By: Zaffirini S.B. No. 1009

A BILL TO BE ENTITLED

AN ACT

relating to the use of a computer for an unauthorized purpose.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:

SECTION 1. Section 48.002, Business & Commerce Code, as added by Chapter 298, Acts of the 79th Legislature, Regular Session, 2005, is amended by adding Subdivisions (1-a) and (10) to read as follows:

(1-a) "Botnet" means a collection of zombies.

(10) "Zombie" means a computer that, without the knowledge and consent of the computer's owner or operator, has been compromised to give access or control to a program or person other than the computer's owner or operator.

SECTION 2. Section 48.054, Business & Commerce Code, as added by Chapter 298, Acts of the 79th Legislature, Regular Session, 2005, is amended to read as follows:

Sec. 48.054. KNOWING VIOLATION. A person knowingly violates Section 48.051, 48.052, [or] 48.053, or 48.057 if the person:

(1) acts with actual knowledge of the facts that constitute the violation; or

(2) consciously avoids information that would establish actual knowledge of those facts.

SECTION 3. Subchapter B, Chapter 48, Business & Commerce Code, as added by Chapter 298, Acts of the 79th Legislature, Regular Session, 2005, is amended by adding Section 48.057 to read as follows:

Sec. 48.057. UNAUTHORIZED CREATION OR USE OF ZOMBIES OR BOTNETS. (a) If a person is not the owner or operator of the computer, the person may not knowingly cause or offer to cause the computer to become a zombie or part of a botnet.

(b) A person may not knowingly create, have created, use, or offer to use a zombie or botnet:

(1) to send an unsolicited commercial electronic mail message, as defined by Section 46.001;

(2) for an attack on a computer system or network that causes a loss of service to users;

(3) to artificially add increments to a click counter by automatically clicking on an advertisement on an Internet website;

(4) to forward computer software designed to damage or disrupt another computer or system;

(5) to collect personally identifiable information;

(6) to manipulate online polls or games; or

(7) for another purpose not authorized by the owner or operator of the computer.

(c) A person may not:

(1) purchase, rent, or otherwise gain control of a zombie or botnet created by another person; or

(2) sell, lease, offer for sale or lease, or otherwise provide to another person access to or use of a zombie or botnet.

(d) A person may not provide substantial assistance or support to another person knowing that the other person is engaged in an act or practice that violates this section.

(e) The following persons may bring a civil action against a person who violates this section:

(1) a person in business as an Internet service provider that is adversely affected by the violation;

(2) a business organization that has incurred a loss or disruption of its business activities as a result of the violation; or

(3) the attorney general.

(f) A person bringing an action under this section may:

(1) seek injunctive relief to restrain the violator from continuing the violation;

(2) recover damages in an amount equal to the greater of:

(A) actual damages arising from the violation;

(B) $500,000 for each violation consisting of the same course of conduct or action, regardless of the number of times the conduct or act occurred; or

(C) $100,000 for each zombie used to commit the violation; or

(3) both seek injunctive relief and recover damages as provided by this subsection.

(g) The court may increase an award of damages, statutory or otherwise, in an action brought under this section to an amount not to exceed three times the applicable damages if the court finds that the violations have occurred with a frequency as to constitute a pattern or practice.

(h) A plaintiff who prevails in an action filed under this section is entitled to recover court costs and reasonable attorney's fees, reasonable fees of experts, and other reasonable costs of litigation.

(i) The remedies authorized by this section are not exclusive but are in addition to any other procedure or remedy provided for by other statutory or common law.

SECTION 4. Subsection (a), Section 48.101, Business & Commerce Code, as added by Chapter 298, Acts of the 79th Legislature, Regular Session, 2005, is amended to read as follows:

(a) The following persons, if adversely affected by the violation, may bring a civil action against a person who violates this chapter other than Section 48.057:

(1) a provider of computer software;

(2) an owner of a web page or trademark;

(3) a telecommunications carrier;

(4) a cable operator; or

(5) an Internet service provider.

SECTION 5. The changes in law made by this Act apply only to conduct that occurs on or after the effective date of this Act. Conduct that occurs before the effective date of this Act is governed by the law in effect at the time the conduct occurred, and that law is continued in effect for that purpose.

SECTION 6. This Act takes effect September 1, 2007.

COMMITTEE AMENDMENT NO. 1

Amend S.B. No. 1009 (Senate engrossment) by adding the following appropriately numbered SECTION to the bill and renumbering subsequent SECTIONS accordingly:

SECTION ___. Subsection (a), Section 48.003, Business & Commerce Code, as added by Chapter 298, Acts of the 79th Legislature, Regular Session, 2005, is amended to read as follows:

(a) Section 48.052, other than Subdivision (1) of that section, and Sections 48.053(4), [and] 48.055, and 48.057 do not apply to a telecommunications carrier, cable operator, computer hardware or software provider, or provider of information service or interactive computer service that monitors or has interaction with a subscriber's Internet or other network connection or service or a protected computer for:

(1) network or computer security purposes;

(2) diagnostics, technical support, or repair purposes;

(3) authorized updates of computer software or system firmware;

(4) authorized remote system management; or

(5) detection or prevention of unauthorized use of or fraudulent or other illegal activities in connection with a network, service, or computer software, including scanning for and removing software proscribed under this chapter. 80R19158 CLG-FZedler

COMMITTEE AMENDMENT NO. 2

Amend S.B. No. 1009 (senate engrossment) in SECTION 3 of the bill, in proposed Paragraph (B), Subdivision (2), Subsection (f), Section 48.057, Business & Commerce Code (page 3, line 17), strike "$500,000" and substitute "$100,000". 80R19312 CLG-FDarby