Bill Summary – FastDemocracy

Fiscal Note
                                        Fiscal Services Division
HF 143 – Ransomware Crimes (LSB1266HV.1)
Staff Contact: Isabel Waller (515.281.6561) isabel.waller@legis.iowa.gov
Fiscal Note Version – Final Action
Description
House File 143 amends Iowa Code chapter 715 to include ransomware protections and
provides penalties for ransomware crimes.
The Bill adopts the definition of ransomware and other terms.
Under the Bill, a person is prohibited from intentionally, willfully, and without authorization
engaging in the following activities:
• Access, attempt to access, cause to be accessed, or exceed the person’s authorized access
   to all or a part of a computer network, computer control language, computer, computer
   software, computer system, or computer database.
• Copy, attempt to copy, possess, or attempt to possess the contents of all or part of a
   computer database accessed as described above.
A person is prohibited from committing the acts listed above with the following intent:
• To cause the malfunction or interruption of the operation of all or any part of a computer,
   computer network, computer control language, computer software, computer system,
   computer service, or computer data.
• To alter, damage, or destroy all or any part of data or a computer program stored,
   maintained, or produced by a computer, computer network, computer software, computer
   system, computer service, or computer database.
A person is prohibited from intentionally, willfully, and without authorization engaging in the
following activities:
• Possess, identify, or attempt to identify a valid computer access code.
• Publicize or distribute a valid computer access code to an unauthorized person.
A person is prohibited from committing an act prohibited by the Bill with the intent to interrupt or
impact the functioning of various entities, as listed in the Bill.
The Bill creates an exception for the use of ransomware for research purposes. However, a
person is prohibited from knowingly possessing ransomware with the intent to introduce it into
the computer, computer network, or computer system of another person without the
authorization of the owner.
A violation of the provisions of the Bill is punishable as follows:
• A violation that causes pecuniary losses involving less than $10,000 to the victim is an
    aggravated misdemeanor.
• A violation that causes pecuniary losses involving at least $10,000 but less than $50,000 to
    the victim is a Class D felony.
                                                  1
•   A violation that causes pecuniary losses involving at least $50,000 to the victim is a Class C
    felony.
The Bill also permits a person injured by a violation of the Bill to bring a civil action.
The Bill also establishes additional exceptions to the prohibitions in Iowa Code chapter 715
related to computer spyware and malware.
Background
An aggravated misdemeanor is punishable by confinement of up to two years and a fine of at
least $855 but not more than $8,540. A Class D felony is punishable by confinement of up to
five years and a fine of at least $1,025 but not more than $10,245. A Class C felony is
punishable by confinement of up to 10 years and a fine of at least $1,370 but not more than
$13,660.
Assumptions
• The following will not change over the projection period: charge, conviction, and sentencing
   patterns and trends; prisoner length of stay (LOS); revocation rates; plea bargaining; and
   other criminal justice system policies and practices.
• A lag effect of six months is assumed from the effective date of this Bill to the date of first
   entry of affected offenders into the correctional system.
• Marginal costs for county jails cannot be estimated due to a lack of data. For purposes of
   this analysis, the marginal cost for county jails is assumed to be $50 per day.
Correctional Impact
House File 143 establishes new criminal offenses. As a result, the correctional impact is difficult
for the Department of Corrections (DOC) and the Division of Criminal and Juvenile Justice
Planning (CJJP) of the Department of Human Rights to estimate. However, the Bill expands on
the crimes in Iowa Code section 715.7, and charges and convictions currently under this section
are rare. Because related crimes are rare, HF 143 is estimated to have a minimal correctional
impact. Refer to the Legislative Services Agency (LSA) memo addressed to the General
Assembly, Cost Estimates Used for Correctional Impact Statements, dated
January 20, 2023, for information related to the correctional system.
Minority Impact
House File 143 establishes new criminal offenses. As a result, the CJJP cannot use prior
existing data to estimate the minority impact of the Bill. However, as the correctional impact is
estimated to be minimal, the minority impact of the Bill would likely be minimal. Refer to the
LSA memo addressed to the General Assembly, Minority Impact Statement, dated
January 20, 2023, for information related to minorities in the criminal justice system.
Fiscal Impact
House File 143 establishes new criminal offenses, and the fiscal impact cannot be estimated.
However, as the correctional impact is estimated to be minimal, the fiscal impact of the Bill
would likely be minimal. Table 1 shows the average State cost per offense for a Class C felony,
a Class D felony, and an aggravated misdemeanor. Potential impacts to the State General
Fund include operating costs incurred by the Judicial Branch, the Indigent Defense Fund, and
the DOC. Any costs would be incurred across multiple fiscal years for prison and parole
supervision.
                                                   2
                              Table 1 — Average State Cost Per Offense
                                  Class C Felony                $12,100 to $25,100
                                  Class D Felony                 $9,500 to $17,400
                            Aggravated Misdemeanor                $5,000 to $9,600
Sources
Criminal and Juvenile Justice Planning Division, Department of Human Rights
Department of Corrections
Legislative Services Agency
                                                                               /s/ Jennifer Acton
                                                                                  May 8, 2023
Doc ID 1371879
The fiscal note for this Bill was prepared pursuant to Joint Rule 17 and the Iowa Code. Data used in developing this
fiscal note is available from the Fiscal Services Division of the Legislative Services Agency upon request.
                                                 www.legis.iowa.gov
                                                          3
Statutes affected: 
Introduced: 715.2, 715.3, 715.5, 715.6, 715.4, 715.8
Reprinted: 715.2, 715.3, 715.5, 715.6, 715.4, 715.8
Enrolled: 715.2, 715.3, 715.5, 715.6, 715.4, 715.8