Make Phishing a Crime

Section two of the bill adds § 156.41, § 156.42, and § 156.43 to the penal law. § 156.41 of penal law creates the crime of phishing in the third degree when a person sends an email to another individual urging them to send money to the person or to a third-party account to which the person has access, download an attachment which contains malware infecting the individual's computer or electronic device, or click on a link which redirects the individual to a website requiring the individ- ual to input his or her login credentials, banking information, or personal information or which causes malware to automatically be down- loaded onto the individual's computer or electronic device with the intent to either steal such person's login credentials, passwords, money, financial or personal information or introduce a malware attack on such person's computer data. Phishing in the third degree is classi- fied as a class A misdemeanor.

§ 156.42 of the penal law creates the crime of phishing in the second degree when a person commits the crime of phishing in the third degree and causes an individual to send money in the aggregate exceeding $500 or damages the individual's computer or electronic device or causes the loss of data in an amount in the aggregate exceeding $500. Phishing in the second degree is classified as a class E felony.

§ 156.43 of the penal law creates the crime of phishing in the first degree when a person commits the crime of phishing in the third degree and causes an individual to send money in the aggregate exceeding $2,000 or damages the individual's computer or electronic device or causes the loss of data in an amount in the aggregate exceeding $2,000. Phishing in the first degree is classified as a class D felony.

Section three of the bill adds paragraph (h) to subdivision three of § 30.10 of the penal law to provide a twenty year statute of limitation for the prosecution of phishing in the first, second, or third degree.

Section four of the bill provides the effective date.

Justification

The internet has brought about an explosion of opportunist looking to exploit the public by committing cybercrimes such as spam emails and phishing attacks operating in the dark web.

Spam emails are unsolicited bulk messages typically sent by spambots, which are automated programs that search the internet looking for email addresses. Spammers then create email distribution lists which typically send an email to millions of email addresses which can be used to, amongst other things, promote scams which may utilize a phishing attack.

Phishing is the fraudulent practice of sending emails purporting to be from reputable source in order to induce individuals to reveal personal information, such as passwords and credit card numbers. Many times the email pressures or entices the person to download an attachment or open a link to a website (which is designed to mimic the site of a legitimate business) by telling the person that they will face some difficulty if they don't, such as their account being frozen. This is done to trick the person into divulging or providing their personal and financial information, including, but not limited to, passwords, account IDs, credit card information, and personal health information. The attachment or fake website may also install malware onto a person's device which is meant to obtain access to or steal the aforementioned information or other information on the device or network the device is connected to.

New York would not be alone in combatting cybercrimes. In 2016, Washing- ton State enacted legislation which addressed various types of cyber- crimes, including those related to phishing and malware. 12 other states have imposed criminal penalties for committing cybercrimes. Other states, including New Jersey, Pennsylvania, and South Carolina, have introduced legislation to try and tackle the phishing problem.

According to Symantec Corporation (Symantec), which provides security against cyberattacks, July 2017 found that 55.3% of all emails globally were spam email, a rate which was expected to continue to increase, and saw the phishing rate grow to 1 in 1,968 emails. Symantec also found that 1 out of every 9 email users encounter email malware in the first half of 2017.

Internet crime can be a profitable business. The FBI's 2016 Internet Crime Report found that there were almost 20,000 victims of phishing attacks in 2016 resulting in losses in excess of $31 million. This does not include targets of malware, scareware, or ransomware which impacted another 5,000 victims, resulting in losses exceeding an additional $6 million.

Unfortunately, perpetrators of cyberattacks are difficult to identify, locate, and apprehend. Quite often, the person committing a cybercrime is doing so outside the jurisdiction of the United States. As such, even though police investigators may amass strong legal evidence to verify the identity and location of the cybercriminal, many times law enforce- ment has no legal ability to arrest the person. Therefore, because such individuals are difficult to bring into custody, the typical statute of limitations in New York State of 3-5 years for a misdemeanor or felony is an insufficient timeframe and is required to be substantially longer which this legislation accordingly provides for. Because cybercriminals operate in the dark web, making it almost impossible to pinpoint their location, the difficulty in identifying and apprehending them within a reasonable timeframe means that they are assured of getting away with the crime simply because investigators lose their lead and the case goes cold.

For perpetrators of cybercrimes, a short statute of limitations for the nature of the crimes that they commit means they will almost always get away simply because they are extremely unlikely to be caught quickly enough to enable successful prosecution.This bill will serve as a deter- rent to cybercriminals committing these crimes against New Yorkers because they will know that the 20 year statute of limitations means they will face certain prosecution and will be more likely to be brought to justice by the law enforcers of the future.

Prior legislative history

None

Fiscal implications

None to the State

Effective date

First of November next succeeding the date after becoming law.