National Information Infrastructure Protection Act of 1996

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``National Information Infrastructure 
Protection Act of 1996''.

SEC. 2. COMPUTER CRIME.

    Section 1030 of title 18, United States Code, is amended--
            (1) in subsection (a)--
                    (A) in paragraph (1)--
                            (i) by striking ``knowingly accesses'' and 
                        inserting ``having knowingly accessed'';
                            (ii) by striking ``exceeds'' and inserting 
                        ``exceeding'';
                            (iii) by striking ``obtains information'' 
                        and inserting ``having obtained information'';
                            (iv) by striking ``the intent or'';
                            (v) by striking ``is to be used'' and 
                        inserting ``could be used''; and
                            (vi) by inserting before the semicolon at 
                        the end the following: ``willfully 
                        communicates, delivers, transmits, or causes to 
                        be communicated, delivered, or transmitted, or 
                        attempts to communicate, deliver, transmit or 
                        cause to be communicated, delivered, or 
                        transmitted the same to any person not entitled 
                        to receive it, or willfully retains the same 
                        and fails to deliver it to the officer or 
                        employee of the United States entitled to 
                        receive it'';
                    (B) in paragraph (2)--
                            (i) by striking ``obtains information'' and 
                        inserting ``obtains--
                    ``(A) information''; and
                            (ii) by adding at the end the following:
                    ``(B) information from any department or agency of 
                the United States; or
                    ``(C) information from any protected computer if 
                the conduct involved an interstate or foreign 
                communication;'';
                    (C) in paragraph (3)--
                            (i) by striking ``the use of the 
                        Government's operation of such computer'' and 
                        inserting ``that use by or for the Government 
                        of the United States''; and
                            (ii) by striking ``adversely'';
                    (D) in paragraph (4)--
                            (i) by striking ``Federal interest'' and 
                        inserting ``protected''; and
                            (ii) by inserting before the semicolon the 
                        following: ``and the value of such use is not 
                        more than $5,000 in any 1-year period'';
                    (E) by amending paragraph (5) to read as follows:
            ``(5)(A) knowingly causes the transmission of a program, 
        information, code, or command, and as a result of such conduct, 
        intentionally causes damage without authorization, to a 
        protected computer;
            ``(B) intentionally accesses a protected computer without 
        authorization, and as a result of such conduct, recklessly 
        causes damage; or
            ``(C) intentionally accesses a protected computer without 
        authorization, and as a result of such conduct, causes 
        damage;''; and
                    (F) by inserting after paragraph (6) the following 
                new paragraph:
            ``(7) with intent to extort from any person, firm, 
        association, educational institution, financial institution, 
        government entity, or other legal entity, any money or other 
        thing of value, transmits in interstate or foreign commerce any 
        communication containing any threat to cause damage to a 
        protected computer;'';
            (2) in subsection (c)--
                    (A) in paragraph (1), by striking ``such 
                subsection'' each place it appears and inserting ``this 
                section'';
                    (B) in paragraph (2)--
                            (i) in subparagraph (A)--
                                    (I) by inserting ``, (a)(5)(C),'' 
                                after ``(a)(3)''; and
                                    (II) by striking ``such 
                                subsection'' and inserting ``this 
                                section'';
                            (ii) by redesignating subparagraph (B) as 
                        subparagraph (C);
                            (iii) by inserting immediately after 
                        subparagraph (A) the following:
                    ``(B) a fine under this title or imprisonment for 
                not more than 5 years, or both, in the case of an 
                offense under subsection (a)(2), if--
                            ``(i) the offense was committed for 
                        purposes of commercial advantage or private 
                        financial gain;
                            ``(ii) the offense was committed in 
                        furtherance of any criminal or tortious act in 
                        violation of the Constitution or laws of the 
                        United States or of any State; or
                            ``(iii) the value of the information 
                        obtained exceeds $5,000;''; and
                            (iv) in subparagraph (C) (as redesignated), 
                        by striking ``such subsection'' and inserting 
                        ``this section'';
                    (C) in paragraph (3)--
                            (i) in subparagraph (A)--
                                    (I) by striking ``(a)(4) or 
                                (a)(5)(A)'' and inserting ``(a)(4), 
                                (a)(5)(A), (a)(5)(B), or (a)(7)''; and
                                    (II) by striking ``such 
                                subsection'' and inserting ``this 
                                section''; and
                            (ii) in subparagraph (B)--
                                    (I) by striking ``(a)(4) or 
                                (a)(5)'' and inserting ``(a)(4), 
                                (a)(5)(A), (a)(5)(B), (a)(5)(C), or 
                                (a)(7)''; and
                                    (II) by striking ``such 
                                subsection'' and inserting ``this 
                                section''; and
                    (D) by striking paragraph (4);
            (3) in subsection (d), by inserting ``subsections 
        (a)(2)(A), (a)(2)(B), (a)(3), (a)(4), (a)(5), and (a)(6) of'' 
        before ``this section.'';
            (4) in subsection (e)--
                    (A) in paragraph (2)--
                            (i) by striking ``Federal interest'' and 
                        inserting ``protected'';
                            (ii) in subparagraph (A), by striking ``the 
                        use of the financial institution's operation or 
                        the Government's operation of such computer'' 
                        and inserting ``that use by or for the 
                        financial institution or the Government''; and
                            (iii) by amending subparagraph (B) to read 
                        as follows:
                    ``(B) which is used in interstate or foreign 
                commerce or communication;'';
                    (B) in paragraph (6), by striking ``and'' the last 
                place it appears;
                    (C) by striking the period at the end of paragraph 
                (7) and inserting ``; and''; and
                    (D) by adding at the end the following new 
                paragraphs:
            ``(8) the term `damage' means any impairment to the 
        integrity or availability of data, a program, a system, or 
        information, that--
                    ``(A) causes loss aggregating at least $5,000 in 
                value during any 1-year period to one or more 
                individuals;
                    ``(B) modifies or impairs, or potentially modifies 
                or impairs, the medical examination, diagnosis, 
                treatment, or care of one or more individuals;
                    ``(C) causes physical injury to any person; or
                    ``(D) threatens public health or safety; and
            ``(9) the term `government entity' includes the Government 
        of the United States, any State or political subdivision of the 
        United States, any foreign country, and any state, province, 
        municipality, or other political subdivision of a foreign 
        country.''; and
            (5) in subsection (g)--
                    (A) by striking ``, other than a violation of 
                subsection (a)(5)(B),''; and
                    (B) by striking ``of any subsection other than 
                subsection (a)(5)(A)(ii)(II)(bb) or 
                (a)(5)(B)(ii)(II)(bb)'' and inserting ``involving 
                damage as defined in subsection (e)(8)(A)''.

Summary: National Information Infrastructure Protection Act of 1996 - Revises Federal criminal code provisions regarding fraud and related activity in connection with computers. Sets penalties with respect to anyone who having knowingly accessed a computer without authorization or exceeding authorized access, obtains specified restricted information or data, and, with reason to believe that such information could be used to the injury of the United States or to the advantage of any foreign nation, willfully communicates, delivers, or transmits it to any person not entitled to receive it or willfully retains it and fails to deliver it to the US officer or employee entitled to receive it. Sets penalties for: (1) intentionally accessing a computer without authorization or exceeding authorized access and thereby obtaining information from any US department or agency, or from any protected computer if the conduct involved an interstate or foreign communication. (2) intentionally accessing, without authorization, any computer of a US department or agency that is exclusively for use by or for the US Government or, in the case of a computer not exclusively for such use, that is used by or for the US Government if such conduct affects the use of the Government's operation of such computer. (3) knowingly and with intent to defraud, accessing a protected computer without authorization, or exceeding authorized access, and furthering the intended fraud and obtaining anything of value, unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $5,000 in any one-year period. (4) knowingly causing the transmission of a program, information, code, or command, and, as a result, intentionally causing damage without authorization to a protected computer, intentionally accessing a protected computer without authorization and recklessly causing damage, or intentionally accessing a protected computer without authorization and causing damage. And (5) with intent to extort from any person or legal entity any thing of value, transmitting in interstate or foreign commerce any communication containing a threat to cause damage to a protected computer. Increases penalties for fraud and related activity in connection with computers.