Senate Sends Bipartisan Bill to Combat "Ransomware" to Governor Brown

Thursday, August 25, 2016

SACRAMENTO – The California State Senate today unanimously approved Senate Bill 1137 authored by Democratic Senator Bob Hertzberg (D-Van Nuys) and co-authored by Republican Senator Patricia Bates (R-Laguna Niguel) and others that would make “ransomware” the criminal equivalent of extortion. It would be a crime punishable by up to four years in jail. The Assembly approved the bill on Tuesday and will next go to Governor Jerry Brown for his consideration.

“With cyber-attacks becoming more frequent, it’s important to update the law to give state law enforcement every tool they need to combat ransomware,” said Bates. “I applaud Senator Hertzberg for his bipartisan leadership on this issue and am hopeful Governor Brown will sign the bill into law in the near future.”

Ransomware involves infecting a user’s computer with a virus that locks it until a ransom is paid. Senate Bill 1137 would define “ransomware” in state law and make it a crime to introduce it into any computer, system or network. The range of punishment (up to four years imprisonment) is equivalent to the punishment under current law for extortion.

Earlier this year, the Orange County Transportation Authority spent $660,000 to fix servers that were held for ransom by unknown hackers. In another case, Hollywood Presbyterian Medical Center paid a $17,000 ransom in bitcoin to a hacker who seized control of the hospital's computer systems and would give back access only when the money was paid. In addition, computer systems at two Southern California hospitals were held hostage by hackers after being hit with ransomware. While patient records were not compromised, such attacks have become more common and more brazen.

Last year's 2,453 reports of ransomware hackings to the FBI totaled a reported loss of $24.1 million, making up nearly one-third of the complaints over the past decade. They also represented 41 percent of the $57.6 million in reported losses since 2005.

SB 1137 is supported by TechNet, Los Angeles County District Attorney Jackie Lacey, Association of Orange County Deputy Sheriffs, California Statewide Law Enforcement Association, California State Sheriffs’ Association, California Police Chiefs Association and other organizations.