BILL NUMBER: S4633

SPONSOR: LANZA
 
TITLE OF BILL:

An act to amend the penal law, in relation to establishing the offenses
of phishing in the third degree, phishing in the second degree and
phishing in the first degree; and to amend the criminal procedure law,
in relation to the time in which a prosecution of such offenses must be
commenced

 
PURPOSE:

To make phishing a high felony and to set the statute of limitations for
committing such crimes at twenty years.

 
SUMMARY OF PROVISIONS:

Section one of the bill adds subdivision 10 to § 156 of the penal law to
define malware as computer software specifically designed to cause
damage to a device or network.

              

Section two of the bill adds § 156.41, § 156.42, and § 156.43 to the
penal law. § 156.41 of penal law creates the crime of phishing in the
third degree when a person sends an email to another individual urging
them to send money to the person or to a third-party account to which
the person has access, download an attachment which contains malware
infecting the individual's computer or electronic device, or click on a
link which redirects the individual to a website requiring the individ-
ual to input his or her login credentials, banking information, or
personal information or which causes malware to automatically be down-
loaded onto the individual's computer or electronic device with the
intent to either steal such person's login credentials, passwords,
money, financial or personal information or introduce a malware attack
on such person's computer data. Phishing in the third degree is classi-
fied as a class A misdemeanor.

§ 156.42 of the penal law creates the crime of phishing in the second
degree when a person commits the crime of phishing in the third degree
and causes an individual to send money in the aggregate exceeding $500
or damages the individual's computer or electronic device or causes the
loss of data in an amount in the aggregate exceeding $500. Phishing in
the second degree is classified as a class E felony.

§ 156.43 of the penal law creates the crime of phishing in the first
degree when a person commits the crime of phishing in the third degree
and causes an individual to send money in the aggregate exceeding $2,000
or damages the individual's computer or electronic device or causes the
loss of data in an amount in the aggregate exceeding $2,000. Phishing in
the first degree is classified as a class D felony.

Section three of the bill adds paragraph (h) to subdivision three of §
30.10 of the penal law to provide a twenty year statute of limitation
for the prosecution of phishing in the first, second, or third degree.

Section four of the bill provides the effective date.

 
JUSTIFICATION:

The internet has brought about an explosion of opportunist looking to
exploit the public by committing cybercrimes such as spam emails and
phishing attacks operating in the dark web. Spam emails are unsolicited
bulk messages typically sent by spambots, which are automated programs
that search the internet looking for email addresses. Spammers then
create email distribution lists which typically send an email to
millions of email addresses which can be used to, amongst other things,
promote scams which may utilize a phishing attack.

Phishing is the fraudulent practice of sending emails purporting to be
from reputable source in order to induce individuals to reveal personal
information, such as passwords and credit card numbers. Many times the
email pressures or entices the person to download an attachment or open
a link to a website (which is designed to mimic the site of a legitimate
business) by telling the person that they will face some difficulty if
they don't, such as their account being frozen. This is done to trick
the person into divulging or providing their personal and financial
information, including, but not limited to, passwords, account IDs,
credit card information, and personal health information. The attachment
or fake website may also install malware onto a person's device which is
meant to obtain access to or steal the aforementioned information or
other information on the device or network the device is connected to.
New York would not be alone in combatting cybercrimes. In 2016, Washing-
ton State enacted legislation which addressed various types of cyber-
crimes, including those related to phishing and malware. 12 other states
have imposed criminal penalties for committing cybercrimes. Other
states, including New Jersey, Pennsylvania, and So uth Carolina, have
introduced legislation to try and tackle the phishing problem.

According to Symantec Corporation (Symantec), which provides security
against cyberattacks, July 2017 found that 55.3% of all emails globally
were spam email, a rate which was expected to continue to increase, and
saw the phishing rate grow to 1 in 1,968 emails.  Symantec also found
that 1 out of every 9 email users encounter email malware in the first
half of 2017. Internet crime can be a profitable business. The FBI's
2016 Internet Crime Report found that there were almost 20,000 victims
of phishing attacks in 2016 resulting in losses in excess of $31
million. This does not include targets of malware, scareware, or
ransom-ware which impacted another 5,000 victims, resulting in losses
exceeding an additional $6 million.

Unfortunately, perpetrators of cyberattacks are difficult to identify,
locate, and apprehend. Quite often, the person committing a cybercrime
is doing so outside the jurisdiction of the United States.  As such,
even though police investigators may amass strong legal evidence to
verify the identity and location of the cybercriminal, many times law
enforcement has no legal ability to arrest the person. Therefore,
because such individuals are difficult to bring into custody, the typi-
cal statute of limitations in New York State of 3-5 years for a misde-
meanor or felony is an insufficient timeframe and is required to be
substantially longer which this legislation accordingly provides for.
Because cybercriminals operate in the dark web, making it almost impos-
sible to pinpoint their location, the difficulty in identifying and
apprehending them within a reasonable timeframe means that they are
assured of getting away with the crime simply because investigators lose
their lead and the case goes cold. For perpetrators of cybercrimes, a
short statute of limitations for the nature of the crimes that they
commit means they will almost always get away simply because they are
extremely unlikely to be caught quickly enough to enable successful
prosecution.This bill will serve as a deterrent to cybercriminals
committing these crimes against New Yorkers because they will know that
the 20 year statute of limitations means they will face certain prose-
cution and will be more likely to be brought to justice by the law
enforcer s of the future.

 
PRIOR LEGISLATIVE HISTORY:

2022: S.6099- Referred to Codes

2021: S.6099- Referred to Codes

2020: S.3172- Referred to Codes/A.6514- Referred to Codes

2019: S.3172- Referred to Codes/A.6514- Referred to Codes

 
FISCAL IMPLICATIONS:

None to the State

 
EFFECTIVE DATE:
First of November next succeeding the date after becoming law