To amend title 18, United States Code, to discourage spyware, and for other purposes.

Summary: Internet Spyware (I-SPY) Prevention Act of 2004 - Amends the Federal criminal code to prohibit intentionally accessing a protected computer without authorization, or exceeding authorized access, by causing a computer program or code to be copied onto the protected computer, and intentionally using that program or code: (1) in furtherance of another Federal criminal offense; (2) to obtain or transmit personal information (including a Social Security number or other government-issued identification number, a bank or credit card number, or an associated password or access code) with intent to defraud or injure a person or cause damage to a protected computer; or (3) to impair the security protection of that computer.

Prohibits any person from bringing a civil action under State law premised upon the defendant's violating this Act.

Provides that this Act does not prohibit any lawfully authorized investigative, protective, or intelligence activity of a law enforcement agency or a U.S. intelligence agency.

Authorizes appropriations for each of FY 2005 through 2008 to the Attorney General for prosecutions needed to discourage the use of spyware (i.e., software that aids in gathering and sending information about a person or organization, or in asserting control over their computer, without their knowledge or consent) and the practice called phishing (i.e., using the websites of, or e-mails that appear to be sent from, well known legitimate businesses to deceive Internet users into revealing personal information that can be used to defraud those users).

Expresses the sense of Congress that the Department of Justice should use this Act and all other available tools to vigorously prosecute those who use spyware to commit crimes and those that conduct phishing scams.

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Internet Spyware (I-SPY) Prevention 
Act of 2004''.

SEC. 2. PENALTIES FOR CERTAIN UNAUTHORIZED ACTIVITIES RELATING TO 
              COMPUTERS.

    (a) In General.--Chapter 47 of title 18, United States Code, is 
amended by inserting after section 1030 the following:
``Sec. 1030A. Illicit indirect use of protected computers
    ``(a) Whoever intentionally accesses a protected computer without 
authorization, or exceeds authorized access to a protected computer, by 
causing a computer program or code to be copied onto the protected 
computer, and intentionally uses that program or code in furtherance of 
another Federal criminal offense shall be fined under this title or 
imprisoned not more than 5 years, or both.
    ``(b) Whoever intentionally accesses a protected computer without 
authorization, or exceeds authorized access to a protected computer, by 
causing a computer program or code to be copied onto the protected 
computer, and by means of that program or code--
            ``(1) intentionally obtains, or transmits to another, 
        personal information with the intent to defraud or injure a 
        person or cause damage to a protected computer; or
            ``(2) intentionally impairs the security protection of the 
        protected computer;
shall be fined under this title or imprisoned not more than 2 years, or 
both.
    ``(c) No person may bring a civil action under the law of any State 
if such action is premised in whole or in part upon the defendant's 
violating this section. For the purposes of this subsection, the term 
`State' includes the District of Columbia, Puerto Rico, and any other 
territory or possession of the United States.
    ``(d) As used in this section--
            ``(1) the terms `protected computer' and `exceeds 
        authorized access' have, respectively, the meanings given those 
        terms in section 1030; and
            ``(2) the term `personal information' means--
                    ``(A) a first and last name;
                    ``(B) a home or other physical address, including 
                street name;
                    ``(C) an electronic mail address;
                    ``(D) a telephone number;
                    ``(E) a Social Security number, tax identification 
                number, drivers license number, passport number, or any 
                other government-issued identification number; or
                    ``(F) a credit card or bank account number or any 
                password or access code associated with a credit card 
                or bank account.
    ``(e) This section does not prohibit any lawfully authorized 
investigative, protective, or intelligence activity of a law 
enforcement agency of the United States, a State, or a political 
subdivision of a State, or of an intelligence agency of the United 
States.''.
    (b) Conforming Amendment.--The table of sections at the beginning 
of chapter 47 of title 18, United States Code, is amended by inserting 
after the item relating to section 1030 the following new item:

``1030A. Illicit indirect use of protected computers.''.

SEC. 3. AUTHORIZATION OF APPROPRIATIONS.

    In addition to any other sums otherwise authorized to be 
appropriated for this purpose, there are authorized to be appropriated 
for each of fiscal years 2005 through 2008, the sum of $10,000,000 to 
the Attorney General for prosecutions needed to discourage the use of 
spyware and the practice commonly called phishing.

SEC. 4. FINDINGS AND SENSE OF CONGRESS CONCERNING THE ENFORCEMENT OF 
              CERTAIN CYBERCRIMES.

    (a) Findings.--Congress makes the following findings:
            (1) Software and electronic communications are increasingly 
        being used by criminals to invade individuals' and businesses' 
        computers without authorization.
            (2) Two particularly egregious types of such schemes are 
        the use of spyware and phishing scams.
            (3) These schemes are often used to obtain personal 
        information, such as bank account and credit card numbers, 
        which can then be used as a means to commit other types of 
        theft.
            (4) In addition to the devastating damage that these 
        heinous activities can inflict on individuals and businesses, 
        they also undermine the confidence that citizens have in using 
        the Internet.
    (b) Sense of Congress.--Because of the serious nature of these 
offenses, and the Internet's unique importance in the daily lives of 
citizens and in interstate commerce, it is the sense of Congress that 
the Department of Justice should use the amendments made by this Act, 
and all other available tools, vigorously to prosecute those

who use spyware to commit crimes and those that conduct phishing scams.

            Passed the House of Representatives October 7, 2004.

            Attest:

                                                 JEFF TRANDAHL,

                                                                 Clerk.