By now, we’re all aware of last week’s crisis that caused people to hurry to the pumps and fill up on gas. If not, here’s the news: a hacker group launched a ransomware attack on Colonial Pipeline, a company that operates pipelines for gasoline, causing shortages of gas and panic buying on the east coast. Most likely, any criminal action against the group will happen at the federal level, but this post highlights relevant North Carolina laws that could apply if this or any similar acts are prosecuted within this jurisdiction.
Hacking and ransomware
Hacking refers to the act of gaining unauthorized or illegal access to a computer network or system. Hackers gain access to sensitive or otherwise private information by exploiting weaknesses in computer security systems. The hackers then install ransomware or other viruses on the system to achieve an intended goal. Ransomware is a type of malicious software (or malware) used by hackers that is designed to block access to a computer system until money is paid (think remotely holding a computer hostage).
Although “hacking” and “ransomware” are widely used terms, they are not referenced in the North Carolina statutes as such. Even so, our laws proscribe several acts that could involve hacking and using ransomware or other malware.
Computer-related crime statutes
North Carolina’s computer-related crimes are in Article 60 of Chapter 14 of the General Statutes and include the following offenses:
Accessing computers, G.S. 14-454
This offense involves willfully accessing or causing to be accessed a computer, computer program, computer network, or any part thereof for fraudulent purposes or for the purpose of obtaining property or services by means of false pretenses. The offense is a Class G felony if the fraud results in more than $1,000 in damage or if the property or services obtained are worth more than $1,000. Otherwise, the offense is a Class 1 misdemeanor.
Accessing government computers, G.S. 14-454.1
This mirrors the above offense, but specifically applies to government computers. G.S. 14-453 defines “government computer” as any computer, computer program, computer system, computer network, or any part thereof, that is owned, operated, or used by any State or local governmental entity.
Accessing government computers, when committed for the purpose of fraud or obtaining property or services, is a Class F felony. When committed for any purpose other than fraud or obtaining property or services, the offense is a Class H felony. Accessing any educational testing material or academic or vocational testing scores or grades that are in a government computer is a Class 1 misdemeanor.
Damaging computers, computer programs, computer systems, computer networks, and resources, G.S. 14-455
This offense involves willfully and without authorization altering, damaging, or destroying a computer, computer program, computer system, computer network, or any part thereof. The offense is a Class G felony if the damage caused by the alteration, damage, or destruction is more than one thousand dollars ($1,000). Altering, damaging, or destroying a government computer is a Class F felony. Any other violation is a Class 1 misdemeanor.
Denial of computer services to an authorized user, G.S. 14-456
Another offense involves willfully and without authorization denying or causing the denial of computer, computer program, computer system, or computer network services to an authorized user of the computer, computer program, computer system, or computer network services. The offense is a Class 1 misdemeanor.
Denial of government computer services to an authorized user, G.S. 14-456.1
This offense mirrors the above offense, but specifically applies to government computer services. The offense is a Class H felony.
Extortion, G.S. 14-457
This offense involves maliciously threatening to alter, damage, or destroy a computer, computer program, computer system, computer network, or any part thereof with the intent to extort money or any pecuniary advantage, or with the intent to compel any person to do or refrain from doing any act against his will. The offense is a Class H felony.
Computer trespass, G.S. 14-458
This final, related offense involves using a computer or computer network without authority and with the intent to:
- temporarily or permanently remove, halt, or otherwise disable any computer data, computer programs, or computer software from a computer or computer network,
- cause a computer to malfunction,
- alter or erase any computer data, computer programs, or computer software,
- cause physical injury to the property of another,
- make or cause to be made an unauthorized copy of computer data, computer programs, or computer software residing in, communicated by, or produced by a computer or computer network, or
- falsely identify with the intent to deceive or defraud the recipient or forge commercial electronic mail transmission information or other routing information in connection with the transmission of unsolicited bulk commercial electronic mail through or into the computer network of an electronic mail service provider or its subscribers. (Think phishing or spoofing).
The offense is a Class 3 misdemeanor. If there is damage to the property of another and the damage caused by the prohibited acts is valued at less than $2,500, the offense is punished as a Class 1 misdemeanor. If the damage is valued at $2,500 or more, the offense is punished as a Class I felony.
Each of the above crimes also applies to the introduction of a computer program into a computer, computer program, computer system, or computer network to effectuate the crime. Thus, introduction of ransomware and malware would be covered by these statutes.
This is just an introduction to the statutes, and I plan on exploring these crimes in more detail later on. In the meantime, if you have questions about any of these offenses, please feel free to send me an email at firstname.lastname@example.org.