Sec. 324.055.  UNAUTHORIZED CREATION OF, ACCESS TO, OR USE OF ZOMBIES OR BOTNETS; PRIVATE ACTION.  (a)  In this section:
(1)  "Internet service provider" means a person providing connectivity to the Internet or another wide area network.
(2)  "Person" has the meaning assigned by Section 311.005, Government Code.
(b)  A person who is not the owner or operator of the computer may not knowingly cause or offer to cause a computer to become a zombie or part of a botnet.
(c)  A person may not knowingly create, have created, use, or offer to use a zombie or botnet to:
(1)  send an unsolicited commercial electronic mail message, as defined by Section 321.001;
(2)  send a signal to a computer system or network that causes a loss of service to users;
(3)  send data from a computer without authorization by the owner or operator of the computer;
(4)  forward computer software designed to damage or disrupt another computer or system;
(5)  collect personally identifiable information; or
(6)  perform an act for another purpose not authorized by the owner or operator of the computer.
(d)  A person may not:
(1)  purchase, rent, or otherwise gain control of a zombie or botnet created by another person; or
(2)  sell, lease, offer for sale or lease, or otherwise provide to another person access to or use of a zombie or botnet.
(e)  The following persons may bring a civil action against a person who violates this section:
(1)  a person who is acting as an Internet service provider and whose network is used to commit a violation under this section; or
(2)  a person who has incurred a loss or disruption of the conduct of the person's business, including for-profit or not-for-profit activities, as a result of the violation.
(f)  A person bringing an action under this section may, for each violation:
(1)  seek injunctive relief to restrain a violator from continuing the violation;
(2)  subject to Subsection (g), recover damages in an amount equal to the greater of:
(A)  actual damages arising from the violation; or
(B)  $100,000 for each zombie used to commit the violation; or
(3)  obtain both injunctive relief and damages.
(g)  The court may increase an award of damages, statutory or otherwise, in an action brought under this section to an amount not to exceed three times the applicable damages if the court finds that the violations have occurred with such a frequency as to constitute a pattern or practice.
(h)  A plaintiff who prevails in an action brought under this section is entitled to recover court costs and reasonable attorney's fees, reasonable fees of experts, and other reasonable costs of litigation.
(i)  A remedy authorized by this section is not exclusive but is in addition to any other procedure or remedy provided for by other statutory or common law.
(j)  Nothing in this section may be construed to impose liability on the following persons with respect to a violation of this section committed by another person:
(1)  an Internet service provider;
(2)  a provider of interactive computer service, as defined by Section 230, Communications Act of 1934 (47 U.S.C. Section 230);
(3)  a telecommunications provider, as defined by Section 51.002, Utilities Code; or
(4)  a video service provider or cable service provider, as defined by Section 66.002, Utilities Code.
Added by Acts 2009, 81st Leg., R.S., Ch. 718 (S.B. 28), Sec. 4, eff. September 1, 2009.