HB 23 - COMPUTER PRIVACY 2:02:30 PM CHAIR GATTO announced that the final order of business would be HOUSE BILL NO. 23, "An Act relating to criminal use of a computer." 2:03:00 PM REPRESENTATIVE PETE PETERSEN, Alaska State Legislature, speaking as one of the bill's joint prime sponsors, explained that HB 23 would update Alaska's statutes regarding criminal use of a computer - AS 11.46.740 - in order to keep up with new technology such as keyboard loggers, devices which record keystrokes as they are being entered into a computer. Specifically, Section 1 of HB 23 - amending AS 11.46.740(a) - would make it a crime for a person to install a keystroke logger or other device or program that has the ability to record someone else's keystrokes or entries - whether transmitted wirelessly or not - in order to access information that the person has no right to. Currently, obtaining someone's personal information via software or "spyware" is illegal, but not when done via the use of a keystroke logger, and HB 23 would [fix this loophole]. 2:04:51 PM DAVID BREMER, Staff, Representative Pete Petersen, Alaska State Legislature, on behalf of Representative Petersen, one of HB 23's joint prime sponsors, additionally offered his understanding that some new technology can enable a person to record someone else's keystrokes from as far away as 100 yards. In response to questions, he assured the committee that the bill wouldn't apply to law enforcement, and noted that the Alaska Cabaret, Hotel, Restaurant, & Retailers Association (Alaska CHARR) is in support of HB 23. REPRESENTATIVE PETERSEN mentioned that in addition to protecting the personal information of individuals, the bill would also protect the proprietary information of businesses. MR. BREMER, in response to questions, said that although a person using a keystroke logger to steal information wouldn't necessarily know the context of the keystrokes that were recorded, he/she could look for common patterns such as 16 numeric keystrokes in a row, possibly indicating a credit card number, or some alphabetic keystrokes that include letters spelling "gmail.com", possibly indicating an e-mail account; and offered his understanding that there is not yet a way to steal information entered on a computer via touchscreen technology. 2:09:12 PM REPRESENTATIVE THOMPSON expressed concern that the affirmative defense provided for via Section 2 of the bill could be misused by perpetrators of domestic violence (DV) who install a keystroke logger on their home computers in order to obtain information entered by their victims. He questioned whether this provision - which would add a new subsection (d) to AS 11.46.740 - would conflict with [Alaska's DV laws, either existing or proposed]. MR. BREMER - noting that without passage of the bill, anyone, even a perpetrator of DV, can use a keystroke logger to obtain information he/she has no right to - explained that Section 2 of the bill was included so as to address instances in which parents install a keystroke logger on their home computer in order to monitor what their children are doing on it. He offered [his understanding that the joint prime sponsors] would not be opposed to amending the bill [to address the concern about perpetrators of DV]. In response to comments, he mentioned that in addition to keystroke loggers that obtain information remotely, there are also ones that attach to the computer itself, looking much like a simple cable extension, and thus a person would have to inspect the wiring on his/her computer prior to every use in order to ensure that no such device had been installed. Keyboard loggers are readily available over the Internet, and range in price from $50-$200, he added. REPRESENTATIVE PRUITT asked whether HB 23 would impact companies that use such technology to monitor their employees. MR. BREMER relayed that it wouldn't because companies have the right to access information on the computers they own. In response to other questions, he clarified that Section 2 of HB 23 provides an affirmative defense for those installing or enabling a keystroke logger on their own computer, and explained that the bill's current title - "An Act relating to criminal use of a computer." - was chosen because the catch line of the section of statute being amended is, "Criminal use of computer." REPRESENTATIVE GRUENBERG suggested that the joint prime sponsors consider narrowing the title in order to ensure that [unrelated] provisions aren't added to the bill. REPRESENTATIVE PETERSEN indicated that narrowing the title to that effect would be fine with him. 2:19:51 PM ANNE CARPENETI, Assistant Attorney General, Legal Services Section, Criminal Division, Department of Law (DOL), suggested dividing the language of proposed AS 11.46.740(a)(2) into two parts in order to clarify that this new language is addressing both the installation of hardware/software, and the accessing of information remotely, and suggested deleting Section 2 as being unnecessary, since the State would already have to prove beyond a reasonable doubt that the person had no right to engage in the proscribed behavior. She noted, though, that Section 2 wouldn't conflict with [Alaska's DV laws, either existing or proposed], because it specifically says that application of its affirmative defense is limited to prosecutions resulting from a violation of AS 11.46.740(a)(2), and AS 11.46 addresses property crimes, not crimes against a person. So if the committee chooses to retain Section 2, the language should at least be changed to reflect that it applies to both presently-owned and formerly-owned computers. CHAIR GATTO relayed that a proposed committee substitute (CS) addressing the aforementioned concerns would be forthcoming. REPRESENTATIVE GRUENBERG mentioned that he supports the bill. 2:28:19 PM GERALD LUCKHAUPT, Assistant Revisor of Statutes, Legislative Legal Counsel, Legislative Legal and Research Services, Legislative Affairs Agency (LAA), speaking as the drafter of HB 23, relayed that he would draft language clarifying that what is now proposed AS 11.46.740(a)(2) would address both the installation of hardware/software, and the accessing of information remotely; and that he would change the title. He concurred that the title currently merely reflects the catch line of the section of AS 11.46 being amended - a section addressing computer crimes, both those committed against individuals and those committed against businesses and other entities; that the affirmative defense provided for via Section 2 would address situations in which parents wish to monitor their children's computer activity, and situations in which a company wishes to monitor its employees' computer activity; that in a prosecution under AS 11.46.740(a)(2), the state would have to prove that the person had no right to engage in the proscribed behavior; and that Section 2 wouldn't conflict with [Alaska's DV laws, either existing or proposed], because it specifically says that its application is limited to prosecutions resulting from a violation of AS 11.46.740(a)(2), which addresses the wrongful use of keystroke loggers, not domestic violence. MR. LUCKHAUPT offered his belief, though, that Section 2 would provide greater protection for someone who installs or enables a keystroke logger on a computer that he/she owns. In response to questions, he again pointed out that proposed AS 11.46.740(a)(2) is intended to address both the installation of keystroke logger hardware/software, and the accessing of keystroke information remotely; offered his belief that HB 23 would fill a gap in the state's laws pertaining to computers and their usage; and explained that under the bill, the activity outlined in proposed subsection (a)(2) would still be a crime regardless that the person failed to actually obtain the information he/she was seeking via the use of keystroke logger technology. 2:42:03 PM QUINLAN STEINER, Director, Central Office, Public Defender Agency (PDA), Department of Administration (DOA), expressed concern that the affirmative defense provided for via Section 2 of HB 23 would place the burden on the defendant to prove, by a preponderance of the evidence, that he/she owned the computer, and this could be difficult to do. Also, Section 2 is confusing because the affirmative defense relates to an element of the offense itself, thereby obfuscating what the State would have to prove. And although the best solution would be to eliminate Section 2 altogether, as suggested by the DOL, another solution might be to make lack of ownership an actual element of the offense, thereby placing the burden on the State to prove that the defendant didn't own the computer. Mr. Steiner also concurred with Ms. Carpeneti that the language of proposed AS 11.46.740(a)(2) ought to be divided into two parts in order to provide clarity. CHAIR GATTO, in response to comments, noted members' continuing concern with Section 2 of HB 23. REPRESENTATIVE PETERSEN, in response to a question, indicated that the intent is for the bill to apply in situations where the person committing the behavior outlined in proposed AS 11.46.740(a)(2) doesn't own the computer in question. MS. CARPENETI cautioned against making a lack of ownership an element of the offense, reiterating that [under the language of AS 11.46.740(a)], the State would already have to prove beyond a reasonable doubt that the person had no right to engage in the proscribed behavior, and that it would be best to simply delete Section 2 and divide the language of proposed AS 11.46.740(a)(2). 2:52:07 PM REPRESENTATIVE GRUENBERG concurred with Ms. Carpeneti that under proposed AS 11.46.740(a) as currently written, the State would have to prove that the person had no right to engage in the proscribed behavior outlined in proposed paragraph (2), acknowledging that owning a computer does give a person the right to do as he/she wishes with it. MS. CARPENETI concurred, and ventured that making a lack of ownership an element of the offense could also prove problematic in situations involving a business or entity that provides its customers with access to its computers or and/or its Internet service - such a business or entity shouldn't have a right to use keystroke logger technology to obtain its customers' personal information simply because it owns the computers and/or Internet service. She again recommended deleting Section 2 of the bill. In response to further questions, she too noted that businesses and other entities do have the right to monitor what their employees are doing on company-owned computers. However, if such computers were being used by both employees and customers, then it would be up to the State to prove beyond a reasonable doubt that the business or entity didn't have the right to incidentally monitor its customers' computer activity while monitoring its employees' computer activity. MR. BREMER relayed that the joint prime sponsors would be deleting Section 2. CHAIR GATTO, after ascertaining that no one else wished to testify, closed public testimony on the bill, and announced that HB 23 would be held over while the committee awaits a forthcoming proposed CS addressing the aforementioned concerns.