New California law makes phishing illegal

Quote:

---

California has passed the country's first antiphishing law, making this form of identity theft punishable by thousands of dollars in fines.

The law, entitled the Anti-Phishing Act of 2005, was proposed by state Senator Kevin Murray, and was signed into law on Friday. It is the first such antiphishing legislation to be enacted in the U.S., according to backers of the bill.

"It's something that adds another tool in the quiver for consumers and businesses to reduce this kind of really bad behavior," said Michael Wendy, a spokesman for the Computing Technology Industry Association, an IT trade association that has supported the law.

Phishing victims are typically sent fraudulent e-mail designed to trick them into revealing personal information, like bank account numbers, user names and passwords.

Under the Anti-Phishing Act, these victims may seek to recover either the cost of the damages they have suffered or US$500,000, whichever is greater; government prosecutors can also seek penalties of up to $2,500 per phishing violation.

While it already may have been possible to prosecute phishers under antifraud laws, the new legislation will make it easier for victims and government to go after phishers, Wendy said.

It may also serve to inspire other legislation, perhaps even at the federal level, he said. "You can't discourage the symbolic purpose of this," he added. "It's a statement to these guys that this is not acceptable behavior."

The new law is unlikely to cut down on phishing, however, at least in the short term, according to Jordan Ritter, chief technology officer with antispam software vendor Cloudmark (Profile, Products, Articles) Inc. However, if the law is held up in court and actually serves to help victims recover damages, phishers may take note, he said.

Ritter agreed that the Anti-Phishing Act also may serve a symbolic purpose. "Anything that raises people's awareness and improves people's education on the extent of the problem... is going to improve things," he said.

Phishing attacks have been on the rise. Research firm Gartner Inc. estimates that 73 million U.S. Internet users received phishing e-mails during the 12 months ended May 2005, up 28 percent from the previous year.

---

http://www.infoworld.com/article/05/...hinglaw_1.html
New California law makes phishing illegal | InfoWorld | News | 2005-10-03 | By Robert McMillan, IDG News Service

Wow.. A state law to fight international crime..

That's really helpfull..

I realy don't think it is usefull at all, although news like this might help a little to bring the subject in the spotlight for some..

Hi the_JinX,

It may not be much now but it's a start...every new law has to start somewhere until it gets adopted around...I think it's a promising development that once adopted by other states and Countries it will give people a legal backing that they never had before.

Eg ;)

I see a problem with this. You need to become a victim first before you can claim damages. So some smart guy who realises something is a phishing attempt and doesn't get fooled by it just can't take any real action about it either. It would be tempting to hand over the information of your bank account and then immediately start legal actions against this scammer to earn the big half a million in damages.

But I too wonder what an US state can do against a Nigerian 419 scammer... Complain to the Nigerian government, I guess...

Hi katja,

First...in any criminal case you have to be a ' victim ' before you can sue for damages...you can't sue for damages that don't as yet exist...if you could the courts would be even more backed up than they are.

Secondly...as I explained to the_JinX...every law starts somewhere...usually in lower courts...then gets adopted across the board...sometimes other Countries copy legislation passed by other Countries and use the information to weed out the problems before passing their own law.

It's a beginning.

Eg ;)

It's interesting that just about every new computer crime law comes out of California. Eventually it will be illegal to email someone I think. Without prior written consent of course.

As for ' International law '...exactly what International body is suppose to be responsible for making these laws that other Countries would be forced to accept.

The UN?

Law begins usually from it's grassroots beginnings and works it way up into legislation then law...it doesn't start from the top down...it starts from the bottom up.

Eg ;)

Hi RoadClosed,

Haven't seen you for awhile hope all is well!

I agree big brother is way tooooooo involved in our lives...you can't even build a tool shed on your own property without a permit or start a fire to keep warm while camping...

but...

this is not a civil problem...but a criminal one...so...in this case I agree we do need a legal means to combat these frauds.

Eg ;)

Phishing without a victim is still illegal under fraud laws. This law seems to makes it easier for those who do become victims to recover what they have lost (as long as the phisher is in California).

Lots of new laws coming from CA (is that the right abbreviation?) there was a paperazzi law annouced the other day increasing the limits on damage claims.

Arnie trying to make a name for himself? He can't run for president though can he?
Sure I saw that in 'Demolition man'.

Atleast this isn't a scary law..

Like most of the new DMCA(2) and other IP and copyright laws..

Quote:

---

Eventually it will be illegal to email someone I think. Without prior written consent of course.

---

Well close to that ;)
http://www.spamlaws.com/federal/108s877.shtml

Quote:

---

(1) AFFIRMATIVE CONSENT- The term `affirmative consent', when used with respect to a commercial electronic mail message, means that--

(A) the recipient expressly consented to receive the message, either in response to a clear and conspicuous request for such consent or at the recipient's own initiative; and

(B) if the message is from a party other than the party to which the recipient communicated such consent, the recipient was given clear and conspicuous notice at the time the consent was communicated that the recipient's electronic mail address could be transferred to such other party for the purpose of initiating commercial electronic mail messages.

---

Phishing personal information is already a crime. Not in of itself but taking personal information violates several crimes already established.

This could be compared better to the California disclosure law that was passed a couple years ago, requiring agencies or companies with breaches to disclose that to those who may have been affected.

If this holds up and looks good, other states will likely adopt (as they did the disclosure law). If enough states adopt, then the Feds will likely pass an all-encoumpassing version.

Not all California laws are embraced by the other states. But some are.