II 

Calendar No. 324 

112TH CONGRESS 

2D SESSION S. 2111 

To enhance punishment for identity theft and other violations of data privacy 

and security. 

IN THE SENATE OF THE UNITED STATES 

FEBRUARY 15, 2012 

Mr. LEAHY introduced the following bill; which was read the first time 

FEBRUARY 16, 2012 

Read the second time and placed on the calendar 

A BILL 

To enhance punishment for identity theft and other violations 

of data privacy and security. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Cyber Crime Protec5 tion Security Act’’. 


smartinez on DSK6TPTVN1PROD with BILLS
2 

•S 2111 PCS

1 SEC. 2. ORGANIZED CRIMINAL ACTIVITY IN CONNECTION 

2 WITH UNAUTHORIZED ACCESS TO PERSON3 ALLY IDENTIFIABLE INFORMATION. 

4 Section 1961(1) of title 18, United States Code, is 

5 amended by inserting ‘‘section 1030 (relating to fraud and 

6 related activity in connection with computers) if the act 

7 is a felony,’’ before ‘‘section 1084’’. 

8 SEC. 3. PENALTIES FOR FRAUD AND RELATED ACTIVITY IN 

9 CONNECTION WITH COMPUTERS. 

10 Section 1030(c) of title 18, United States Code, is 

11 amended to read as follows: 

12 ‘‘(c) The punishment for an offense under subsection 

13 (a) or (b) of this section is— 

14 ‘‘(1) a fine under this title or imprisonment for 

15 not more than 20 years, or both, in the case of an 

16 offense under subsection (a)(1) of this section; 

17 ‘‘(2)(A) except as provided in subparagraph 

18 (B), a fine under this title or imprisonment for not 

19 more than 3 years, or both, in the case of an offense 

20 under subsection (a)(2); or 

21 ‘‘(B) a fine under this title or imprisonment for 

22 not more than ten years, or both, in the case of an 

23 offense under paragraph (a)(2) of this section, if— 

24 ‘‘(i) the offense was committed for pur25 poses of commercial advantage or private finan26 cial gain; 


smartinez on DSK6TPTVN1PROD with BILLS
3 

•S 2111 PCS

1 ‘‘(ii) the offense was committed in the fur2 therance of any criminal or tortious act in viola3 tion of the Constitution or laws of the United 

4 States, or of any State; or 

5 ‘‘(iii) the value of the information obtained, 

6 or that would have been obtained if the offense 

7 was completed, exceeds $5,000; 

8 ‘‘(3) a fine under this title or imprisonment for 

9 not more than 1 year, or both, in the case of an of10 fense under subsection (a)(3) of this section; 

11 ‘‘(4) a fine under this title or imprisonment of 

12 not more than 20 years, or both, in the case of an 

13 offense under subsection (a)(4) of this section; 

14 ‘‘(5)(A) except as provided in subparagraph 

15 (D), a fine under this title, imprisonment for not 

16 more than 20 years, or both, in the case of an of17 fense under subsection (a)(5)(A) of this section, if 

18 the offense caused— 

19 ‘‘(i) loss to 1 or more persons during any 

20 1-year period (and, for purposes of an inves21 tigation, prosecution, or other proceeding 

22 brought by the United States only, loss result23 ing from a related course of conduct affecting 

24 1 or more other protected computers) aggre25 gating at least $5,000 in value; 


smartinez on DSK6TPTVN1PROD with BILLS
4 

•S 2111 PCS

1 ‘‘(ii) the modification or impairment, or 

2 potential modification or impairment, of the 

3 medical examination, diagnosis, treatment, or 

4 care of 1 or more individuals; 

5 ‘‘(iii) physical injury to any person; 

6 ‘‘(iv) a threat to public health or safety; 

7 ‘‘(v) damage affecting a computer used by, 

8 or on behalf of, an entity of the United States 

9 Government in furtherance of the administra10 tion of justice, national defense, or national se11 curity; or 

12 ‘‘(vi) damage affecting 10 or more pro13 tected computers during any 1-year period; 

14 ‘‘(B) a fine under this title, imprisonment for 

15 not more than 10 years, or both, in the case of an 

16 offense under subsection (a)(5)(B), if the offense 

17 caused a harm provided in clause (i) through (vi) of 

18 subparagraph (A) of this subsection; 

19 ‘‘(C) if the offender attempts to cause or know20 ingly or recklessly causes death from conduct in vio21 lation of subsection (a)(5)(A), a fine under this title, 

22 imprisonment for any term of years or for life, or 

23 both; or 


smartinez on DSK6TPTVN1PROD with BILLS
5 

•S 2111 PCS

1 ‘‘(D) a fine under this title, imprisonment for 

2 not more than 1 year, or both, for any other offense 

3 under subsection (a)(5); 

4 ‘‘(6) a fine under this title or imprisonment for 

5 not more than 10 years, or both, in the case of an 

6 offense under subsection (a)(6) of this section; or 

7 ‘‘(7) a fine under this title or imprisonment for 

8 not more than 10 years, or both, in the case of an 

9 offense under subsection (a)(7) of this section..’’. 

10 SEC. 4. TRAFFICKING IN PASSWORDS. 

11 Section 1030(a) of title 18, United States Code, is 

12 amended by striking paragraph (6) and inserting the fol13 lowing: 

14 ‘‘(6) knowingly and with intent to defraud traf15 fics (as defined in section 1029) in— 

16 ‘‘(A) any password or similar information 

17 or means of access through which a protected 

18 computer as defined in subparagraphs (A) and 

19 (B) of subsection (e)(2) may be accessed with20 out authorization; or 

21 ‘‘(B) any means of access through which a 

22 protected computer as defined in subsection 

23 (e)(2)(A) may be accessed without authoriza24 tion.’’. 


smartinez on DSK6TPTVN1PROD with BILLS
6 

•S 2111 PCS

1 SEC. 5. CONSPIRACY AND ATTEMPTED COMPUTER FRAUD 

2 OFFENSES. 

3 Section 1030(b) of title 18, United States Code, is 

4 amended by inserting ‘‘for the completed offense’’ after 

5 ‘‘punished as provided’’. 

6 SEC. 6. CRIMINAL AND CIVIL FORFEITURE FOR FRAUD AND 

7 RELATED ACTIVITY IN CONNECTION WITH 

8 COMPUTERS. 

9 Section 1030 of title 18, United States Code, is 

10 amended by striking subsections (i) and (j) and inserting 

11 the following: 

12 ‘‘(i) CRIMINAL FORFEITURE.— 

13 ‘‘(1) The court, in imposing sentence on any 

14 person convicted of a violation of this section, or 

15 convicted of conspiracy to violate this section, shall 

16 order, in addition to any other sentence imposed and 

17 irrespective of any provision of State law, that such 

18 person forfeit to the United States— 

19 ‘‘(A) such person’s interest in any prop20 erty, real or personal, that was used, or in21 tended to be used, to commit or facilitate the 

22 commission of such violation; and 

23 ‘‘(B) any property, real or personal, consti24 tuting or derived from any gross proceeds, or 

25 any property traceable to such property, that 


smartinez on DSK6TPTVN1PROD with BILLS
7 

•S 2111 PCS

1 such person obtained, directly or indirectly, as 

2 a result of such violation. 

3 ‘‘(2) The criminal forfeiture of property under 

4 this subsection, including any seizure and disposition 

5 of the property, and any related judicial or adminis6 trative proceeding, shall be governed by the provi7 sions of section 413 of the Comprehensive Drug 

8 Abuse Prevention and Control Act of 1970 (21 

9 U.S.C. 853), except subsection (d) of that section. 

10 ‘‘(j) CIVIL FORFEITURE.— 

11 ‘‘(1) The following shall be subject to forfeiture 

12 to the United States and no property right, real or 

13 personal, shall exist in them: 

14 ‘‘(A) Any property, real or personal, that 

15 was used, or intended to be used, to commit or 

16 facilitate the commission of any violation of this 

17 section, or a conspiracy to violate this section. 

18 ‘‘(B) Any property, real or personal, con19 stituting or derived from any gross proceeds ob20 tained directly or indirectly, or any property 

21 traceable to such property, as a result of the 

22 commission of any violation of this section, or 

23 a conspiracy to violate this section. 

24 ‘‘(2) Seizures and forfeitures under this sub25 section shall be governed by the provisions in chapVerDate Mar 15 2010 23:32 Feb 16, 2012 Jkt 019200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S2111.PCS S2111

smartinez on DSK6TPTVN1PROD with BILLS
8 

•S 2111 PCS

1 ter 46 of title 18, United States Code, relating to 

2 civil forfeitures, except that such duties as are im3 posed on the Secretary of the Treasury under the 

4 customs laws described in section 981(d) of title 18, 

5 United States Code, shall be performed by such offi6 cers, agents and other persons as may be designated 

7 for that purpose by the Secretary of Homeland Se8 curity or the Attorney General.’’. 

9 SEC. 7. DAMAGE TO CRITICAL INFRASTRUCTURE COM10 PUTERS. 

11 (a) IN GENERAL.—Chapter 47 of title 18, United 

12 States Code, is amended by inserting after section 1030 

13 the following: 

14 ‘‘SEC. 1030A. AGGRAVATED DAMAGE TO A CRITICAL INFRA15 STRUCTURE COMPUTER. 

16 ‘‘(a) DEFINITIONS.—In this section— 

17 ‘‘(1) the terms ‘computer’ and ‘damage’ have 

18 the meanings given such terms in section 1030; and 

19 ‘‘(2) the term ‘critical infrastructure computer’ 

20 means a computer that manages or controls systems 

21 or assets vital to national defense, national security, 

22 national economic security, public health or safety, 

23 or any combination of those matters, whether pub24 licly or privately owned or operated, including— 


smartinez on DSK6TPTVN1PROD with BILLS
9 

•S 2111 PCS

1 ‘‘(A) gas and oil production, storage, and 

2 delivery systems; 

3 ‘‘(B) water supply systems; 

4 ‘‘(C) telecommunication networks; 

5 ‘‘(D) electrical power delivery systems; 

6 ‘‘(E) finance and banking systems; 

7 ‘‘(F) emergency services; 

8 ‘‘(G) transportation systems and services; 

9 and 

10 ‘‘(H) government operations that provide 

11 essential services to the public. 

12 ‘‘(b) OFFENSE.—It shall be unlawful to, during and 

13 in relation to a felony violation of section 1030, inten14 tionally cause or attempt to cause damage to a critical 

15 infrastructure computer, and such damage results in (or, 

16 in the case of an attempt, would, if completed have re17 sulted in) the substantial impairment— 

18 ‘‘(1) of the operation of the critical infrastruc19 ture computer; or 

20 ‘‘(2) of the critical infrastructure associated 

21 with the computer. 

22 ‘‘(c) PENALTY.—Any person who violates subsection 

23 (b) shall be fined under this title, imprisoned for not less 

24 than 3 years nor more than 20 years, or both. 


smartinez on DSK6TPTVN1PROD with BILLS
10 

•S 2111 PCS

1 ‘‘(d) CONSECUTIVE SENTENCE.—Notwithstanding 

2 any other provision of law— 

3 ‘‘(1) a court shall not place on probation any 

4 person convicted of a violation of this section; 

5 ‘‘(2) except as provided in paragraph (4), no 

6 term of imprisonment imposed on a person under 

7 this section shall run concurrently with any other 

8 term of imprisonment, including any term of impris9 onment imposed on the person under any other pro10 vision of law, including any term of imprisonment 

11 imposed for the felony violation section 1030; 

12 ‘‘(3) in determining any term of imprisonment 

13 to be imposed for a felony violation of section 1030, 

14 a court shall not in any way reduce the term to be 

15 imposed for such crime so as to compensate for, or 

16 otherwise take into account, any separate term of 

17 imprisonment imposed or to be imposed for a viola18 tion of this section; and 

19 ‘‘(4) a term of imprisonment imposed on a per20 son for a violation of this section may, in the discre21 tion of the court, run concurrently, in whole or in 

22 part, only with another term of imprisonment that 

23 is imposed by the court at the same time on that 

24 person for an additional violation of this section, 

25 provided that such discretion shall be exercised in 


smartinez on DSK6TPTVN1PROD with BILLS
11 

•S 2111 PCS

1 accordance with any applicable guidelines and policy 

2 statements issued by the United States Sentencing 

3 Commission pursuant to section 994 of title 28.’’. 

4 (b) TECHNICAL AND CONFORMING AMENDMENT.— 

5 The table of sections for chapter 47 of title 18, United 

6 States Code, is amended by inserting after the item relat7 ing to section 1030 the following: 

‘‘Sec. 1030A. Aggravated damage to a critical infrastructure computer.’’. 

8 SEC. 8. LIMITATION ON ACTIONS INVOLVING UNAUTHOR9 IZED USE. 

10 Section 1030(e)(6) of title 18, United States Code, 

11 is amended by striking ‘‘alter;’’ and inserting ‘‘alter, but 

12 does not include access in violation of a contractual obliga13 tion or agreement, such as an acceptable use policy or 

14 terms of service agreement, with an Internet service pro15 vider, Internet website, or non-government employer, if 

16 such violation constitutes the sole basis for determining 

17 that access to a protected computer is unauthorized;’’. 


smartinez on DSK6TPTVN1PROD with BILLS
Calendar No. 324 

112TH CONGRESS 

2D SESSION S. 2111 

A BILL 

To enhance punishment for identity theft and other 

violations of data privacy and security. 

FEBRUARY 16, 2012 

Read the second time and placed on the calendar 


smartinez on DSK6TPTVN1PROD with BILLS