05 SB62/CSFA/2
Senate
Bill 62
By:
Senators Shafer of the 48th, Staton of the 18th, Heath of the 31st and Hill of
the 32nd
AS
PASSED SENATE
A
BILL TO BE ENTITLED
AN ACT
AN ACT
To
provide for a short title; to provide for legislative findings; to amend Article
6 of Chapter 9 of Title 16 of the Official Code of Georgia Annotated, relating
to computer systems protections, so as to add a new part to create the new crime
of initiation of deceptive commercial e-mail; to provide for definitions; to
provide for criminal penalties; to provide for civil relief and venue for civil
proceedings; to provide for certain prosecuting officials to prosecute deceptive
commercial e-mail; to provide for applicability; to provide for exceptions; to
designate specific information which may be disclosed by an electronic
communication service or a remote computing service; to authorize search
warrants or subpoenas under certain circumstances; to provide for certain
authority of law enforcement units, the Attorney General, and district
attorneys; to provide for certain
recordś
admissibility into evidence; to change provisions relating to the definition of
racketeering activity in the Georgia RICO Act; to provide for related matters;
to repeal conflicting laws; and for other purposes.
BE
IT ENACTED BY THE GENERAL ASSEMBLY OF GEORGIA:
SECTION
1.
This
Act shall be known and may be cited as the "Georgia Slam Spam E-mail
Act."
SECTION
2.
The
General Assembly finds and declares that electronic mail has become an important
and popular means of communication, relied on by millions of Georgians on a
daily basis for personal and commercial purposes. The low cost and global reach
of electronic mail make it convenient and efficient. Electronic mail serves as a
catalyst for economic development and frictionless commerce. The General
Assembly further finds that the convenience and efficiency of electronic mail is
threatened by an ever-increasing glut of deceptive commercial electronic mail.
The senders of these electronic messages engage in a variety of fraudulent and
deceptive practices to hide their identities, to disguise the true source of
their electronic mail, and to evade the criminal and civil consequences of their
actions. Deceptive commercial electronic mail imposes costs upon its ultimate
recipients who are forced to receive, review, and delete unwanted messages and
upon the electronic mail service providers forced to carry the messages. The
General Assembly further finds that our state has a paramount interest in
protecting its businesses and citizens from the deleterious effects of deceptive
commercial electronic mail, including the impermissible shifting of cost and
economic burden that results from the false and fraudulent nature of deceptive
commercial electronic mail.
Georgiás
enforcement of this interest imposes no additional burden upon the senders of
such electronic mails in relation to the laws of any other state, in that such
enforcement requires nothing more than the
senderś
forbearance from active deception.
SECTION
3.
Article
6 of Chapter 9 of Title 16 of the Official Code of Georgia Annotated, relating
to computer systems protection, is amended by striking in its entirety Code
Section 16-9-92, relating to definitions in the "Georgia Computer Systems
Protection Act," and inserting in lieu thereof the following:
"16-9-92.
As
used in this article, the term:
(1)
'Computer' means an electronic, magnetic, optical,
electrochemical,
or other high-speed data processing device or system performing computer
operations with or on data and includes any data storage facility or
communications facility directly related to or operating in conjunction with
such device; but such term does not include an automated typewriter or
typesetter, portable hand-held calculator, household appliance, or other similar
device that is not used to communicate with or to manipulate any other
computer
hydraulic,
electrochemical, or organic device or group of devices which, pursuant to a
computer program, to human instruction, or to permanent instructions contained
in the device or group of devices, can automatically perform computer operations
with or on computer data and can communicate the results to another computer or
to a person. The term includes any connected or directly related device,
equipment, or facility which enables the computer to store, retrieve, or
communicate computer programs, computer data, or the results of computer
operations to or from a person, another computer, or another device. This term
specifically includes, but is not limited to, mail servers and e-mail networks.
This term does not include a device that is not used to communicate with or to
manipulate any other
computer.
(2)
'Computer network' means a set of related, remotely connected computers and any
communications facilities with the function and purpose of transmitting data
among them through the communications facilities.
(3)
'Computer operation' means computing, classifying, transmitting, receiving,
retrieving, originating, switching, storing, displaying, manifesting, measuring,
detecting, recording, reproducing, handling, or utilizing any form of data for
business, scientific, control, or other purposes.
(4)
'Computer program' means one or more statements or instructions composed and
structured in a form acceptable to a computer that, when executed by a computer
in actual or modified form, cause the computer to perform one or more computer
operations. The term 'computer program' shall include all associated procedures
and documentation, whether or not such procedures and documentation are in human
readable form.
(5)
'Data' includes any representation of information, intelligence, or data in any
fixed medium, including documentation, computer printouts, magnetic storage
media, punched cards, storage in a computer, or transmission by a computer
network.
(6)
'Electronic communication' means any transfer of signs, signals, writing,
images, sounds, data, or intelligence of any nature transmitted in whole or in
part by a wire, radio, electromagnetic, photoelectronic, or photo-optical system
that affects interstate or foreign commerce, but does not include:
(A)
Any wire or oral communication;
(B)
Any communication made through a tone-only paging device;
(C)
Any communication from a tracking device; or
(D)
Electronic funds transfer information stored by a financial institution in a
communications system used for the electronic storage and transfer of
funds.
(7)
'Electronic communication service' means any service which provides to its users
the ability to send or receive wire or electronic communications.
(8)
'Electronic communications system' means any wire, radio, electromagnetic,
photoelectronic, photo-optical, or facilities for the transmission of wire or
electronic communications, and any computer facilities or related electronic
equipment for the electronic storage of such communications.
(9)
'Electronic means' is any device or apparatus which can be used to intercept a
wire, oral, or electronic communication other than:
(A)
Any telephone or telegraph instrument, equipment, or facility, or any component
thereof,
(i)
Furnished to the subscriber or user by a provider of electronic communication
service in the ordinary course of its business and used by the subscriber or
user in the ordinary course of its business or furnished by such subscriber or
user for connection to the facilities of such service and used in the ordinary
course of its business; or
(ii)
Used by a provider of electronic communication service in the ordinary course of
its business or by an investigative or law enforcement officer in the ordinary
course of his or her duties; or
(B)
A hearing aid or similar device being used to correct subnormal hearing to
better than normal.
(10)
'Electronic storage' means:
(A)
Any temporary, intermediate storage of wire or electronic communication
incidental to its electronic transmission; and
(B)
Any storage of such communication by an electronic communication service for
purposes of backup protection of such communication.
(6)(11)
'Financial instruments' includes any check, draft, money order, note,
certificate of deposit, letter of credit, bill of exchange, credit or debit
card, transaction-authorizing mechanism, or marketable security, or any computer
representation thereof.
(12)
'Law enforcement unit' means any law enforcement officer charged with the duty
of enforcing the criminal laws and ordinances of the state or of the counties or
municipalities of the state who is employed by and compensated by the state or
any county or municipality of the state or who is elected and compensated on a
fee basis. The term shall include, but not be limited to, members of the
Department of Public Safety, municipal police, county police, sheriffs, deputy
sheriffs, and agents and investigators of the Georgia Bureau of
Investigation.
(7)(13)
'Property' includes computers, computer networks, computer programs, data,
financial instruments, and services.
(14)
'Remote computing service' means the provision to the public of computer storage
or processing services by means of an electronic communications
system.
(8)(15)
'Services' includes computer time or services or data processing
services.
(9)(16)
'Use' includes causing or attempting to cause:
(A)
A computer or computer network to perform or to stop performing computer
operations;
(B)
The obstruction, interruption, malfunction, or denial of the use of a computer,
computer network, computer program, or data; or
(C)
A person to put false information into a computer.
(10)(17)
'Victim expenditure' means any expenditure reasonably and necessarily incurred
by the owner to verify that a computer, computer network, computer program, or
data was or was not altered, deleted, damaged, or destroyed by unauthorized
use.
(11)(18)
'Without authority' includes the use of a computer or computer network in a
manner that exceeds any right or permission granted by the owner of the computer
or computer
network."
SECTION
4.
Said
article is further amended by designating the existing matter thereof as Part 1
and by adding two new parts to the end of the article to read as
follows:
"Part
2
16-9-100.
As
used in this part, the term:
(1)
'Advertiser' means a person or entity that advertises through the use of
commercial e-mail.
(2)
'Automatic technical process' means the actions performed by an e-mail service
provideŕs
or telecommunications
carrieŕs
computers or computer network while acting as an intermediary between the sender
and the recipient of an e-mail.
(3)
'Commercial e-mail' means any e-mail message initiated for the purpose of
advertising or promoting the lease, sale, rental, gift, offer, or other
disposition of any property, services, or extension of credit.
(4)
'Direct consent' means that the recipient has expressly consented to receive
e-mail advertisements from the advertiser or initiator, either in response to a
clear and conspicuous request for direct consent or at the
recipient́s
own initiative.
(5)
'Domain' means any alphanumeric designation which is registered with or assigned
by any domain name registrar, domain name registry, or other domain name
registration authority as part of an electronic address on the
Internet.
(6)
'Domain owner' means, in relation to an e-mail address, the actual owner at the
time an e-mail is received at that address of a domain that appears in or
comprises a portion of the e-mail address. The registrant of a domain is
presumed to be the actual owner of that domain.
(7)
'E-mail' means an electronic message that is sent to an e-mail address and
transmitted between two or more telecommunications devices, computers, or
electronic devices capable of receiving electronic messages, whether or not the
message is converted to hard copy format after receipt, viewed upon
transmission, or stored for later retrieval. The term includes electronic
messages that are transmitted through a local, regional, or global computer
network.
(8)
'E-mail address' means a destination, commonly expressed as a string of
characters, to which e-mail can be sent or delivered. An e-mail address consists
of a user name or mailbox, the '@' symbol, and reference to a
domain.
(9)
'E-mail service provider' means any person, including an Internet service
provider, that is an intermediary in sending or receiving e-mail or that
provides to end-users of the e-mail service the ability to send or receive
e-mail.
(10)
'False or misleading,' when used in relation to a commercial e-mail, means
that:
(A)
The header information includes an originating or intermediate e-mail address,
domain name, or Internet protocol address which was obtained by means of false
or fraudulent pretenses or representations;
(B)
The header information fails to accurately identify the computer used to
initiate the e-mail;
(C)
The subject line of the e-mail is intended to mislead a recipient about a
material fact regarding the content or subject matter of the
e-mail;
(D)
The header information is altered or modified in a manner that impedes or
precludes the recipient of the e-mail or an e-mail service provider from
identifying, locating, or contacting the person who initiated the
e-mail;
(E)
The header information or content of the commercial e-mail, without
authorization and with intent to mislead, references a personal name, entity
name, trade name, mark, domain, address, phone number, or other personally
identifying information belonging to a third party in such manner as would cause
a recipient to believe that the third party authorized, endorsed, sponsored,
sent, or was otherwise involved in the transmission of the commercial
e-mail;
(F)
The header information or content of the commercial e-mail contains false or
fraudulent information regarding the identity, location, or means of contacting
the initiator of the commercial e-mail; or
(G)
The commercial e-mail falsely or erroneously states or represents that the
transmission of the e-mail was authorized on the basis of:
(i)
The
recipient́s
prior direct consent to receive the commercial e-mail; or
(ii)
A preexisting or current business relationship between the recipient and either
the initiator or advertiser.
(11)
'Header information' means those portions of an e-mail message which designate
or otherwise identify:
(A)
The sender;
(B)
All recipients;
(C)
An alternative return e-mail address, if any; and
(D)
The names or Internet protocol addresses of the computers, systems, or other
means used to send, transmit, route, or receive the e-mail message.
The
term does not include either the subject line or the content of an e-mail
message.
(12)
'Incident' means the contemporaneous initiation in violation of this part of one
or more commercial e-mails containing substantially similar
content.
(13)
'Initiate' or 'initiator' means to transmit or cause to be transmitted a
commercial e-mail, but does not include the routine transmission of the
commercial e-mail through the network or system of a telecommunications utility
or an e-mail service provider.
(14)
'Internet protocol address' means the unique numerical address assigned to and
used to identify a specific computer or computer network that is directly
connected to the Internet.
(15)
'Minor' means any person under the age of 18 years.
(16)
'Person' means a person as defined by Code Section 16-1-3 and specifically
includes any limited liability company, trust, joint venture, or other legally
cognizable entity.
(17)
'Preexisting or current business relationship,' as used in connection with the
sending of a commercial e-mail, means that the recipient has made an inquiry and
has provided his or her e-mail address, or has made an application, purchase, or
transaction, with or without consideration, regarding products or services
offered by the advertiser.
(18)
'Protected computer' means any computer that, at the time of an alleged
violation of any provision of this part involving that computer, was located
within the geographic boundaries of the State of Georgia.
(19)
'Recipient' means any addressee of a commercial e-mail advertisement. If an
addressee of a commercial e-mail has one or more e-mail addresses to which a
commercial e-mail is sent, the addressee shall be deemed to be a separate
recipient for each e-mail address to which the e-mail is sent.
(20)
'Routine transmission' means the forwarding, routing, relaying, handling, or
storing of an e-mail message through an automatic technical process. The term
shall not include the sending, or the knowing participation in the sending, of
commercial e-mail advertisements.
16-9-101.
Any
person who initiates a commercial e-mail that the person knew or should have
known to be false or misleading that is sent from, passes through, or is
received by a protected computer shall be guilty of the crime of initiation of
deceptive commercial e-mail.
16-9-102.
(a)
Any person convicted of a violation of Code Section 16-9-101 shall be guilty of
a misdemeanor and punished by a fine of not more than $1,000.00 or by
imprisonment of not more than 12 months, or both, except:
(1)
Where the volume of commercial e-mail transmitted exceeded 10,000 attempted
recipients in any 24 hour period;
(2)
Where the volume of commercial e-mail transmitted exceeded 100,000 attempted
recipients in any 30 day period;
(3)
Where the volume of commercial e-mail transmitted exceeded one million attempted
recipients in any one-year period;
(4)
Where the revenue generated from a specific commercial e-mail exceeded
$1,000.00;
(5)
Where the total revenue generated from all commercial e-mail transmitted to any
e-mail service provider or its subscribers exceeded $50,000.00; or
(6)
Where any person knowingly hires, employs, uses, or permits any minor to assist
in the transmission of commercial e-mail in violation of Code Section
16-9-101,
the
person shall be guilty of a felony and punished by a fine of not more than
$50,000.00 or by imprisonment of not more than five years, or both.
(b)
For the second conviction of Code Section 16-9-101 within a five-year period, as
measured from the dates of previous arrests for which convictions were obtained
to the date of the current arrest for which a conviction is obtained, the person
shall be guilty of a felony and punished by a fine of not more than $50,000.00
or by imprisonment of not more than five years, or both. For the purpose of this
subsection, the term 'conviction' shall include a plea of nolo
contendere.
16-9-103.
For
the purpose of venue under this part, any violation of this part shall be
considered to have been committed:
(1)
In the county of the principal place of business in this state of the owner of
an involved protected computer, computer network, or any part
thereof;
(2)
In any county in which any person alleged to have violated any provision of this
part had control or possession of any proceeds of the violation or of any books,
records, documents, or property which were used in furtherance of the
violation;
(3)
In any county in which any act was performed in furtherance of any transaction
which violated this part; and
(4)
In any county from which, to which, or through which any use of an involved
protected computer or computer network was made, whether by wires,
electromagnetic waves, microwaves, or any other means of
communication.
16-9-104.
The
Attorney General shall have concurrent jurisdiction with the district attorneys
and solicitors-general to conduct the criminal prosecution of violations of this
part.
16-9-105.
(a)
The following persons shall have standing to assert a civil action under this
part:
(1)
Any e-mail service provider whose protected computer was used to send, receive,
or transmit an e-mail that was sent in violation of this part; and
(2)
A domain owner of any e-mail address to which a deceptive commercial e-mail is
sent in violation of this part, provided that the domain owner also owns a
protected computer at which the e-mail was received.
(b)
Any person who has standing and who suffers personal, property, or economic
damage by reason of a violation of any provision of this part may initiate a
civil action for and recover the greater of:
(1)
Five thousand dollars plus expenses of litigation and reasonable
attorneýs
fees;
(2)
Liquidated damages of $1,000.00 for each offending commercial e-mail, up to a
limit of $2 million per incident, plus expenses of litigation and reasonable
attorneýs
fees; or
(3)
Actual damages, plus expenses of litigation and reasonable
attorneýs
fees.
16-9-106.
(a)
Any crime committed in violation of this part shall be considered a separate
offense.
(b)
The provisions of this part shall not be construed as limiting or precluding the
application of any other provision of law which applies to any transaction or
course of conduct which violates this part.
(c)
Nothing in this part shall be construed to limit or restrict the adoption,
implementation, or enforcement by an e-mail service provider or Internet service
provider of a policy of declining to transmit, receive, route, relay, handle, or
store certain types of e-mail.
16-9-107.
There
shall be no cause of action under this part against an e-mail service provider
on the basis of its routine transmission of any commercial e-mail over its
computer network.
Part
3
16-9-108.
(a)
In any investigation of a violation of this article or any investigation of a
violation of Code Section 16-12-100, 16-12-100.1, 16-12-100.2, 16-5-90, or
Article 8 of Chapter 9 of Title 16 involving the use of a computer in
furtherance of the act, the Attorney General or any district attorney shall have
the power to administer oaths; to call any party to testify under oath at such
investigation; to require the attendance of witnesses and the production of
books, records, and papers; and to take the depositions of witnesses. The
Attorney General or any such district attorney is authorized to issue a subpoena
for any witness or a subpoena to compel the production of any books, records, or
papers.
(b)
In case of refusal to obey a subpoena issued under this Code section to any
person and upon application by the Attorney General or district attorney, the
superior court in whose jurisdiction the witness is to appear or in which the
books, records, or papers are to be produced may issue to that person an order
requiring him or her to appear before the court to show cause why he or she
should not be held in contempt for refusal to obey the subpoena. Failure to obey
a subpoena may be punished by the court as contempt of court.
16-9-109.
(a)
Any law enforcement unit, the Attorney General, or any district attorney who is
conducting an investigation of a violation of this article or an investigation
of a violation of Code Section 16-12-100, 16-12-100.1, 16-12-100.2, 16-5-90, or
Article 8 of Chapter 9 of Title 16 involving the use of a computer in
furtherance of the act may require the disclosure by a provider of electronic
communication service or remote computing service of the contents of a wire or
electronic communication that is in electronic storage in an electronic
communications system for 180 days or less pursuant to a search warrant issued
under the provisions of Article 2 of Chapter 5 of Title 17 by a court with
jurisdiction over the offense under investigation. Such court may require the
disclosure by a provider of electronic communication service or remote computing
service of the contents of a wire or electronic communication that has been in
electronic storage in an electronic communications system for more than 180 days
as set forth in subsection (b) of this Code section.
(b)(1)
Any law enforcement unit, the Attorney General, or any district attorney may
require a provider of electronic communication service or remote computing
service to disclose a record or other information pertaining to a subscriber to
or customer of such service, exclusive of the contents of communications, only
when any law enforcement unit, the Attorney General, or any district
attorney:
(A)
Obtains a search warrant as provided in Article 2 of Chapter 5 of Title
17;
(B)
Obtains a court order for such disclosure under subsection (c) of this Code
section; or
(C)
Has the consent of the subscriber or customer to such disclosure.
(2)
A provider of electronic communication service or remote computing service shall
disclose to any law enforcement unit, the Attorney General, or any district
attorney the:
(A)
Name;
(B)
Address;
(C)
Local and long distance telephone connection records, or records of session
times and durations;
(D)
Length of service, including the start date, and types of service
utilized;
(E)
Telephone or instrument number or other subscriber number or identity, including
any temporarily assigned network address; and
(F)
Means and source of payment for such service, including any credit card or bank
account number
of
a subscriber to or customer of such service when any law enforcement unit, the
Attorney General, or any district attorney uses a subpoena authorized by Code
Section 16-9-108 or 45-15-17 or a grand jury or trial subpoena when any law
enforcement unit, the Attorney General, or any district attorney complies with
paragraph (1) of this subsection.
(3)
Any law enforcement unit, the Attorney General, or any district attorney
receiving records or information under this subsection shall not be required to
provide notice to a subscriber or customer. A provider of electronic
communication service or remote computing service shall not disclose to a
subscriber or customer the existence of any search warrant or subpoena issued
pursuant to this article nor shall a provider of electronic communication
service or remote computing service disclose to a subscriber or customer that
any records have been requested by or disclosed to any law enforcement unit, the
Attorney General, or any district attorney pursuant to this
article.
(c)
A court order for disclosure issued pursuant to (b) of this Code section may be
issued by any superior court with jurisdiction over the offense under
investigation and shall only issue such court order for disclosure if any law
enforcement unit, the Attorney General, or any district attorney offers specific
and articulable facts showing that there are reasonable grounds to believe that
the contents of an electronic communication, or the records or other information
sought, are relevant and material to an ongoing criminal investigation. A court
issuing an order pursuant to this Code section, on a motion made promptly by a
provider of electronic communication service or remote computing service, may
quash or modify such order, if compliance with such order would be unduly
burdensome or oppressive on such provider.
(d)(1)
Any records supplied pursuant to this part shall be accompanied by the affidavit
of the custodian or other qualified witness, stating in substance each of the
following:
(A)
The affiant is the duly authorized custodian of the records or other qualified
witness and has authority to certify the records;
(B)
The copy is a true copy of all the records described in the subpoena, court
order, or search warrant and the records were delivered to the attorney or the
attorneýs
representative;
(C)
The records were prepared by the personnel of the business in the ordinary
course of business at or near the time of the act, condition, or
event;
(D)
The sources of information and method and time of preparation were such as to
indicate its trustworthiness;
(E)
The identity of the records; and
(F)
A description of the mode of preparation of the records.
(2)
If the business has none or only part of the records described, the custodian or
other qualified witness shall so state in the affidavit.
(3)
If the original records would be admissible in evidence if the custodian or
other qualified witness had been present and testified to the matters stated in
the affidavit, the copy of the records shall be admissible in evidence. When
more than one person has knowledge of the facts, more than one affidavit shall
be attached to the records produced.
(4)
No later than 30 days prior to trial, a party intending to offer such evidence
produced in compliance with this subsection shall provide written notice of such
intentions to the opposing party or parties. A motion opposing the admission of
such evidence shall be filed within ten days of the filing of such notice, and
the court shall hold a hearing and rule on such motion no later than ten days
prior to trial. Failure of a party to file such motion opposing admission prior
to trial shall constitute a waiver of objection to such records and affidavit.
However, the court, for good cause shown, may grant relief from such
waiver."
SECTION
5.
Said
title is further amended in Code Section 16-14-3, relating to definitions
relative to the "Georgia RICO (Racketeer Influenced and Corrupt Organizations)
Act," by striking the word "or" at the end of division (9)(A)(xxxvii), by
striking the symbol "." at the end of division (9)(A)(xxxviii) and inserting in
lieu thereof the symbol and word "; or", and by adding a new division
(9)(A)(xxxix) to read as follows:
"(xxxix)
Code Section 16-9-101, relating to deceptive commercial
e-mail."
SECTION
6.
All
laws and parts of laws in conflict with this Act are repealed.