand was made, if known; or
(2) the date the victim became aware of the demand.
SECTION 2. The change in law made by this Act applies only
to an offense committed on or after the effective date of this Act.
An offense committed before the effective date of this Act is
governed by the law in effect on the date the offense was committed,
and the former law is continued in effect for that purpose. For
purposes of this section, an offense was committed before the
effective date of this Act if any element of the offense occurred
before that date.
SECTION 3. This Act takes effect September 1, 2017.