Tex. Business & Commerce Code § 324.055
This is the official text of Tex. Business & Commerce Code § 324.055, part of Texas’s Business & Commerce Code — governs commercial transactions and general business practices.
Not legal advice. This page reproduces the official text of a government statute for reference only. Laws change, and how a statute applies depends on your specific facts. For advice about your situation, consult a licensed attorney in your state.
§ 324.055. UNAUTHORIZED CREATION OF, ACCESS TO, OR USE OF ZOMBIES OR BOTNETS; PRIVATE ACTION.
Official statutory text
(a) In this section:
(1) "Internet service provider" means a person providing connectivity to the Internet or another wide area network.
(2) "Person" has the meaning assigned by Section 311.005, Government Code.
(b) A person who is not the owner or operator of the computer may not knowingly cause or offer to cause a computer to become a zombie or part of a botnet.
(c) A person may not knowingly create, have created, use, or offer to use a zombie or botnet to:
(1) send an unsolicited commercial electronic mail message, as defined by Section 321.001;
(2) send a signal to a computer system or network that causes a loss of service to users;
(3) send data from a computer without authorization by the owner or operator of the computer;
(4) forward computer software designed to damage or disrupt another computer or system;
(5) collect personally identifiable information; or
(6) perform an act for another purpose not authorized by the owner or operator of the computer.
(d) A person may not:
(1) purchase, rent, or otherwise gain control of a zombie or botnet created by another person; or
(2) sell, lease, offer for sale or lease, or otherwise provide to another person access to or use of a zombie or botnet.
(e) The following persons may bring a civil action against a person who violates this section:
(1) a person who is acting as an Internet service provider and whose network is used to commit a violation under this section; or
(2) a person who has incurred a loss or disruption of the conduct of the person's business, including for-profit or not-for-profit activities, as a result of the violation.
(f) A person bringing an action under this section may, for each violation:
(1) seek injunctive relief to restrain a violator from continuing the violation;
(2) subject to Subsection (g), recover damages in an amount equal to the greater of:
(A) actual damages arising from the violation; or
(B) $100,000 for each zombie used to commit the violation; or
(3) obtain both injunctive relief and damages.
(g) The court may increase an award of damages, statutory or otherwise, in an action brought under this section to an amount not to exceed three times the applicable damages if the court finds that the violations have occurred with such a frequency as to constitute a pattern or practice.
(h) A plaintiff who prevails in an action brought under this section is entitled to recover court costs and reasonable attorney's fees, reasonable fees of experts, and other reasonable costs of litigation.
(i) A remedy authorized by this section is not exclusive but is in addition to any other procedure or remedy provided for by other statutory or common law.
(j) Nothing in this section may be construed to impose liability on the following persons with respect to a violation of this section committed by another person:
(1) an Internet service provider;
(2) a provider of interactive computer service, as defined by Section 230, Communications Act of 1934 (47 U.S.C. Section 230);
(3) a telecommunications provider, as defined by Section 51.002, Utilities Code; or
(4) a video service provider or cable service provider, as defined by Section 66.002, Utilities Code.
(1) "Internet service provider" means a person providing connectivity to the Internet or another wide area network.
(2) "Person" has the meaning assigned by Section 311.005, Government Code.
(b) A person who is not the owner or operator of the computer may not knowingly cause or offer to cause a computer to become a zombie or part of a botnet.
(c) A person may not knowingly create, have created, use, or offer to use a zombie or botnet to:
(1) send an unsolicited commercial electronic mail message, as defined by Section 321.001;
(2) send a signal to a computer system or network that causes a loss of service to users;
(3) send data from a computer without authorization by the owner or operator of the computer;
(4) forward computer software designed to damage or disrupt another computer or system;
(5) collect personally identifiable information; or
(6) perform an act for another purpose not authorized by the owner or operator of the computer.
(d) A person may not:
(1) purchase, rent, or otherwise gain control of a zombie or botnet created by another person; or
(2) sell, lease, offer for sale or lease, or otherwise provide to another person access to or use of a zombie or botnet.
(e) The following persons may bring a civil action against a person who violates this section:
(1) a person who is acting as an Internet service provider and whose network is used to commit a violation under this section; or
(2) a person who has incurred a loss or disruption of the conduct of the person's business, including for-profit or not-for-profit activities, as a result of the violation.
(f) A person bringing an action under this section may, for each violation:
(1) seek injunctive relief to restrain a violator from continuing the violation;
(2) subject to Subsection (g), recover damages in an amount equal to the greater of:
(A) actual damages arising from the violation; or
(B) $100,000 for each zombie used to commit the violation; or
(3) obtain both injunctive relief and damages.
(g) The court may increase an award of damages, statutory or otherwise, in an action brought under this section to an amount not to exceed three times the applicable damages if the court finds that the violations have occurred with such a frequency as to constitute a pattern or practice.
(h) A plaintiff who prevails in an action brought under this section is entitled to recover court costs and reasonable attorney's fees, reasonable fees of experts, and other reasonable costs of litigation.
(i) A remedy authorized by this section is not exclusive but is in addition to any other procedure or remedy provided for by other statutory or common law.
(j) Nothing in this section may be construed to impose liability on the following persons with respect to a violation of this section committed by another person:
(1) an Internet service provider;
(2) a provider of interactive computer service, as defined by Section 230, Communications Act of 1934 (47 U.S.C. Section 230);
(3) a telecommunications provider, as defined by Section 51.002, Utilities Code; or
(4) a video service provider or cable service provider, as defined by Section 66.002, Utilities Code.
Status: in_force · Read it on the official government site
Dealing with a business matter in Texas?
See all Texas Business lawyers
About this page: Statute text is reproduced from official government publishers via the
Open US Law dataset
(Vaquill AI, snapshot v2026.08, CC BY 4.0). Primary legislative text like this is public domain under the government-edicts doctrine
(Georgia v. Public.Resource.Org, 2020). We link every section back to its official source so you can verify it independently.