By: West S.B. No. 1477     A BILL TO BE ENTITLED   AN ACT   relating to ransomware; creating a criminal offense.          BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:          SECTION 1.  Chapter 33, Penal Code, is amended by adding   Section 33.023 to read as follows:          Sec. 33.023.  RANSOMWARE ATTACK AND EXTORTION. (a)  In this   section:                (1)  "Privileged information" means:                      (A)  protected health information, as that term is   defined by Section 182.002, Health and Safety Code;                      (B)  information that is subject to the   attorney-client privilege; or                      (C)  information that is subject to the   accountant-client privilege under Section 901.457, Occupations   Code, or other law, if the information is on a computer, computer   network, or computer system owned by a person possessing a license   issued under Subchapter H, Chapter 901, Occupations Code.                (2)  "Ransomware" means computer software that:                      (A)  is introduced onto a computer, computer   network, or computer system; and                      (B)  prevents the owner of the computer, computer   network, or computer system, or another person with the effective   consent of the owner, from accessing information on that computer,   computer network, or computer system.           (b)  A person commits an offense if the person intentionally:                (1)  introduces ransomware or causes ransomware to be   introduced onto a computer, computer network, or computer system   without the effective consent of the owner; and                (2)  demands payment or other consideration to:                      (A)  remove the ransomware;                      (B)  restore the owner's access to the computer,   computer network, or computer system; or                      (C)  otherwise mitigate the effects of the   ransomware.          (c)  Except as provided by Subsection (d), an offense under   this section is:                (1)  a Class C misdemeanor if the value of the payment   or other consideration demanded is less than $100 or cannot be   determined;                (2)  a Class B misdemeanor if the value of the payment   or other consideration demanded is $100 or more but less than $750;                (3)  a Class A misdemeanor if the value of the payment   or other consideration demanded is $750 or more but less than   $2,500;                (4)  a state jail felony if the value of the payment or   other consideration demanded is $2,500 or more but less than   $30,000;                (5)  a felony of the third degree if the value of the   payment or other consideration demanded is $30,000 or more but less   than $150,000;                (6)  a felony of the second degree if the value of the   payment or other consideration demanded is $150,000 or more but   less than $300,000; and                (7)  a felony of the first degree if the value of the   payment or other consideration demanded is $300,000 or more.          (d)  If it is shown on the trial of the offense that the   defendant knowingly restricted a victim's access to privileged   information, an offense under this section is:                (1)  a state jail felony if the value of the payment or   other consideration demanded is less than $2,500;                (2)  a felony of the third degree if:                      (A)  the value of the payment or other   consideration demanded is $2,500 or more but less than $30,000; or                      (B)  a client or patient of a victim suffered harm   attributable to the offense;                (3)  a felony of the second degree if:                      (A)  the value of the payment or other   consideration demanded is $30,000 or more but less than $150,000;   or                      (B)  a client or patient of a victim suffered   bodily injury attributable to the offense; and                (4)  a felony of the first degree if:                      (A)  the value of the payment or other   consideration demanded is $150,000 or more; or                      (B)  a client or patient of a victim suffered   serious bodily injury or death attributable to the offense.          (e)  A person who is subject to prosecution under this   section and any other section of this code may be prosecuted under   either section or both sections.          (f)  For purposes of calculating the value of the payment or   other consideration under Subsection (c) or (d), the exchange rate   between a foreign currency and the United States dollar is   established at the earlier of:                (1)  the date the demand was made, if known; or                (2)  the date the victim became aware of the demand.          SECTION 2.  The change in law made by this Act applies only   to an offense committed on or after the effective date of this Act.     An offense committed before the effective date of this Act is   governed by the law in effect on the date the offense was committed,   and the former law is continued in effect for that purpose.  For   purposes of this section, an offense was committed before the   effective date of this Act if any element of the offense occurred   before that date.          SECTION 3.  This Act takes effect September 1, 2017.