AN ACT Relating to cybercrime; amending RCW 9.94A.515; reenacting and amending RCW 9A.52.010; adding a new chapter to Title 9A RCW; creating new sections; repealing RCW 9A.52.110, 9A.52.120, and 9A.52.130; and prescribing penalties.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:

The legislature intends to strike a balance between public safety and civil liberties in the digital world, including creating sufficient space for white hat security research and whistleblowers. The state whistleblower and public record laws prevent this act from being used to hide any deleterious actions by government officials under the guise of security. Furthermore, this act is not intended to criminalize activity solely on the basis that it violates any terms of service.

The purpose of the Washington cybercrime act is to provide prosecutors the twenty-first century tools they need to combat twenty-first century crimes.

NEW SECTION.  Sec. 3.  The definitions in this section apply throughout this chapter unless the context clearly requires otherwise.

(1) "Access" means to gain entry to, instruct, communicate with, store data in, retrieve data from, or otherwise make use of any resources of electronic data, data network, or data system, including via electronic means.

(2) "Cybercrime" includes crimes of this chapter.

(3) "Data" means a digital representation of information, knowledge, facts, concepts, data software, data programs, or instructions that are being prepared or have been prepared in a formalized manner and are intended for use in a data network, data program, data services, or data system.

(4) "Data network" means any system that provides digital communications between one or more data systems or other digital input/output devices including, but not limited to, display terminals, remote systems, mobile devices, and printers.

(5) "Data program" means an ordered set of electronic data representing coded instructions or statements that when executed by a computer causes the device to process electronic data.

(6) "Data services" includes data processing, storage functions, internet services, email services, electronic message services, web site access, internet-based electronic gaming services, and other similar system, network, or internet-based services.

(7) "Data system" means an electronic device or collection of electronic devices, including support devices one or more of which contain data programs, input data, and output data, and that performs functions including, but not limited to, logic, arithmetic, data storage and retrieval, communication, and control. This term does not include calculators that are not programmable and incapable of being used in conjunction with external files.

(8) "Identifying information" means information that, alone or in combination, is linked or linkable to a trusted entity that would be reasonably expected to request or provide credentials to access a targeted data system or network. It includes, but is not limited to, recognizable names, addresses, telephone numbers, logos, HTML links, email addresses, registered domain names, reserved IP addresses, usernames, social media profiles, cryptographic keys, and biometric identifiers.

(9) "Malware" means any set of data instructions that are designed, without authorization and with malicious intent, to disrupt computer operations, gather sensitive information, or gain access to private computer systems. "Malware" does not include software that installs security updates, removes malware, or causes unintentional harm due to some deficiency. It includes, but is not limited to, a group of data instructions commonly called viruses or worms, that are self-replicating or self-propagating and are designed to infect other data programs or data, consume data resources, modify, destroy, record, or transmit data, or in some other fashion usurp the normal operation of the data, data system, or data network.

(10) "White hat security research" means accessing a data program, service, or system solely for purposes of good faith testing, investigation, identification, and/or correction of a security flaw or vulnerability, where such activity is carried out, and where the information derived from the activity is used, primarily to promote security or safety.

(11) "Without authorization" means to knowingly circumvent technological access barriers to a data system in order to obtain information without the express or implied permission of the owner, where such technological access measures are specifically designed to exclude or prevent unauthorized individuals from obtaining such information, but does not include white hat security research or circumventing a technological measure that does not effectively control access to a computer. The term "without the express or implied permission" does not include access in violation of a duty, agreement, or contractual obligation, such as an acceptable use policy or terms of service agreement, with an internet service provider, internet web site, or employer. The term "circumvent technological access barriers" may include unauthorized elevation of privileges, such as allowing a normal user to execute code as administrator, or allowing a remote person without any privileges to run code.

(a) The access is made with the intent to commit another crime in violation of a state law not included in this chapter; or

(b) The violation involves a computer or database maintained by a government agency.

(2) Computer trespass in the first degree is a class C felony.

(2) Computer trespass in the second degree is a gross misdemeanor.

(2) Electronic data service interference is a class C felony.

(2) Spoofing is a gross misdemeanor.

(a)(i) Alters data as it transmits between two data systems over an open or unsecure network; or

(ii) Introduces any malware into any electronic data, data system, or data network; and

(b)(i) Doing so is for the purpose of devising or executing any scheme to defraud, deceive, or extort, or commit any other crime in violation of a state law not included in this chapter, or of wrongfully controlling, gaining access to, or obtaining money, property, or electronic data; or

(ii) The electronic data, data system, or data network is maintained by a governmental agency.

(2) Electronic data tampering in the first degree is a class C felony.

(a) Alters data as it transmits between two data systems over an open or unsecure network under circumstances not constituting the offense in the first degree; or

(b) Introduces any malware into any electronic data, data system, or data network under circumstances not constituting the offense in the first degree.

(2) Electronic data tampering in the second degree is a gross misdemeanor.

NEW SECTION.  Sec. 10.  (1) A person is guilty of electronic data theft if he or she intentionally, without authorization, and without reasonable grounds to believe that he or she has such authorization, obtains any electronic data with the intent to:

(a) Devise or execute any scheme to defraud, deceive, extort, or commit any other crime in violation of a state law not included in this chapter; or

(b) Wrongfully control, gain access to, or obtain money, property, or electronic data.

(2) Electronic data theft is a class C felony.

Sec. 12.  RCW 9A.52.010 and 2011 c 336 s 369 are each reenacted and amended to read as follows:

The following definitions apply in this chapter:

(1) (("Access" means to approach, instruct, communicate with, store data in, retrieve data from, or otherwise make use of any resources of a computer, directly or by electronic means.

(4))) "Enter." The word "enter" when constituting an element or part of a crime, shall include the entrance of the person, or the insertion of any part of his or her body, or any instrument or weapon held in his or her hand and used or intended to be used to threaten or intimidate a person or to detach or remove property((;)).

(((5))) (2) "Enters or remains unlawfully." A person "enters or remains unlawfully" in or upon premises when he or she is not then licensed, invited, or otherwise privileged to so enter or remain.

A license or privilege to enter or remain in a building which is only partly open to the public is not a license or privilege to enter or remain in that part of a building which is not open to the public. A person who enters or remains upon unimproved and apparently unused land, which is neither fenced nor otherwise enclosed in a manner designed to exclude intruders, does so with license and privilege unless notice against trespass is personally communicated to him or her by the owner of the land or some other authorized person, or unless notice is given by posting in a conspicuous manner. Land that is used for commercial aquaculture or for growing an agricultural crop or crops, other than timber, is not unimproved and apparently unused land if a crop or any other sign of cultivation is clearly visible or if notice is given by posting in a conspicuous manner. Similarly, a field fenced in any manner is not unimproved and apparently unused land. A license or privilege to enter or remain on improved and apparently used land that is open to the public at particular times, which is neither fenced nor otherwise enclosed in a manner to exclude intruders, is not a license or privilege to enter or remain on the land at other times if notice of prohibited times of entry is posted in a conspicuous manner.

(((6))) (3) "Premises" includes any building, dwelling, structure used for commercial aquaculture, or any real property.

Sec. 13.  RCW 9.94A.515 and 2015 c 261 s 11 are each amended to read as follows:

(1) RCW 9A.52.110 (Computer trespass in the first degree) and 1984 c 273 s 1;

(2) RCW 9A.52.120 (Computer trespass in the second degree) and 1984 c 273 s 2; and

(3) RCW 9A.52.130 (Computer trespass—Commission of other crime) and 1984 c 273 s 3.

--- END ---