Section 33.023 is the Texas ransomware statute, added in 2017. It covers two distinct kinds of conduct: altering data in transit, and introducing ransomware.
What the Statute Says
(a) In this section, "ransomware" means a computer contaminant or lock that restricts access by an unauthorized person to a computer, computer system, or computer network or any data in a computer, computer system, or computer network under circumstances in which a person demands money, property, or a service to remove the computer contaminant or lock, restore access to the computer, computer system, computer network, or data, or otherwise remediate the impact of the computer contaminant or lock.
(b) A person commits an offense if the person intentionally alters data as it transmits between two computers in a computer network or computer system through deception and without a legitimate business purpose.
(c) A person commits an offense if the person intentionally introduces ransomware onto a computer, computer network, or computer system through deception and without a legitimate business purpose.
Grading
The offense is graded by the aggregate amount involved — the value of the loss caused — in the same manner as other Chapter 33 offenses, running from misdemeanor levels at the lowest amounts through the felony grades as loss increases. The statute also addresses circumstances involving government and critical infrastructure systems.
Because loss drives the grade, the loss calculation is the most contested issue in almost every case: remediation costs, downtime, consultant fees, and claimed lost revenue are frequently aggregated aggressively.
The Three Elements Worth Attacking
Intentionally. Not recklessly, not negligently. Misconfigured software, a forwarded attachment opened by someone else, and compromised credentials used by a third party are not intentional acts by the account holder.
Through deception. This is a distinct element and it is often overlooked. The statute requires that the alteration or introduction be accomplished through deception. Conduct that involved no deceptive act — using credentials openly held, or acting through an authorized channel — may not satisfy it.
Without a legitimate business purpose. Security research, contracted penetration testing, authorized IT maintenance, network management by providers, and monitoring performed under an employment or service agreement are all legitimate purposes. Documentation of scope and authorization is the defense.
Attribution Is the Practical Battleground
These prosecutions rest on digital forensics. IP addresses identify connections rather than people; VPNs, shared networks, compromised machines used as relays, and spoofed accounts are ordinary features of the landscape. An independent defense forensic examination is essential, and the State's own extraction reports frequently contain the material that establishes reasonable doubt.
Federal Exposure
Ransomware is a federal enforcement priority. Charges under the Computer Fraud and Abuse Act and related statutes carry substantially heavier penalties, and federal investigators are usually involved before a state charge appears. See our federal criminal defense page.
Related
- Breach of computer security (33.02) · Electronic access interference (33.022)
- Houston federal criminal defense
Charged in Harris County?
Brian Foley is Board Certified in Criminal Law by the Texas Board of Legal Specialization and a former Harris County Felony Chief Prosecutor; Luis Baez is a former Trial Bureau Chief. Call or text (713) 703-1718 for a free, confidential consultation.