HB617.DOC

SECTION 1. The Hawaii Revised Statutes is amended by adding a new chapter to title 36 to be appropriately designated and to read as follows:

"Chapter

USE OF COMPUTERS FOR UNAUTHORIZED PURPOSES

§ -1 Definitions. As used in this part, unless the context otherwise requires:

"Access" means to gain entry to, instruct, communicate with, store data in, retrieve data from, or otherwise make use of any resources of a computer, computer system, or computer network.

"Botnet" means a collection of two or more zombies.

"Commercial electronic mail message" means an electronic mail message that advertises, offers for sale or lease, or promotes any goods, services, business opportunity, property, or other article, commodity, or thing of value.

"Computer" means any electronic, magnetic, optical, electrochemical, or other high-speed data processing device performing logical, arithmetic, or storage functions, and includes all computer equipment connected or related to such a device in a computer system or computer network, but shall not include an automated typewriter or typesetter, a portable hand-held calculator, or other similar device.

"Computer equipment" means any equipment or devices, including all input, output, processing, storage, software, or communications facilities, intended to interface with the computer.

"Computer network" means two or more computers or computer systems, interconnected by communication lines, including microwave, electronic, or any other form of communication.

"Computer services" includes but is not limited to the use of a computer system, computer network, computer program, data prepared for computer use, and data contained within a computer system or computer network.

"Computer software" or "program" means a set of computer-readable instructions or statements and related data that, when executed by a computer system, causes the computer system or the computer network to which it is connected to perform computer services.

"Computer system" means a set of interconnected computer equipment intended to operate as a cohesive system.

"Data" means information, facts, concepts, software, or instructions prepared for use in a computer, computer system, or computer network.

"Internet service provider" means a person providing connectivity to the Internet or another wide area network.

"Person" means an individual, corporation, government or governmental subdivision or agency, business trust, estate, trust, partnership, association, or any other legal entity.

"Without authorization" means without the permission of or in excess of the permission of an owner, lessor, or rightful user or someone licensed or privileged by an owner, lessor, or rightful user to grant the permission.

"Zombie" means a computer that, without the knowledge and consent of the computer's owner or operator, has been compromised to give access or control to a program or person other than the computer's owner or operator.

§ -2 Unauthorized creation of, access to, or use of zombies or botnets; private action. (a) A person who is not the owner or operator of the computer may not knowingly cause or offer to cause a computer to become a zombie or part of a botnet.

(b) A person may not knowingly create, have created, use, or offer to use a zombie or botnet to:

(1) Send an unsolicited commercial electronic mail message;

(2) Send a signal to a computer system or network that causes a loss of service to users;

(3) Send data from a computer without authorization by the owner or operator of the computer;

(4) Forward computer software designed to damage or disrupt another computer or system;

(5) Collect personally identifiable information; or

(6) Perform an act for another purpose not authorized by the owner or operator of the computer.

(1) Purchase, rent, or otherwise knowingly gain control of a zombie or botnet created by another person; or

(2) Sell, lease, offer for sale or lease, or otherwise knowingly provide to another person access to or use of a zombie or botnet.

(d) The following persons may bring a civil action against a person who violates this section:

(1) A person who is acting as an internet service provider and whose network is used to commit a violation under this section; or

(2) A person who has incurred a loss or disruption of the conduct of the person's business, including for-profit or not-for-profit activities, as a result of the violation.

(e) A person bringing an action under this section, for each violation may:

(1) Seek injunctive relief to restrain a violator from continuing the violation;

(2) Subject to subsection (f), recover damages in an amount equal to the greater of:

(A) Actual damages arising from the violation; or

(B) $100,000 for each zombie used to commit the violation; or

(3) Obtain both injunctive relief and damages.

(f) The court may increase an award of damages, statutory or otherwise, in an action brought under this section to an amount not to exceed three times the applicable damages if the court finds that the violations have occurred with such a frequency as to constitute a pattern or practice.

(g) A plaintiff who prevails in an action brought under this section is entitled to recover court costs and reasonable attorney's fees, reasonable fees of experts, and other reasonable costs of litigation.

(h) A remedy authorized by this section is not exclusive but is in addition to any other procedure or remedy provided for by other statutory or common law.

(i) Nothing in this section may be construed to impose liability on the following persons with respect to a violation of this section committed by another person:

(1) An internet service provider;

(2) A telecommunication service provider;

(3) A cable operator; or

(4) A provider of interactive computer service, as defined by Title 47 United States Code section 230."

SECTION 2. This Act does not affect rights and duties that matured, penalties that were incurred, and proceedings that were begun before its effective date.

SECTION 3. This Act shall take effect upon its approval.

INTRODUCED BY:	_____________________________

HOUSE OF REPRESENTATIVES	H.B. NO.	617
TWENTY-SIXTH LEGISLATURE, 2011
STATE OF HAWAII