Phishers Face Jail Time Under New U.S. Bill

An anonymous reader writes "Democrat Patrick Leahy has introduced a new federal anti-phishing bill that would impose jail terms up to five years and fines up to $250,000 for criminals creating fake web site designed to con consumers in to giving them their personal information. 'Some phishers can be prosecuted under wire fraud or identity theft statutes, but often these prosecutions take place only after someone has been defrauded - that leaves plenty of time to cover their tracks. Traditional wire fraud and identity theft statutes are not sufficient to respond to phishing.' said Leahy in a statement regarding the Anti-Phishing Act of 2005."

Comments

Phishing after a night out

[LiquidCoooled]

I hope I don't get arrested for phishing in the wardrobe after a night out.

I'm glad about this

[Deekin_Scalesinger]

Assuming it works and is enforceable, of course. I think phishing is a pretty low way to live your life - preying on the gullible. Been done for thousands of years, true, but taking advantage of people is no way to live your life IMO.

Re:I'm glad about this

[kaellinn18]

taking advantage of people is no way to live your life IMO

Then I recommend you not pursue a career in the federal government.

Re:I'm glad about this

[kaellinn18]

Some people realize that there are more important things than money in this world and that when you are 70

And some people realize a joke when they see one. Is the Navy still removing the sense of humor from new recruits? I thought they stopped doing that in the 80s.

Re:I'm glad about this

[foobsr]

Been done for thousands of years, true, but taking advantage of people is no way to live your life IMO.

This in a strange way reminds me of THE DISPOSSESSED by Ursula K. LeGuin.

CC.

Re:I'm glad about this

[Tim C]

More likely it's details of a reward program for Iraqi citizens - eg for turning in suspected insurgents and criminals, joining the security forces, etc.

Re:The crime is creating a website?

[LiquidCoooled]

Parody sites do not usually require you to give up account numbers of other information.

Any that do should be rightfully concerned.

Great.....

[Capt James McCarthy]

Congress is all over it. Now the problem is sure to be solved. :-/ I'm afraid that this lip service will once again make the general public think this will solve the problem. Nope. It may slow down folks within the US borders, but we all know the true result of bills like this. It just won't work.

Legislative Hall of Fame

[aconn]

This one will join CANSPAM in the Legislative Hall of Fame under the necessary but useless category.

Re:Legislative Hall of Fame

[Ryosen]

This is true, but those laws primarily go into effect after the fraud has been committed. What they are going after here is not the fraudulent act itself but the attempt. Sort of like assault and battery. Assault is the threat, battery is the action. Battery carries the heavier charge.

Currently, other than possibly copyright violations, there is nothing truly illegal about setting up a phishing site. Yes, you have intent, but that is very difficult to prove. To make a case really worthwhile to go after, you have to have the theft.

This bill (which I admittedly have not read yet) would seek to make the attempt illegal and easier to prosecute. Like CAN-SPAN, it will be very difficult to enforce, but the good effort is there at least.

NO!

[StevenHenderson]

Uh oh! Does this mean they are going to jail Prince Ombutu Nagala of Nigeria? He was going to split $28M with me!!!!!!!!1

Good!

[Kimos]

I'm glad to see that phishing is being taken seriously! Just because it happens on the internet, doesn't mean it's not as serious as any other type of scam.

Evidence

[retards]

Not a bad thing, but I think actual fraud or clear intent should have to be proven. Opportunity and unproven intent should not be weigh beyond a reasonable doubt.

Re:Evidence

[Anonymous Coward]

That shouldn't be difficult.

Creating a website that looks like that of an existing bank or commercial concern using graphics and layouts harvested from said bank or commercial concern's website and asking for account numbers and PINs, SSNs and other personal information should be ample proof of intent. Using browser address bar and security certificate spoofs/hacks should cement the proof of intent.

An individual or group who collects usernames and passwords like that doesn't do so for curiosity's sake.

Re:Evidence

[lgw]

Proof of intent is a requirement for conviction for many laws. I think that's OK. The point of the new law is to create the power to arrest a phisher before he defrauds someone. If you're going to do that, you have to judge intent.

That seems pretty easy in this case - if the web site has a form where bank passwords or other sensitive information might be entered, it's phishing. This would easily leave the "other browser form submitter" web sites, which look like phishing sites at first glance, in the clear - they don't have a space for passwords.

For once, I can't see a problem with a new law.

Please explain why

[Anonymous Coward]

"Traditional wire fraud and identity theft statutes are not sufficient to respond to phishing.' said Leahy in a statement regarding the Anti-Phishing Act of 2005."

Please explain why. New laws suck. 99% of the time the old existing laws are completely capable of handling the problem... just enforce the laws we have.

Re:Please explain why

[ednopantz]

Somebody should develop a tool to bombard their websites with junk data. They want acct #s and passwords? Give em 10,000 fake ones for every real one. Let them try and figure out which is which. It could even be a distributed app: FoilPhishers@Home.

But yeah, send 'em to Federal PMITA prison at first opportunity too.

Re:Please explain why

[glyn.phillips]

Don't forget Illegal Use of Trademark.

Re:Please explain why

[ThogScully]

I'll second that point of view... it seems to me that even if the old laws somehow don't just make scamming in general illegal, then perhaps those laws should be adjusted so that they do.

That way, we can have one law that says scamming people is illegal rather than one law that says scamming people over the phone is illegal and another for scamming people on the internet, and another for scamming people in person, etc...

It's all the same crime - there's no reason to distinguish at the legal level, only in the methods of prosecution and gathering proof.
-N

Re:Please explain why

[RobotRunAmok]

Leahy is a lawmaker. Lawmakers make laws. There is no glamor for him in enforcing existing (i.e., someone else's) laws.

How many congresspeople do you know who run for re-election on a platform of, "Hey, y'know, we've pretty much got a law for every possible crime imaginable, I just spent my term minimizing bureacracy so Justice, the cops and the courts could do their thing" ?

It's all about the re-election. "Hey, lookit me! The hip Anti-Phish Candidate! A year ago it wasn't even a word, but last week I wrote a law against it!! Who's your Re-Electable Daddy?!"

It's the same headline-generating mentality that prompts these bozos to make cellphone-specific anti-driving-while-distracted laws.

Re:Please explain why

[dasunt]

Please explain why. New laws suck. 99% of the time the old existing laws are completely capable of handling the problem... just enforce the laws we have.

Here's my theory what happens:

Imagine a congressman or congresswoman wants to appear to be doing something. Or perhaps they are just naive. Either way, they come up with a new law which more or less covers an existing law. We'll use a hypothetical "Violence against Women Act 2005", which makes kidnapping a woman across state lines a federal offense.

Now, its already illegal to kidnap someone across state lines, as we all should know. However, considering that there is a 2006 election just around the corner, the average member of congress will not vote against this act -- just imagine the attack ads if he did!

Look at the AARP -- they are being attacked by USA Next for supporting gay marriage. What really happened is that Ohio was passing a constitutional amendment to ban gay marriage. The bill was broad enough to apply to unmarried cohabiting heterosexual seniors. The AARP, acting in the best interests of its members opposed the bill, and now we see ads about how AARP is for gay marriage.

So, let me ask you one question: Why are you against punishing criminals? Your opponent will be asking you this question in 2006.

As always, there is a Simpson's quote for this. Episode 2F11, where Bart discovers a comet that happens to be directly headed towards Springfield:

KENT BROCKMAN
With our utter annihilation imminent, our federal government has snapped into action. We go live now via satellite to the floor of the United States congress.

SPEAKER
Then it is unanimous, we are going to approve the bill to evacuate the town of Springfield in the great state of--

CONGRESSMAN
Wait a second, I want to tack on a rider to that bill - $30 million of taxpayer money to support the perverted arts.

SPEAKER
All in favor of the amended Springfield-slash-pervert bill?

FLOOR
Boo!

SPEAKER
Bill defeated.

Re:Please explain why

[MindStalker]

Current law requires there to be victims. So if you are unsuccesful or they simply can't find your victims, they could not arrest you under current law. Of course there are laws like trademark infringment but that would require the cooperation of the people you are copying.

Re:Please explain why

[GigsVT]

The new law doesn't change the old law anyway.

"Whoever knowingly, with the intent to carry on any activity which would be a Federal or State crime of fraud or identity theft--"

For this law to even apply, the prosecution has to show intent to commit fraud as it is already defined. This is the same as just charging someone with attempted fraud, as far as I can tell.

Re:Please explain why

[TFGeditor]

"Obtaining someone's information illegally, to use it illegally, is...already illegal!"

Do you understand the difference between "obtaining someone's information" and "ATTEMPTING to obtain someone's information"?

I see this law as similar to ones making it illegal to possess "burglary tools." Who but a locksmith or other tech-type has a legitimate reason to possess lock picks while out in public?

Re:Please explain why

[plague3106]

I don't see why thats a problem really. Would you want to be dragged into court (and prision) because the state said you hurt someone, but could not produce said person? The need to have someone hurt is there because the accused has the right to face their accuser in open court.

Re:Please explain why

[BackInIraq]

I'll second that point of view... it seems to me that even if the old laws somehow don't just make scamming in general illegal, then perhaps those laws should be adjusted so that they do.

First, there are many different ways to "scam," and the law, much like coding, is very syntax sensitive. So often times things need to be more specifically defined. In addition, you don't want any particular law to be so darn complex that trying it becomes that much more difficult, so often they break them up so they can just charge you with the part *you* broke. At least, thats how it has always seemed to me.

That way, we can have one law that says scamming people is illegal rather than one law that says scamming people over the phone is illegal and another for scamming people on the internet, and another for scamming people in person, etc...

One major difference between internet scamming (such as phishing) and, say, phone or in-person scamming is that the latter are very labor intensive, whereas the former can run more on auto-pilot. Kinda like foot soldiers vs. simply planting land-mines. Which leads into...

It's all the same crime - there's no reason to distinguish at the legal level, only in the methods of prosecution and gathering proof.

My guess is that they want to differentiate between phishing online and offline scamming because of the speed with which one can gather information illicitly on the internet. Otherwise generally it is better to wait until you have a victim (assuming we're talking non-violent crime, of course), because it makes it vastly easier to prosecute. Online, they can't afford to wait that long, both because you end up with far too many victims, and the perps can disappear (and reappear) much more quickly.

Re:Please explain why

[plague3106]

Yet there are plenty of laws where there is no "victim"

'Well I've already killed 10 people, so killing another one wouldn't be wrong.' Nice logic.

Laws against activities which are deemed to be against the good of the public

Often without really proving they ARE against the public good.

soliciting a prostitute

How does that harm 'the public'? It wasn't until fairly recently that people didn't acknowlege that having prostitution legal WAS a benefit.

drunk driving

I have no problem adding to a sentence if the driver is drunk. But if they haven't harmed anyone or damaged any property, I find it hard to justify a punishment.

selling drugs

Yes, thats why amsterdamn is falling apart, and Europeans are alcoholics because their drinking ages are lower. And lets ignore prescription drugs too, which can be problem causers too. I forgot, is it ok to sell drugs or not?

insider trading

If said insider trading hamrs another party, I don't see a problem with a law regarding it.

usually have no tangible victim associated with them

And I think they should be rewritten so they are unenforcable until harm is done to someone.

The accuser in those cases is usually the government (or rather "the people") and that is whom the accused faces in the courtroom.

Well I don't like dogs, so I'm going to work to have owning dogs made illegal. Then every dog owner can face 'the people' as their accuser. Why? Because the dog COULD bite someone.

How is this different...

[91degrees]

From exisitng conspiracy to commit fraud crimes?

Why do we need a new law when an existing one will do?

Attention Voters!

[Scratch-O-Matic]

Senator Leahy is engaged in a legislative battle against online scammers, and he needs your support. If you would like to help, click on this link. To ensure that you are a registered voter, you will be asked to verify your name, address, and social security number. You may then make a donation online, right from your checking account!

Re:The crime is creating a website?

[erick99]

The crime is tricking someone into giving up sensitive information such as bank account info so that their money can be stolen (as one example). Building the web site is a tool to accomplish the theft. I don't believe, however, that the legislation will outlaw websites in general.

better solution.

[Lumpy]

I already start up an app to poison their databases every time I get one ofthose paypal,ebay or lately, the yahoo greeting card phishing scams.

point a particular java app at the url and let her fly filling in all the form fields over and over and over again with what looks like real but is generated from files crap.

if the asshats have to sift through 300 bad records to find something useable, at least I slowed them down a bit.

If more people in the know did this to them instead of the worthless action of reporting them it would make a bigger impact. the last one I reported to ebay was still up days later. My second alert to ebay was responded with "we cant deal with them all, go away" but in nicer words.

Re:better solution.

[Speare]

I agree...the more we "police" the internet ourselves, the less the government will need to regulate it.

An' if we take 'em out o'the holdin' cell afore their trial, an' string 'em up inna tree, then the liberal activist judges cain't set 'em free! Who's wit' me? Grab yer hoods an' meet me by the libary at half past midnight. We're gonna do some justice.

I don't care

[Anonymous Coward]

just so long as they leave my free ipod scam alone...

Re:The crime is creating a website?

[WidescreenFreak]

There is a major difference between a parody web site and a web site that was created with the intention of fooling people into giving away information that can lead to criminal usage. I've never seen a parody web site ask for a social security number, bank number, etc.

Additionally, all parody sites I've seen either are blatantly obvious parodies or state somewhere on the site that they're parodies. Phishing sites won't do that because they're trying to convince you that they're genuine.

Apples and oranges.

Use it to prosecute spyware companies?

[G4from128k]

I've not read the bill (only this article), but I wonder if this could be used to prosecute other internet low-life that try to gather personal data for purposes not sanctioned by the submitter of the information. And taking over someone's computer without their knowledge would certainly seem to be a type of fraud under this bill.

A cause for celebration

[Laurentiu]

As a new federal law called "The Anti-Phishing Act of 2005" is being pushed by the U.S. legislative, hackers everywhere celebrate their victory over the English language.

"W3 pl4n 2 in7r0duc3 z00n 0d4r l337 w0rdz in d4 c0n73mp0r4n v0c4bul4rj", said the appointed speaker for the "H4x0rz" community, who prefers to remain anonymous ."0ur n3x7 74rg47z 4r3 "h4x0r", "l337" 4nd "pwn3d". 0ur l0bbj gr0up iz z7r0ng, 4nd w3 b3li3v3 d4j will 4lz0 b3 in7r0duc3d bj d4 3nd 0ph d4 j34r."

Phishing Bill Issues

[Gallenod]

This is a first shot across the bow. The bill will probably undgergo substantial debate and amendment as it moves through Congress, but I expect this has a chance to become law.

I've met Sen. Leahy. He's an old-school Vermont Democrat who's held pretty much every state-level elected office except governor and lieutenant governor. I've had a couple of e-mail exchanges with him on CAN-SPAM. When that law first passed, he was cautiously backing it as a reasonable first step. He's realized lately, however, that it's been largely ineffective. The anti-phishing bill is his first real leading charge at cyber-scamming and it reflects some of his earlier frustration with Congress's inability to deal effectively with Internet issues.

(Or much else, in many people's opinion.)

Leahy ruffled some feathers in the online community by supporting RIAA-sponsored legislation on copyrights. It's possible this is a canny political attempt to balance the books a bit. Then again, he's a decent guy with 80% support in a state that's 33% Republican. Even in the minority, he's got a lot of clout. On this issue he'll probably get bi-partisan support, so it's likely this bill will, in some form, eventualy become law.

Besides, anyone high on Dick Cheney's hate list can't be all bad.

Uhh..what country will this be enforced in again?

[the-ghoul]

Are most if not nearly all perps of this this non US based? Last time I looked, the scammers were mostly from Nigeria right?

This may actually help

[wingspan]

Phishing exists because the phisher has a favorable risk/reward relationship. This legislation will help change that relationship by allowing law enforcement to get involved earlier. Today, LE has to wait for a fraud to occur and someone to complain. If my understanding is correct, under this legislation LE can get involved much earlier, when phishing or pharming is first detected. Earlier involvement means less time for the phish site to be operating (reducing return), and less time to destroy evidence (increasing risk).

Of course, whether they will become involved or not is subject to debate.

Hot air

[glyn.phillips]

Apparently Patrick Leahy is ignoring just how easy it is to move phishing opperations off shore. This looks more like a means to keep Leahy in the news rather than an effective crime-fighting law. In the horse and buggy days people learned not to walk right behind a horse unless willing to get kicked. When automobiles came out everyone learned to look both ways before crossing the street. As any new technology appears, a new set of safety rules comes with it, and each individual needs to learn the new rules. Many institutions are busy educating their users and now law is needed to force them to do this as it is already in their best interest.

Re:Hot air

[Steve B]

Apparently Patrick Leahy is ignoring just how easy it is to move phishing opperations off shore.

The host computer can be moved offshore, but the phisher himself can still be nabbed as long as he stays in the US (or a country with an extradition treaty). As a few people pointed out on spammer thread the other day, not many of the crooks are willing to actually go live in Elbonia so they can hide from the law.

Re:The crime is creating a website?

[josh3736]

Christ, take off your tinfoil! This is an entirely reasonable and proper use of legislative power.

This bill stops Bad Guys® from stealing the inexperienced users' life savings before they actually steal anyone's money. It does not outlaw building any website, just those designed with the intent and purpose to steal your bank password.

And all Phishing sites are US-based too. Whew!

[mattspammail]

How many of you have actually traced down an IP address to find its origin? I know I'm not the only one. The first thing you find out is that the IP address is registered in Latin America or some other part of the world where we have no jurisdiction. The second thing you find out is that there is no way to do anything about their perceived illegal activities. I say perceived, because it may be un-legislated activity where they come from.

I say all of this because I don't think there's a single thing we can do to prevent those outside our country from doing this over and over and over again.

Practically useless, if you ask me.

Isn't there already a law that can be applied?

[CastrTroy]

Isn't there already a law that can be applied? Doesn't this basically amount to fraud or something? I think the biggest problem with Phishing is that it's a little hard to track down who is doing it. If you know who's doing it, you can easily arrest them. The problem is, is that mostly these phishers try to remain anonymous, and probably don't have their operations set up in the US.

Re:The crime is creating a website?

[BlueUnderwear]

Anyone else find that a bit scary? People with parody sites should be probably be worried a little.

And also people who try to ensure interoperability of bank sites with "non-standard" browsers.

Don't laugh... it did actually happen!

More nannying by the state.

[pandrijeczko]

Scammers use phishing because there are stupid people to leech money from. No stupid people, no profit from phishing, no reason to phish in the first place.

The sooner people accept responsibility for their own lives and their own personal information, the sooner people realise that with every Bill or Law that gets passed, the more they hand over the controls of their lives to the nanny state.

If the stupid people can't be bothered to protect their private information, if they can't simply delete emails they don't 100% trust the source of, if they can't invest in a paper shredder, if they believe all those glossy adverts about the security of their chosen operating system, then more fool them.

But please don't let us smart people also lose our personal liberties as a result of their stupidity.

No phishing scam has ever got me and they never will.

Re:The crime is creating a website?

[BlueUnderwear]

Christ, take off your tinfoil! This is an entirely reasonable and proper use of legislative power.

This bill stops Bad Guys® from stealing the inexperienced users' life savings before they actually steal anyone's money.

Theft and fraud are already illegal. Who says that this law will do anything against phishers? The reason why phishing thrives is not because it is legal, but because it's hard to investigate and/or police just can't be bothered.

It does not outlaw building any website, just those designed with the intent and purpose to steal your bank password.

How do you prove intent? And what is the exact wording of the bill? If the intent is truly to steal and defraud, we've already got laws. We don't need any laws either forbidding to "carry weapons with intents of threatening peasants to give up their wallets". Mugging is already forbidden, and anything such a hypothecal law might achieve is inconvenience the butcher who brings a new knife to his shop...

A Luxembourgish Linux user got threats from a bank because he featured a look-alike login page on his Website. Purpose of that login page: strip an obnoxious browser check. But that's not how the bank tried to spin it.

Who's clicking on these things?

[theskipper]

I don't get some of these phishing guys. Just got this in my inbox. Sure, there are some phishes that look believable but are the phishers really as stupid as the people that click on them? Would anyone who'd create a brain-dead phish like this one actually be afraid of jail time and/or a fine?

--
Subject: E-gold secutity patchHBhdGNo

Dear E-gold user, we receive many complaints concerning unsunctioned taking the money
off the balance of our users recently, thus we earnestly ask you to install the
following service-pack onto your Personal Computer.

- This innovation blocks all known Trojans which let take the money off your account
without your consent. We earnestly ask you to install this service-pack in order
to keep your money safe and sound.

- In case of the lost of your money, E-gold *DOES NOT* bear any responsibility if the
service-pack had not been installed on your computer before.

- The installation archivated file of the service-pack is attached to this letter.

Why can I murder someone for less jail time?

[IpsissimusMarr]

Is it just me or is doing something illegal in the cyber-world more dangerous than the real world? How is it possible that I get more jail time for cracking into and defacing a web page than I'd get for shooting someone?

For our 'cyber-laws' we should be taking precidence from our existing laws. Instead of levying new fines for phishing, add this definition onto our current fraud and identity theft laws. Instead of creating crazy fines for spammers (although I want to see them pay just like everyone else) and model the punishments similarly to the do-no-call lists?

Law-makers don't see the internet as an extension of the physical world, and in term of law it should be seen in this light. Extend Current laws, don't make them up in a flight of fancy.

Theives

[northcat]

Small theives have laws against them. Big theives have laws that regulate them. Really big theives have laws for them.

Re:The crime is creating a website?

[squiggleslash]

I think the page you link to has so little in common with Phishing that it's about as likely to be prosecuted under a hypothetical badly-worded anti-phishing law as it is under a hypothetical badly-worded anti-cellphone-while-driving law. It doesn't represent itself as the bank in question, no reasonable person would see it as the bank in question, and the only way anyone would class it as "phishing" would be if the author is actually keeping the login information and abusing it (in which case he should be prosecuted!)

I think, to be quite honest, it takes the cake to criticise a law you haven't read and have no reason to believe is overbroad for being overbroad or badly worded. Yeah, it might be. Likewise the law on murder might be so overbroad that you can be prosecuted under it for eating beef. But that's not the case, and there's no reason, at this stage, to believe the anti-phishing law is overbroad either. Criticise it when it's actually got something in it to criticise.

British Joke

[pandrijeczko]

We're getting a lot more into "Chip and Pin" cards over here in the UK now.

Presumably, therefore, credit card fraud in the future will not only require the obtaining of a credit card by fraudulent means but also some kind of hardware hack to use a cloned card.

Does that mean there could be a new crime of "phish and chipping"?

I'll get my coat...

This will not help...

[RaZ0r]

because a large percentage of this fraud is originating outside of the USA.

How is the US Goverment going to press charges when its occuring out of its jurisdiction?

Just my 2c...

Re:New *Introduced* Bill

[geoffspear]

Not only are you cynical, you're completely delusional, too.

The Supreme Court overturns very few laws. Congress passes plenty of laws. You have no idea what you're talking about, and should stop wasting everyone's time by posting such stupid messages.

Re:A better solution.

[Anonymous Coward]

Hehe...sounds like someone watched that crappy-ass movie "Hackers" (even though Angelina Jolie was hot as ever in it)...

Hacker 1: I need to get in the system and list this guy as deceased.

Hacker 2: Well, just click here on 'hack' and you're in.

Exact wording of the bill.

[geoffspear]

Anti-phishing Act of 2005 (Introduced in Senate)

S 472 IS

109th CONGRESS

1st Session

S. 472

To criminalize Internet scams involving fraudulently obtaining personal information, commonly known as phishing .

IN THE SENATE OF THE UNITED STATES

February 28, 2005

Mr. LEAHY introduced the following bill; which was read twice and referred to the Committee on the Judiciary

A BILL

To criminalize Internet scams involving fraudulently obtaining personal information, commonly known as phishing .

Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

This Act may be cited as the `Anti-phishing Act of 2005'.

SEC. 2. FINDINGS.

Congress finds the following:

(1) American society is increasingly dependent on the Internet for communications, entertainment, commerce, and banking.

(2) For the Internet to reach its full potential in these and other respects, it must continue to be a trustworthy medium. This means, for example, that Internet users should be able to trust the stated origin of Internet communications and the stated destination of Internet hyperlinks.

(3) Internet users are increasingly subjected to scams based on misleading or false communications that trick the user into sending money, or trick the user into revealing enough information to enable various forms of identify theft that result in financial loss.

(4) One class of such scams, called `phishing' , uses false e-mail return addresses, stolen graphics, stylistic imitation, misleading or disguised hyperlinks, so-called `social engineering', and other artifices to trick users into revealing personally identifiable information. After obtaining this information, the `phisher' then uses the information to create unlawful identification documents and/or to unlawfully obtain money or property.

(5) These crimes victimize not only the individuals whose information is stolen, but the entire online community, including millions of people who rely on the integrity of the Internet's system of addresses and hyperlinks.

SEC. 3. CRIMINAL OFFENSE.

(a) In General- Chapter 63 of title 18, United States Code, is amended by adding at the end the following:

`Sec. 1351. Internet fraud

`(a) Website- Whoever knowingly, with the intent to carry on any activity which would be a Federal or State crime of fraud or identity theft--

`(1) creates or procures the creation of a website or domain name that represents itself as a legitimate online business, without the authority or approval of the registered owner of the actual website or domain name of the legitimate online business; and

`(2) uses that website or domain name to induce, request, ask, or solicit any person to transmit, submit, or provide any means of identification to another;

shall be fined under this title or imprisoned up to 5 years, or both.

`(b) Messenger- Whoever knowingly, with the intent to carry on any activity which would be a Federal or State crime of fraud or identity theft sends any electronic mail message that--

`(1) falsely represents itself as being sent by a legitimate online business;

`(2) includes an Internet information location tool that refers or links users to an online location on the World Wide Web that falsely purports to belong to or be associated with such legitimate online business; and

`(3) induces, requests, asks, or solicits a recipient of the electronic mail message directly or indirectly to provide, submit, or relate any means of identification to another;

shall be fined under this title or imprisoned up to 5 years, or both.

`(c) Definitions- In

Big Fat Whoop

[TheHawke]

I ran across a phishing site on a client's system while cleaning it up. The HOSTS file had 6 entries in it, redirecting any requests for 5 British banks and one Brazilan banco, to a IP at EV1.net. I busted my ass in a effort to get EV1.net's support team and administrative suits to pull the IP, but all I got was canned replies: "Forward the information to the abuse department". So I did so.

Two weeks passed, and EV1.net did not take any action whatsoever. So, I sent the report to the big Brit banks, which included The Bank of England, Barclays, and the legendary Lloyds. I got immediate replies, personal ones, NOT canned, that they would immediately take legal action agianst the offending CSP.

I checked the IP shortly after receiving the replies and got a DNS error.

It seems to me that EV1.net, which is based in Houston, has merc tendencies when it comes to site hosting.

Danger. Potential abuse

[phorm]

One thing to watch out for though is that this law might be abused by those claiming against parody sites. A parody site would have a similar look+feel (or heck, perhaps just a similar URL), but obviously a different focus/content. Now if there were a login option on the parody site, the primary site might be able to claim they were phishing for usernames/passwords...

Report Phishing to Whom??

[elenaran]

Just this past week I received the same phishing email (fake Key Bank login) 5 days in a row. I was surprised the site was able to stay up for so long. Who does one report this type of thing to? the FBI? the Secret Service? the FCC?? There needs to be some sort of clear statement on this from the government.

OT: What do Phish fans say when they run outa pot?

[TheLittleJetson]

"Maaaaan, this music sucks!"