IP: Pennsylvania makes spreading computer viruses criminal

[fast <dfarber () fast net>]

----- Original Message -----
From: "Peter G. Neumann" <neumann () csl sri com>
To: <farber () cis upenn edu>


> Dave, Wearing your Pennsylvania hat, this might be of particular
> interest to you!  It is probably of interest also for IP.  Peter
>
>                 ---------------
>
> Date: Fri, 02 Jun 2000 09:12:22 -0400
> From: "Keith A Rhodes" <rhodesk.aimd () gao gov>
> To: <Neumann () csl sri com>
> Subject: Pennsylvania makes spreading computer viruses criminal
>
> [Peter, two things: 1) I always thought that spreading viruses was illegal
> -- at least I keep hearing law enforcement say they have enough laws, 2)
the
> article says, "When convicted..." It should read "If convicted..."]
>
> June 1, 2000
> Web posted at: 10:55 a.m. EDT (1455 GMT)
>
> by Daniel Keegan
>
> (IDG) -- People who intentionally spread a computer virus face a
seven-year
> prison sentence and a $15,000 fine in Pennsylvania after Governor Tom
Ridge
> signed a new bill into law May 26. The bill also requires that restitution
> be paid for any damages caused.
>
> The bill, which passed the House and Senate unanimously, makes computer
> hacking - including denial of service attacks - and the willful spread of
a
> computer virus a crime. It also defines a computer virus for the first
time.
> Existing law regarding the unlawful use of a computer does not include the
> introduction of a computer virus as an offense, only the unlawful affects
of
> its introduction.
>
> The bill was written last year when the Melissa virus hit, but was not
> created in response to it, said Carmine Camillo, legislative advisor for
> Sen. Jane Earll, the sponsor of the bill. The bill was introduced in the
> fall.
>
> Accessing and damaging a computer or system is a felony of the third
degree,
> facing a seven-year sentence and $15,000 fine. Interfering with a
computer,
> system, or network or giving out a password or other confidential
information
> about a system is a misdemeanor of the first degree, with a maximum
penalty of
> five years and $10,000 fine.
>
> When convicted, the defendant must repay the victim for the cost of
> repairing or replacing the system infected, lost profit for the period
that
> the system was not usable, and to replace or restore lost or damaged
> data. Camillo said the level of restitution would be left to the judge.
>
> The bill takes effect at the end of July.