BILL NUMBER: S3172

SPONSOR: LANZA
 
TITLE OF BILL:

An act to amend the penal law, in relation to establishing the offenses
of phishing in the third degree, phishing in the second degree and
phishing in the first degree; and to amend the criminal procedure law,
in relation to the time in which a prosecution of such offenses must be
commenced

 
PURPOSE:

To make phishing a high felony and to set the statute of limitations for
committing such crimes at twenty years.

 
SUMMARY OF PROVISIONS:

Section one of the bill adds subdivision 10 to § 156 of the penal law to
define malware as computer software specifically designed to cause
damage to a device or network.
              

Section two of the bill adds § 156.41, § 156.42, and § 156.43 to the
penal law. § 156.41 of penal law creates the crime of phishing in the
third degree when a person sends an email to another individual urging
them to send money to the person or to a third-party account to which
the person has access, download an attachment which contains malware
infecting the individual's computer or electronic device, or click on a
link which redirects the individual to a website requiring the individ-
ual to input his or her login credentials, banking information, or
personal information or which causes malware to automatically be down-
loaded onto the individual's computer or electronic device with the
intent to either steal such person's login credentials, passwords,
money, financial or personal information or introduce a malware attack
on such person's computer data. Phishing in the third degree is classi-
fied as a class A misdemeanor.

§ 156.42 of the penal law creates the crime of phishing in the second
degree when a person commits the crime of phishing in the third degree
and causes an individual to send money in the aggregate exceeding $500
or damages the individual's computer or electronic device or causes the
loss of data in an amount in the aggregate exceeding $500. Phishing in
the second degree is classified as a class E felony.

§ 156.43 of the penal law creates the crime of phishing in the first
degree when a person commits the crime of phishing in the third degree
and causes an individual to send money in the aggregate exceeding $2,000
or damages the individual's computer or electronic device or causes the
loss of data in an amount in the aggregate exceeding $2,000. Phishing in
the first degree is classified as a class D felony.

Section three of the bill adds paragraph (h) to subdivision three of §
30.10 of the penal law to provide a twenty year statute of limitation
for the prosecution of phishing in the first, second, or third degree.

Section four of the bill provides the effective date.

 
JUSTIFICATION:

The internet has brought about an explosion of opportunist looking to
exploit the public by committing cybercrimes such as spam emails and
phishing attacks operating in the dark web.

Spam emails are unsolicited bulk messages typically sent by spambots,
which are automated programs that search the internet looking for email
addresses. Spammers then create email distribution lists which typically
send an email to millions of email addresses which can be used to,
amongst other things, promote scams which may utilize a phishing attack.

Phishing is the fraudulent practice of sending emails purporting to be
from reputable source in order to induce individuals to reveal personal
information, such as passwords and credit card numbers. Many times the
email pressures or entices the person to download an attachment or open
a link to a website (which is designed to mimic the site of a legitimate
business) by telling the person that they will face some difficulty if
they don't, such as their account being frozen. This is done to trick
the person into divulging or providing their personal and financial
information, including, but not limited to, passwords, account IDs,
credit card information, and personal health information. The attachment
or fake website may also install malware onto a person's device which is
meant to obtain access to or steal the aforementioned information or
other information on the device or network the device is connected to.

New York would not be alone in combatting cybercrimes. In 2016, Washing-
ton State enacted legislation which addressed various types of cyber-
crimes, including those related to phishing and malware. 12 other states
have imposed criminal penalties for committing cybercrimes. Other
states, including New Jersey, Pennsylvania, and South Carolina, have
introduced legislation to try and tackle the phishing problem.

According to Symantec Corporation (Symantec), which provides security
against cyberattacks, July 2017 found that 55.3% of all emails globally
were spam email, a rate which was expected to continue to increase, and
saw the phishing rate grow to 1 in 1,968 emails.  Symantec also found
that 1 out of every 9 email users encounter email malware in the first
half of 2017.

Internet crime can be a profitable business. The FBI's 2016 Internet
Crime Report found that there were almost 20,000 victims of phishing
attacks in 2016 resulting in losses in excess of $31 million. This does
not include targets of malware, scareware, or ransomware which impacted
another 5,000 victims, resulting in losses exceeding an additional $6
million.

Unfortunately, perpetrators of cyberattacks are difficult to identify,
locate, and apprehend.  Quite often, the person committing a cybercrime
is doing so outside the jurisdiction of the United States. As such, even
though police investigators may amass strong legal evidence to verify
the identity and location of the cybercriminal, many times law enforce-
ment has no legal ability to arrest the person. Therefore, because such
individuals are difficult to bring into custody, the typical statute of
limitations in New York State of 3-5 years for a misdemeanor or felony
is an insufficient timeframe and is required to be substantially longer
which this legislation accordingly provides for. Because cybercriminals
operate in the dark web, making it almost impossible to pinpoint their
location, the difficulty in identifying and apprehending them within a
reasonable timeframe means that they are assured of getting away with
the crime simply because investigators lose their lead and the case goes
cold.

For perpetrators of cybercrimes, a short statute of limitations for the
nature of the crimes that they commit means they will almost always get
away simply because they are extremely unlikely to be caught quickly
enough to enable successful prosecution.This bill will serve as a deter-
rent to cybercriminals committing these crimes against New Yorkers
because they will know that the 20 year statute of limitations means
they will face certain prosecution and will be more likely to be brought
to justice by the law enforcers of the future.

 
PRIOR LEGISLATIVE HISTORY:

None

 
FISCAL IMPLICATIONS:

None to the State

 
EFFECTIVE DATE:
First of November next succeeding the date after becoming law.