This section makes it an offense to intentionally tamper with data in transit or introduce ransomware, when done through deception and without a legitimate business purpose.
Sec. 33.023. ELECTRONIC DATA TAMPERING. (a) In this section, "ransomware" means a computer contaminant or lock that restricts access by an unauthorized person to a computer, computer system, or computer network or any data in a computer, computer system, or computer network under circumstances in which a person demands money, property, or a service to remove the computer contaminant or lock, restore access to the computer, computer system, computer network, or data, or otherwise remediate the impact of the computer contaminant or lock. (b) A person commits an offense if the person intentionally alters data as it transmits between two computers in a computer network or computer system through deception and without a legitimate business purpose. (c) A person commits an offense if the person intentionally introduces ransomware onto a computer, computer network, or computer system through deception and without a legitimate business purpose. (d) Subject to Subsections (d-1) and (d-2), an offense under this section is a Class C misdemeanor. (d-1) Subject to Subsection (d-2), if it is shown on the trial of the offense that the defendant acted with the intent to defraud or harm another, an offense under this section is: (1) a Class C misdemeanor if the aggregate amount involved is less than $100 or cannot be determined; (2) a Class B misdemeanor if the aggregate amount involved is $100 or more but less than $750; (3) a Class A misdemeanor if the aggregate amount involved is $750 or more but less than $2,500; (4) a state jail felony if the aggregate amount involved is $2,500 or more but less than $30,000; (5) a felony of the third degree if the aggregate amount involved is $30,000 or more but less than $150,000; (6) a felony of the second degree if the aggregate amount involved is $150,000 or more but less than $300,000; and (7) a felony of the first degree if the aggregate amount involved is $300,000 or more. (d-2) If it is shown on the trial of the offense that the defendant knowingly restricted a victim's access to privileged information, an offense under this section is: (1) a state jail felony if the value of the aggregate amount involved is less than $2,500; (2) a felony of the third degree if: (A) the value of the aggregate amount involved is $2,500 or more but less than $30,000; or (B) a client or patient of a victim suffered harm attributable to the offense; (3) a felony of the second degree if: (A) the value of the aggregate amount involved is $30,000 or more but less than $150,000; or (B) a client or patient of a victim suffered bodily injury attributable to the offense; and (4) a felony of the first degree if: (A) the value of the aggregate amount involved is $150,000 or more; or (B) a client or patient of a victim suffered serious bodily injury or death attributable to the offense. (e) When benefits are obtained, a victim is defrauded or harmed, or property is altered, appropriated, damaged, or deleted in violation of this section, whether or not in a single incident, the conduct may be considered as one offense and the value of the benefits obtained and of the losses incurred because of the fraud, harm, or alteration, appropriation, damage, or deletion of property may be aggregated in determining the grade of the offense. (f) A person who is subject to prosecution under this section and any other section of this code may be prosecuted under either or both sections. (g) Software is not ransomware for the purposes of this section if the software restricts access to data because: (1) authentication is required to upgrade or access purchased content; or (2) access to subscription content has been blocked for nonpayment. Added by Acts 2017, 85th Leg., R.S., Ch. 684 (H.B. 9), Sec. 3, eff. September 1, 2017.