S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                  9843--A
 
                           I N  A S S E M B L Y
 
                             February 14, 2018
                                ___________
 
 Introduced  by M. of A. PERRY -- read once and referred to the Committee
   on Codes -- committee discharged, bill amended, ordered  reprinted  as
   amended and recommitted to said committee
 
 AN  ACT to amend the penal law, in relation to establishing the offenses
   of phishing in the third degree, phishing in  the  second  degree  and
   phishing in the first degree; and to amend the criminal procedure law,
   in  relation  to the time in which a prosecution of such offenses must
   be commenced
 
   THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section  1. Section 156.00 of the penal law is amended by adding a new
 subdivision 10 to read as follows:
   10. "MALWARE" MEANS COMPUTER SOFTWARE SPECIFICALLY DESIGNED  TO  CAUSE
 DAMAGE TO A DEVICE OR A NETWORK.
   §  2.  The  penal  law is amended by adding three new sections 156.41,
 156.42 and 156.43 to read as follows:
 § 156.41 PHISHING IN THE THIRD DEGREE.
   A PERSON IS GUILTY OF PHISHING IN THE THIRD  DEGREE  WHEN  HE  OR  SHE
 SENDS AN EMAIL TO AN INDIVIDUAL:
   1. URGING THE INDIVIDUAL TO:
   A.  SEND  MONEY TO THE PERSON OR TO A THIRD-PARTY ACCOUNT TO WHICH THE
 PERSON HAS ACCESS;
   B. DOWNLOAD AN ATTACHMENT WHICH CONTAINS MALWARE INFECTING  THE  INDI-
 VIDUAL'S COMPUTER OR ELECTRONIC DEVICE; OR
   C. CLICK ON A LINK WHICH REDIRECTS THE INDIVIDUAL TO A WEBSITE REQUIR-
 ING THE INDIVIDUAL TO INPUT HIS OR HER LOGIN CREDENTIALS, BANKING INFOR-
 MATION, OR PERSONAL INFORMATION OR WHICH CAUSES MALWARE TO AUTOMATICALLY
 BE DOWNLOADED ONTO THE INDIVIDUAL'S COMPUTER OR ELECTRONIC DEVICE;
   2. WITH THE INTENT TO:
   A.  STEAL SUCH PERSON'S LOGIN CREDENTIALS, PASSWORDS, MONEY, FINANCIAL
 OR PERSONAL INFORMATION; OR
   B. INTRODUCE A MALWARE ATTACK ON SUCH PERSON'S COMPUTER DATA.
   PHISHING IN THE THIRD DEGREE IS A CLASS A MISDEMEANOR.
 § 156.42 PHISHING IN THE SECOND DEGREE.
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
              

                       [ ] is old law to be omitted.
                                                            LBD14017-03-8

 A. 9843--A                          2
 
   A PERSON IS GUILTY OF PHISHING IN THE SECOND DEGREE  WHEN  HE  OR  SHE
 COMMITS THE CRIME OF PHISHING IN THE THIRD DEGREE AND CAUSES AN INDIVID-
 UAL  TO  SEND  MONEY  IN THE AGGREGATE EXCEEDING FIVE HUNDRED DOLLARS OR
 CAUSES DAMAGE TO THE INDIVIDUAL'S COMPUTER OR ELECTRONIC DEVICE  OR  THE
 LOSS  OF  DATA  IN  AN  AMOUNT  IN  THE AGGREGATE EXCEEDING FIVE HUNDRED
 DOLLARS.
   PHISHING IN THE SECOND DEGREE IS A CLASS E FELONY.
 § 156.43 PHISHING IN THE FIRST DEGREE.
   A PERSON IS GUILTY OF PHISHING IN THE FIRST  DEGREE  WHEN  HE  OR  SHE
 COMMITS THE CRIME OF PHISHING IN THE THIRD DEGREE AND CAUSES AN INDIVID-
 UAL  TO  SEND  MONEY  IN THE AGGREGATE EXCEEDING TWO THOUSAND DOLLARS OR
 CAUSES DAMAGE TO THE INDIVIDUAL'S COMPUTER OR ELECTRONIC DEVICE  OR  THE
 LOSS  OF  DATA  IN  AN  AMOUNT  IN  THE AGGREGATE EXCEEDING TWO THOUSAND
 DOLLARS.
   PHISHING IN THE FIRST DEGREE IS A CLASS D FELONY.
   § 3. Subdivision 3 of section 30.10 of the criminal procedure  law  is
 amended by adding a new paragraph (h) to read as follows:
   (H)  A  PROSECUTION  FOR  PHISHING  IN  THE FIRST DEGREE AS DEFINED IN
 SECTION 156.43, PHISHING IN THE SECOND  DEGREE  AS  DEFINED  IN  SECTION
 156.42  OR  PHISHING IN THE THIRD DEGREE AS DEFINED IN SECTION 156.41 OF
 THE PENAL LAW MAY BE COMMENCED WITHIN TWENTY YEARS AFTER THE  COMMISSION
 THEREOF.
   § 4. This act shall take effect on the first of November next succeed-
 ing the date upon which it shall have become a law.