Pennsylvania SB 415: An Act amending Title 18 (Crimes and Offenses) of the Pennsylvania Consolidated Statutes, in computer offenses, providing for the offense of ransomware; and imposing duties on the Office of Administration.

Bill Text

PRINTER'S NO. 368
THE GENERAL ASSEMBLY OF PENNSYLVANIA
SENATE BILL
No. 415
Session of
2025
INTRODUCED BY PHILLIPS-HILL, FONTANA, LAUGHLIN, STEFANO, VOGEL,
DUSH AND MASTRIANO, MARCH 10, 2025
REFERRED TO JUDICIARY, MARCH 10, 2025
AN ACT
Amending Title 18 (Crimes and Offenses) of the Pennsylvania
Consolidated Statutes, in computer offenses, providing for
the offense of ransomware; and imposing duties on the Office
of Administration.
The General Assembly of the Commonwealth of Pennsylvania
hereby enacts as follows:
Section 1. Chapter 76 of Title 18 of the Pennsylvania
Consolidated Statutes is amended by adding a subchapter to read:
SUBCHAPTER F
RANSOMWARE
Sec.
7671. Purposes of subchapter.
7672. Definitions.
7673. Prohibited actions.
7674. (Reserved).
7675. Forfeiture.
7676. Limitation of time.
7677. Notification.
7678. Payments.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

7679. Civil actions.
7680. Remedies not exclusive.
7681. Office of Administration.
§ 7671. Purposes of subchapter.
This subchapter is intended to ensure that Commonwealth
agencies have strong capabilities in place to:
(1) Prohibit persons from engaging in ransomware attacks
and from extorting payments to resolve or prevent ransomware
attacks.
(2) Prevent and detect ransomware attacks.
(3) Restore systems and captured information quickly
that were disrupted or obtained through ransomware attacks.
(4) Provide timely public notification of ransomware
attacks.
(5) Pursue and prosecute perpetrators of ransomware
attacks.
§ 7672. Definitions.
The following words and phrases when used in this subchapter
shall have the meanings given to them in this section unless the
context clearly indicates otherwise:
"Commonwealth agency." Any of the following:
(1) The Governor's Office.
( 2) A department, board, commission, authority or other
agency of the Commonwealth that is subject to the policy
supervision and control of the Governor.
(3) The office of Lieutenant Governor.
(4) An independent department.
(5) An independent agency.
(6) The General Assembly or an agency of the General
Assembly.
20250SB0415PN0368 - 2 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

"Computer contaminant." A set of computer instructions that
is designed to modify, damage, destroy, record or transmit data
held by a computer, computer system or computer network without
the intent or permission of the owner of the data.
"Independent agency." A board, commission, authority or
other agency of the Commonwealth that is not subject to the
policy supervision and control of the Governor.
"Independent department." Any of the following:
(1) The Department of the Auditor General.
(2) The Treasury Department.
(3) The Office of Attorney General.
(4) A board or commission of an entity under paragraph
(1), (2) or (3).
"Managed service provider." A third-party company that
remotely manages a customer's information technology
infrastructure and end-user systems.
"Ransomware." As follows:
(1) A computer contaminant or lock placed or introduced
without authorization into a computer, computer system or
computer network that does any of the following:
(i) Restricts access by an authorized person to the
computer, computer system or computer network or to any
data held by the computer, computer system or computer
network , under circumstances in which the person
responsible for the placement or introduction of the
computer contaminant or lock demands payment of money or
other consideration to:
(A) remove the computer contaminant or lock;
(B) restore access to the computer, computer
system, computer network or data; or
20250SB0415PN0368 - 3 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

(C) otherwise remediate the impact of the
computer contaminant or lock.
(ii) Transforms data held by the computer, computer
system or computer network into a form in which the data
is rendered unreadable or unusable without the use of a
confidential process or key.
(2) The term does not include authentication required to
upgrade or access purchased content or the blocking of access
to subscription content in the case of nonpayment for the
access.
§ 7673. Prohibited actions.
(a) Prohibition.--Except as provided in subsection (b), a
person may not, with the intent to extort money or other thing
of value from another person or a Commonwealth agency for the
purpose of removing a computer contaminant or lock, restoring
access to a computer, computer system, computer network or data
or otherwise remediating the impact of a computer contaminant or
lock:
(1) Knowingly possess ransomware .
(2) Use ransomware without the authorization of the
owner of the computer, computer system or computer network.
(3) Sell, transfer or develop ransomware.
(4) Threaten to use ransomware against another person or
a Commonwealth agency if the threat is:
(i) made in an express or implied manner; and
(ii) transmitted in person, by mail or through
facsimile, email, the Interne