Legislature(2011 - 2012)CAPITOL 120
03/23/2011 01:00 PM House JUDICIARY
| Audio | Topic |
|---|---|
| Start | |
| HB87 | |
| HB23 | |
| Adjourn |
* first hearing in first committee of referral
+ teleconferenced
= bill was previously heard/scheduled
+ teleconferenced
= bill was previously heard/scheduled
| + | HB 87 | TELECONFERENCED | |
| *+ | HB 23 | TELECONFERENCED | |
| + | TELECONFERENCED | ||
| += | HB 6 | TELECONFERENCED | |
| += | HB 168 | TELECONFERENCED | |
HB 23 - COMPUTER PRIVACY
2:02:30 PM
CHAIR GATTO announced that the final order of business would be
HOUSE BILL NO. 23, "An Act relating to criminal use of a
computer."
2:03:00 PM
REPRESENTATIVE PETE PETERSEN, Alaska State Legislature, speaking
as one of the bill's joint prime sponsors, explained that HB 23
would update Alaska's statutes regarding criminal use of a
computer - AS 11.46.740 - in order to keep up with new
technology such as keyboard loggers, devices which record
keystrokes as they are being entered into a computer.
Specifically, Section 1 of HB 23 - amending AS 11.46.740(a) -
would make it a crime for a person to install a keystroke logger
or other device or program that has the ability to record
someone else's keystrokes or entries - whether transmitted
wirelessly or not - in order to access information that the
person has no right to. Currently, obtaining someone's personal
information via software or "spyware" is illegal, but not when
done via the use of a keystroke logger, and HB 23 would [fix
this loophole].
2:04:51 PM
DAVID BREMER, Staff, Representative Pete Petersen, Alaska State
Legislature, on behalf of Representative Petersen, one of
HB 23's joint prime sponsors, additionally offered his
understanding that some new technology can enable a person to
record someone else's keystrokes from as far away as 100 yards.
In response to questions, he assured the committee that the bill
wouldn't apply to law enforcement, and noted that the Alaska
Cabaret, Hotel, Restaurant, & Retailers Association (Alaska
CHARR) is in support of HB 23.
REPRESENTATIVE PETERSEN mentioned that in addition to protecting
the personal information of individuals, the bill would also
protect the proprietary information of businesses.
MR. BREMER, in response to questions, said that although a
person using a keystroke logger to steal information wouldn't
necessarily know the context of the keystrokes that were
recorded, he/she could look for common patterns such as 16
numeric keystrokes in a row, possibly indicating a credit card
number, or some alphabetic keystrokes that include letters
spelling "gmail.com", possibly indicating an e-mail account; and
offered his understanding that there is not yet a way to steal
information entered on a computer via touchscreen technology.
2:09:12 PM
REPRESENTATIVE THOMPSON expressed concern that the affirmative
defense provided for via Section 2 of the bill could be misused
by perpetrators of domestic violence (DV) who install a
keystroke logger on their home computers in order to obtain
information entered by their victims. He questioned whether
this provision - which would add a new subsection (d) to AS
11.46.740 - would conflict with [Alaska's DV laws, either
existing or proposed].
MR. BREMER - noting that without passage of the bill, anyone,
even a perpetrator of DV, can use a keystroke logger to obtain
information he/she has no right to - explained that Section 2 of
the bill was included so as to address instances in which
parents install a keystroke logger on their home computer in
order to monitor what their children are doing on it. He
offered [his understanding that the joint prime sponsors] would
not be opposed to amending the bill [to address the concern
about perpetrators of DV]. In response to comments, he
mentioned that in addition to keystroke loggers that obtain
information remotely, there are also ones that attach to the
computer itself, looking much like a simple cable extension, and
thus a person would have to inspect the wiring on his/her
computer prior to every use in order to ensure that no such
device had been installed. Keyboard loggers are readily
available over the Internet, and range in price from $50-$200,
he added.
REPRESENTATIVE PRUITT asked whether HB 23 would impact companies
that use such technology to monitor their employees.
MR. BREMER relayed that it wouldn't because companies have the
right to access information on the computers they own. In
response to other questions, he clarified that Section 2 of HB
23 provides an affirmative defense for those installing or
enabling a keystroke logger on their own computer, and explained
that the bill's current title - "An Act relating to criminal use
of a computer." - was chosen because the catch line of the
section of statute being amended is, "Criminal use of computer."
REPRESENTATIVE GRUENBERG suggested that the joint prime sponsors
consider narrowing the title in order to ensure that [unrelated]
provisions aren't added to the bill.
REPRESENTATIVE PETERSEN indicated that narrowing the title to
that effect would be fine with him.
2:19:51 PM
ANNE CARPENETI, Assistant Attorney General, Legal Services
Section, Criminal Division, Department of Law (DOL), suggested
dividing the language of proposed AS 11.46.740(a)(2) into two
parts in order to clarify that this new language is addressing
both the installation of hardware/software, and the accessing of
information remotely, and suggested deleting Section 2 as being
unnecessary, since the State would already have to prove beyond
a reasonable doubt that the person had no right to engage in the
proscribed behavior. She noted, though, that Section 2 wouldn't
conflict with [Alaska's DV laws, either existing or proposed],
because it specifically says that application of its affirmative
defense is limited to prosecutions resulting from a violation of
AS 11.46.740(a)(2), and AS 11.46 addresses property crimes, not
crimes against a person. So if the committee chooses to retain
Section 2, the language should at least be changed to reflect
that it applies to both presently-owned and formerly-owned
computers.
CHAIR GATTO relayed that a proposed committee substitute (CS)
addressing the aforementioned concerns would be forthcoming.
REPRESENTATIVE GRUENBERG mentioned that he supports the bill.
2:28:19 PM
GERALD LUCKHAUPT, Assistant Revisor of Statutes, Legislative
Legal Counsel, Legislative Legal and Research Services,
Legislative Affairs Agency (LAA), speaking as the drafter of HB
23, relayed that he would draft language clarifying that what is
now proposed AS 11.46.740(a)(2) would address both the
installation of hardware/software, and the accessing of
information remotely; and that he would change the title. He
concurred that the title currently merely reflects the catch
line of the section of AS 11.46 being amended - a section
addressing computer crimes, both those committed against
individuals and those committed against businesses and other
entities; that the affirmative defense provided for via Section
2 would address situations in which parents wish to monitor
their children's computer activity, and situations in which a
company wishes to monitor its employees' computer activity; that
in a prosecution under AS 11.46.740(a)(2), the state would have
to prove that the person had no right to engage in the
proscribed behavior; and that Section 2 wouldn't conflict with
[Alaska's DV laws, either existing or proposed], because it
specifically says that its application is limited to
prosecutions resulting from a violation of AS 11.46.740(a)(2),
which addresses the wrongful use of keystroke loggers, not
domestic violence.
MR. LUCKHAUPT offered his belief, though, that Section 2 would
provide greater protection for someone who installs or enables a
keystroke logger on a computer that he/she owns. In response to
questions, he again pointed out that proposed AS 11.46.740(a)(2)
is intended to address both the installation of keystroke logger
hardware/software, and the accessing of keystroke information
remotely; offered his belief that HB 23 would fill a gap in the
state's laws pertaining to computers and their usage; and
explained that under the bill, the activity outlined in proposed
subsection (a)(2) would still be a crime regardless that the
person failed to actually obtain the information he/she was
seeking via the use of keystroke logger technology.
2:42:03 PM
QUINLAN STEINER, Director, Central Office, Public Defender
Agency (PDA), Department of Administration (DOA), expressed
concern that the affirmative defense provided for via Section 2
of HB 23 would place the burden on the defendant to prove, by a
preponderance of the evidence, that he/she owned the computer,
and this could be difficult to do. Also, Section 2 is confusing
because the affirmative defense relates to an element of the
offense itself, thereby obfuscating what the State would have to
prove. And although the best solution would be to eliminate
Section 2 altogether, as suggested by the DOL, another solution
might be to make lack of ownership an actual element of the
offense, thereby placing the burden on the State to prove that
the defendant didn't own the computer. Mr. Steiner also
concurred with Ms. Carpeneti that the language of proposed
AS 11.46.740(a)(2) ought to be divided into two parts in order
to provide clarity.
CHAIR GATTO, in response to comments, noted members' continuing
concern with Section 2 of HB 23.
REPRESENTATIVE PETERSEN, in response to a question, indicated
that the intent is for the bill to apply in situations where the
person committing the behavior outlined in proposed
AS 11.46.740(a)(2) doesn't own the computer in question.
MS. CARPENETI cautioned against making a lack of ownership an
element of the offense, reiterating that [under the language of
AS 11.46.740(a)], the State would already have to prove beyond a
reasonable doubt that the person had no right to engage in the
proscribed behavior, and that it would be best to simply delete
Section 2 and divide the language of proposed AS
11.46.740(a)(2).
2:52:07 PM
REPRESENTATIVE GRUENBERG concurred with Ms. Carpeneti that under
proposed AS 11.46.740(a) as currently written, the State would
have to prove that the person had no right to engage in the
proscribed behavior outlined in proposed paragraph (2),
acknowledging that owning a computer does give a person the
right to do as he/she wishes with it.
MS. CARPENETI concurred, and ventured that making a lack of
ownership an element of the offense could also prove problematic
in situations involving a business or entity that provides its
customers with access to its computers or and/or its Internet
service - such a business or entity shouldn't have a right to
use keystroke logger technology to obtain its customers'
personal information simply because it owns the computers and/or
Internet service. She again recommended deleting Section 2 of
the bill. In response to further questions, she too noted that
businesses and other entities do have the right to monitor what
their employees are doing on company-owned computers. However,
if such computers were being used by both employees and
customers, then it would be up to the State to prove beyond a
reasonable doubt that the business or entity didn't have the
right to incidentally monitor its customers' computer activity
while monitoring its employees' computer activity.
MR. BREMER relayed that the joint prime sponsors would be
deleting Section 2.
CHAIR GATTO, after ascertaining that no one else wished to
testify, closed public testimony on the bill, and announced that
HB 23 would be held over while the committee awaits a
forthcoming proposed CS addressing the aforementioned concerns.