Citations Affected: IC 24-4.8; IC 35-32-2-1; IC 35-41-1-1.
Synopsis: Various computer issues. Conference committee report for ESB 49. Prohibits certain
uses of spyware. Authorizes a provider of computer software, a web site owner, or a trademark
or copyright holder harmed by a prohibited use of spyware to bring a civil action against the
person who committed the prohibited act. Allows a person who brings a cause of action for
unlawful spyware installation to receive injunctive relief and the greater of actual damages or
$100,000 per violation. Provides that a person may be convicted of an offense if the person's
conduct constitutes an offense under Indiana law and either: (1) involves the use of the Internet
or another computer network, and access to the Internet or other computer network occurs in
Indiana; or (2) involves the use of electronic communication, including the Internet or another
computer network, outside Indiana and the victim of the conduct resides in Indiana at the time
of the conduct. Provides that a trial for such conduct may be held in a county: (1) from which or
to which access to the Internet or other computer network was made; (2) in which any computer,
computer data, computer software, or computer network that was used to access the Internet or
other computer network is located; or (3) in which the victim resides at the time of the conduct
if the conduct involves the use of electronic communication and occurs outside Indiana. (This
conference committee report removes provisions added in the House of Representatives
that would have required state agencies and business entities to disclose any breach of the
security of computerized data systems maintained by the agencies and entities to any
resident of the state whose personal information was, or is reasonably believed to have
been, acquired by an unauthorized person.)
Effective: July 1, 2005.
MADAM PRESIDENT:
Your Conference Committee appointed to confer with a like committee from the House
upon Engrossed House Amendments to Engrossed Senate Bill No. 49 respectfully reports that
said two committees have conferred and agreed as follows to wit:
that the Senate recede from its dissent from all House amendments and that
the Senate now concur in all House amendments to the bill and that the bill
be further amended as follows:
Delete everything after the enacting clause and insert the following:
following:
(1) A materially false statement that a person knows to be false.
(2) A statement or description made by a person who omits or
misrepresents material information with the intent to deceive
an owner or operator of a computer.
(3) The failure to provide notice to an owner or operator of a
computer regarding the installation or execution of computer
software with the intent to deceive the owner or operator.
Sec. 7. "Internet" has the meaning set forth in IC 5-22-2-13.5.
Sec. 8. (a) "Owner or operator" means the person who owns or
leases a computer or a person who uses a computer with the
authorization of the person who owns or leases the computer.
(b) The term does not include a manufacturer, distributor,
wholesaler, retail merchant, or any other person who owns or
leases a computer before the first retail sale of the computer.
Sec. 9. "Person" means an individual, a partnership, a
corporation, a limited liability company, or another organization.
Sec. 10. "Personally identifying information" means the
following information that refers to a person who is an owner or
operator of a computer:
(1) Identifying information (as defined in IC 35-43-5-1).
(2) An electronic mail address.
(3) Any of the following information in a form that personally
identifies an owner or operator of a computer:
(A) An account balance.
(B) An overdraft history.
(C) A payment history.
Sec. 11. (a) Except as provided in subsection (b), "transmit"
means to transfer, send, or otherwise make available computer
software or a computer software component through a network,
the Internet, a wireless transmission, or any other medium,
including a disk or data storage device.
(b) "Transmit" does not include an action by a person who
provides:
(1) the Internet connection, telephone connection, or other
means of connection for an owner or operator, including a
compact disc or DVD on which computer software to establish
or maintain a connection is made available;
(2) the storage or hosting of computer software or an Internet
web page through which the computer software was made
available; or
(3) an information location tool, including a directory, an
index, a reference, a pointer, or a hypertext link, through
which the owner or operator of the computer located the
software;
unless the person receives a direct economic benefit from the
execution of the computer software.
Chapter 2. Prohibited Conduct
Sec. 1. This chapter does not apply to a person who monitors or
interacts with an owner or operator's Internet connection, Internet
service, network connection, or computer if the person is a
telecommunications carrier, cable operator, computer hardware
or software provider, or other computer service provider who
monitors or interacts with an owner or operator's Internet
connection, Internet service, network connection, or computer for
one (1) or more of the following purposes:
(1) Network security.
(2) Computer security.
(3) Diagnosis.
(4) Technical support.
(5) Maintenance.
(6) Repair.
(7) Authorized updates of software or system firmware.
(8) Authorized remote system management.
(9) Detection or prevention of the unauthorized, illegal, or
fraudulent use of a network, service, or computer software,
including scanning for and removing computer software that
facilitates a violation of this chapter.
Sec. 2. A person who is not the owner or operator of the
computer may not knowingly or intentionally:
(1) transmit computer software to the computer; and
(2) by means of the computer software transmitted under
subdivision (1), do any of the following:
(A) Use intentionally deceptive means to modify computer
settings that control:
(i) the page that appears when an owner or operator opens
an Internet browser or similar computer software used to
access and navigate the Internet;
(ii) the Internet service provider, search engine, or web
proxy that an owner or operator uses to access or search
the Internet; or
(iii) the owner or operator's list of bookmarks used to
access web pages.
(B) Use intentionally deceptive means to collect personally
identifying information:
(i) through the use of computer software that records a
keystroke made by an owner or operator and transfers
that information from the computer to another person; or
(ii) in a manner that correlates the personally identifying
information with data respecting all or substantially all of
the web sites visited by the owner or operator of the
computer, not including a web site operated by the person
collecting the personally identifying information.
(C) Extract from the hard drive of an owner or operator's
computer:
(i) a credit card number, debit card number, bank account
number, or any password or access code associated with
these numbers;
(ii) a Social Security number, tax identification number,
driver's license number, passport number, or any other
government issued identification number; or
(iii) the account balance or overdraft history of a person in
a form that identifies the person.
(D) Use intentionally deceptive means to prevent reasonable
efforts by an owner or operator to block or disable the
installation or execution of computer software.
(E) Knowingly or intentionally misrepresent that computer
software will be uninstalled or disabled by an owner or
operator's action.
(F) Use intentionally deceptive means to remove, disable, or
otherwise make inoperative security, antispyware, or
antivirus computer software installed on the computer.
(G) Take control of another person's computer with the
intent to cause damage to the computer or cause the owner
or operator to incur a financial charge for a service that the
owner or operator has not authorized by:
(i) accessing or using the computer's modem or Internet
service; or
(ii) without the authorization of the owner or operator,
opening multiple, sequential, standalone advertisements in
the owner or operator's Internet browser that a reasonable
computer user cannot close without turning off the
computer or closing the browser.
(H) Modify:
(i) computer settings that protect information about a
person with the intent of obtaining personally identifying
information without the permission of the owner or
operator; or
(ii) security settings with the intent to cause damage to a
computer.
(I) Prevent reasonable efforts by an owner or operator to
block or disable the installation or execution of computer
software by:
(i) presenting an owner or operator with an option to
decline installation of computer software knowing that the
computer software will be installed even if the owner or
operator attempts to decline installation; or
(ii) falsely representing that computer software has been
disabled.
Sec. 3. A person who is not the owner or operator may not
knowingly or intentionally do any of the following:
(1) Induce the owner or operator to install computer software
on the owner or operator's computer by knowingly or
intentionally misrepresenting the extent to which installing the
computer software is necessary for:
(A) computer security;
(B) computer privacy; or
(C) opening, viewing, or playing a particular type of content.
(2) Use intentionally deceptive means to execute or cause the
execution of computer software with the intent to cause the
owner or operator to use the computer software in a manner
that violates subdivision (1).
Chapter 3. Relief and Damages
(2) or more counties, the trial may be held in any county sharing the
common boundary.
(j) If an offense is committed by use of the Internet or another
computer network (as defined in IC 35-43-2-3), the trial may be
held in any county:
(1) from which or to which access to the Internet or other
computer network was made; or
(2) in which any computer, computer data, computer software,
or computer network that was used to access the Internet or
other computer network is located.
(k) If an offense:
(1) is committed by use of:
(A) the Internet or another computer network (as defined in
IC 35-43-2-3); or
(B) another form of electronic communication; and
(2) occurs outside Indiana and the victim of the offense resides
in Indiana at the time of the offense;
the trial may be held in the county where the victim resides at the
time of the offense.
____________________________ ____________________________
Senator FordRepresentative Koch
Chairperson
____________________________ ____________________________
Senator BrodenRepresentative Moses
Senate Conferees House Conferees