Slashdot Mirror
First Anti-Phishing Law Enacted in California
Steve writes "Arnold Schwarzenegger, governor of California, signed a bill yesterday that makes phishing a civil liability. According to MSNBC, the new law is the first of its kind in the country:
"The bill, advanced by state Sen. Kevin Murray, is the first of its kind in the United States and makes 'phishing'... a civil violation.
Victims may seek to recover actual damages or $500,000 for each violation, depending upon which is greater."
This is an expensive penalty for phishers who are litigated against, but do the lack of criminal accountability and the burden of action on the victim hinder the effectiveness of this bill?"
You have got to be kidding me. The elaborate system of dams, resevoirs and aqueducts that serve Los Angeles *alone* do more damage to the environment than any amount of commercial or recreational fishing in California or along the Pacific coast. And don't even get me started on Disneyland. 150 years since slavery was abolished, and mice and ducks are still held in thrall.
No more phishing! We should enact laws against spam too and solve that problem.
$500,000? I'm in.
Aw man: I just deleted about $6,000,000 worth of opportunities, er, scams last week.
I the msnbc article is rather vague.
I guess it makes the legislators in California feel good, but it isn't going to do anything to stop it. It might stop someone who lives in California, uses their home ISP account to collect information and deposits the money in their parent's bank account.
Senator Patrick Leahy (D-VT) introduced an anti-phishing bill that proposed stiff penalties including up to 5 years in prison and fines as steep as $250,000. I wonder what happened to that ?
New laws (all laws) have unintended consequences, and fraud is already illegal. TFA provides no details, but I am always skeptical of new regulations which seem to "protect us" from something which is already covered by existing statute.
The real difficulty is that phishers tend to operate from outside jurisdiction and for very brief periods of time. I fail to see how a new "anti-phishing" law will do much to solve the problem - but elections are soon...I doubt that is coincedence.
Using plain ol' text since 1968
Now, if the other states will just take notice...
It's a shame Congress won't act, but we do not need a CAN-PHISH act.
Under laws which control Fraud , Identify theft ,and such like .
IANAL but why would there need to be a new law for phishing? it is after all just fraud .
The only things certain in war are Propaganda and Death. You can never be sure which is which though
This is why we need to elect normal people to government. Normal people as defined as not a professional politician. Arnold isn't corrupted with long ties to special interests and can pass laws for the people. Established politicians wouldn't be too concerned about a law like this because of special interests.
So we get laws with teeth to protect people. Good deal.
So vote for non-politicians to administer government, it always seems to work better over time.
Actually why do we have so many damn laws? We can get rid of legislators by getting rid of laws.
Think of the saving to sanity and finances?
We should have only one law: "Don't do anything to harm someone else intentionally". God had the right idea when he gave Moses ten laws, provide us the bible as a sort of guideline to acheiving those laws. Not kidding.
We should have the one law of "don't hurt others intentionally" and then have a transparent system that enables qualified judges to make justified decisions on what appropriate punishments are based on circumstances and deservement (is that a word).
Laws get bought and even in democracies are based on people's current emotions at the time, and they are too non specific in the way they are written anyway. My point is that by have so many laws, they are over specific and miss too many situations.
It just seems like there are an infinite number of situations and deserved punishments that trying to codify them can lead to problems and more injustice than what the intent of laws is. Each crime is slightly different.
Now who ever thought they'd see politicians using the word "phishing", more or less putting it into a bill?
Isn't it just straight up fraud right now? I'm guessing this law lets you sue without actualy needing to give up your information?
autopr0n is like, down and stuff.
Sheesh, what a waste of fucking paper.
Not really a waste of paper for two reasons.
First, it sets a pace for the federal and perhaps later for the world to follow. Although your point about enforcing this to another country may be more difficult is a fact.
But a second point is if a phisher became successful enough, it would warrent setting the fool up. Just wait until they travel and get them in a friendly juristiction. It wouldn't be the first time a criminal was caught by the bait of a good job or prize.
I had a personal website QaBOjk.com, i forgot to renew, and when i got around to it some company snatched it on me.. pissed me right off because i've used that nickname since i started using the net, and i was rather fond of my email address: jerome[at]qabojk.com They have no justify reason to steal my domain name! what? qabojk enterprises might wanna buy it? QABOJK?? its not even a word!!! those bastards..
Will this start a new age of bounty hunters?
:j
Tracing a phisher back can be pretty hard and you pretty much have to do illegal things yourself in the process since their webservers usually run on some hacked machine and the only way to trace them fast enough will be to hack into that machine yourself. But a half million bucks is enough money to make it worth it and some of the phishers may decide that it's more profitable to go after their own kind.
Of course collecting may be the most difficult part... you can sue someone who is located in Russia in a California court, but if you win how are you going to collect?
Btw., as I understand US law only it's probably enough if any one of the recipient, the email account that got the phishing email, the fake web server, or the company that was being spoofed are located in California for you to sue in a Cal court.
Anyway, it'll be really interesting to see what happens with this. I've long thought that the best way to combat all sorts of scum on the internet is to create a sufficient economic incentive for bounty hunters since LE is never going to put their resources in the right places. This is the first anit-internet-scum law that makes the (potential) reward high enough, so if it works expect to see more.
And good hunting!
We didn't, at least, we used to not. At one time, our whole legal system was just a few pages long. But our government decided that it wasn't enough, and so we've ended up with the billions of pages of legal code we have today.
In a utopian world, I would agree with you. Unfortunately, there are just too many people who look for too many loopholes trying to screw other people over. And even that doesn't take into account the many gray areas. For example, I think that all copyrights are bad because they protect a small minority at the expense of putting artificial limits on the creativity and innovation of the vast majority. Some think they're good because it allows people to have financial incentive to be creative and innovative. Who's right? It's hard to say, but unfortunately, those aforementioned pages have sided with the latter folks.
You also neglect the fact that qualified judges are easily corrupted with that much power, and justified decisions will always be viewed as unfair by someone.
I agree that many laws are unneeded, and some are downright harmful to the public good, and like everyone else, I wish someone would come along and restore some sanity. But that doesn't imply that we need to almost completely do away with the legal system.
That's actually a good analogy, because even today, we still have Muslims and Christians, who worship the same God of Moses, trying to wipe each other—and other groups along with them—out because they just can't agree on which rules are okay to ignore out of convenience and which makes someone an infidel or heretic.
So we've ended up with large organized religions to break it all down for us into rules such as you can't use contraception, women have to wear burquas, you can't eat pork, etc.
According to your philosophy, we need to do away with religion altogether, and indeed some people believe that. I don't, but as with the legal system, I wish that someone could come along and restore some sanity.
There's laws against fraud in the first place. Or does the whole 'billed your credit card under fraudulent means' no longer apply once the bad guys use computers?
Of course the burden is on the victim, fraud is already a criminal offense. This bill classifies phishing specifically as a CIVIL offense so the victim can collect damages. In order to collect, the victim has to sue. Don't you remember the OJ civil trial?
Oh, and IANAL. Just knows what I sees on the teevee.
"Lawyers are for sucks."
- Doug McKenzie
There have been phishing convictions under existing fraud statutes (google "phishing conviction" for some examples), but that wasn't really my point. It seems that we laud politicians for sweeping "initiatives" and "wars on $badthing", but can't find the money for the folks in the trenches who are doing the real work.
Police resources are stretched too thin - tell the politicians to get off the soapbox and support them.
Using plain ol' text since 1968
Ok you're saying: a) it's too expensive to go after the criminals, and b) it's the victims own fault.
What kind of defeatist BS is that?
But what's more, this law addresses precisely those points... for a) it creates an economic incentive for someone to at least
Seems like you should agree with those goals.
but do the lack of criminal accountability and the burden of action on the victim hinder the effectiveness of this bill?
Phishing is already illegal across the US, if not the world. It's called "fraud". This bill merely adds more ammunition to the public's arsenal.
If you combine this with the new florida law that makes it legal to shoot someone if they piss you off or maybe look a bit foreign, then it'd work very well... find phisher/spammer, shoot them in the head... profit!
"This is an expensive penalty for phishers who are litigated against, but do the lack of criminal accountability and the burden of action on the victim hinder the effectiveness of this bill?"
You know, this may be worse for those who have a suit brought against them as the burden of proof for the other side is smaller. At least this is what I have been made to understand for years. (I may be using the incorrect language however.) Also, can someone who knows tell us if you can have a jury in civil suits?
Now, as much as I dislike the activity, I also dislike laws that have such large statutory damages. (And the whichever is greater provisions.) You may have only suffered a ten dollar loss as a result of someone's foolishness, but you can collect $500,000.00 from them? We really need to go back to the thought of the punishment fitting the crime instead of trying to scare people into compliance. (I am talking in general here and not about phiching.)
all the best,
drew
--
http://www.ourmedia.org/node/57503
Paper Plane Design 001 Video
Creative Commons Attribution-ShareAlike License
FreeMusicPush If you want to see more Free Music made, listen to Free
Well, at least he didnt create an entire governmental department to handle this and pushed it back out to the civil arena like other things should be ( hint : *AA ).
However, since this often involves stealing of personal information and actual theft, perhaps it should have remained a criminal issue..
---- Booth was a patriot ----
I've made the same suggestion a few other times, and it still applies here.
The PC manufacturers can configure a start up sequence. When a user starts their computer, a series of screens appear which demonstrate the various Internet evils and countermeasures. One can show information on spam, another on phishing, etc.
As each screen is displayed, the user must click on a "I understand" button before going to the next screen. Only after each screen is viewed will their PC fully boot.
How simple can it be for the PC manufacturers to do this? At least the user cannot say "I didn't know".
Pete Carr Owner Chatmag.com
One of the biggest problems is that banks, auction sites, and other online entities don't really seem to care. They'll do things to make it look like they care such as send out an email every now and then warning you to check the URL and set up email addresses for reporting complaints. The few times I've actually tried to report a phishing site to these large corporations, I haven't get a response for days or weeks. At that point the damage is done. Most of the phishing sites even use graphics linked from their targets. If ebay's image servers refused requests to hosts which were not affiliated with ebay, then the phishing sites would be forced to host them on their own servers which would take up much more bandwidth and be more likely to get noticed. The least they could do is watch their referrer logs and look for anything which resembled a script. As proof I give you this phishing site, which uses ebay's images and has been up for several days: http://211.60.138.10:680/rock/eBayIsap/ (do NOT enter your info here)
Spam is an annoying side effect of allowing open access to the web to the masses. You're going to get a lot of scumbags, er... people who don't share the same ethical standards as the original web designers. Spam is the pollution (unlimited access for commercial messages) of a general community resource (the web) for individual private gain (selling ad space in a medium that you don't own).
Phishing is a serious attempt to defraud individuals of large amounts of money by sending false e-mail communications that appear to be from official financial institutions. Phishing must be stopped because it will destroy the ability of people to use the web for commercial transactions (and defraud individuals of large amounts of money).
These criminals can be quite clever. For example, I received an e-mail that appeared to be a question from an eBay bidder about an item that I wasn't selling. The e-mail graphics looked exactly like eBay's question-from-bidders form. I clicked on reply to inform the writer that I was not offering this item at auction. The screen appeared for me to enter my eBay user name and password. It looked exactly like the standard eBay screen. I was about to when I realized that it was unlikely that eBay would misdirect a question like this. I went to eBay's site and did a search for the auction number from the phish email. It didn't exist. I forwarded the phish message to eBay's fraud department. I was pissed, because they almost got my account password.
People who do this should be thrown into an American rape torture prison for years. This shit is serious. Same with those Nigerian assholes. This shit isn't funny anymore and no one in the government will do anything about it. I believe that this Nigerian bank fraud transfer scam is something that the international web community should handle by themselves because the authorities won't touch it. The Americans get a large percentage of their oil from Nigeria so they just look the other way at all this endless fraud and theft inflicted on the American people by these clowns.
We, the web designers and internet system administrators, should shut off all internet communication to and from Nigeria until the bank transfer scam criminals are imprisoned and the defrauded funds returned. Remember, in the new information age, it is not the governments or violence technicians that control the power, it's the people who control the information. It's time to let the world understand this new reality. And shutting down the Nigerian bank fraud scammers by an ad-hoc group action is just the way to get that point across.
Even at the start, the US legal system not only contained the laws passed by Congress, but all of British common law; pretty much every legal precedent back to the 1300s. All of that history could be and was considered by judges when deciding cases.
The solution to the problem isn't legislation, it's litigation. The problem is that the people that do phishing aren't usually from the U.S. In fact, I would even go so far as to say that only maybe 1% of phishers even live in California. And that's probably stretching it.
Really, if you want to solve the problem of phising, what better/easier way than to remove the stupid social security number (SS#) from existence? People are worried about identity theft of credit card numbers(CC#) and we have a NATIONAL ID CARD proposal? Sounds kind of ridiculous to me.
I know a lot of you really probably don't know the technicalities of phishing, but the only reason why identity theft is an issue is because of the holy grail of all numbers, the SS#. If I get someone's SS#, it's better than a CC#, because now I can register a CC# under their name and SS#. If you think that phishers do what they do to get a CC#, you're wrong. The SS# is what many of them are *really* after.
You are correct. Of course, if they try to hide the money, you can go after them for it and dig. I know someone who will be filing a suit against Soloway (for spamming), but he will be in line after Braverman and Microsoft -- But he is determined to "make him my bitch."
Even if they are overseas, you can still go after them. I went after Global Web Promotions in a California court. They spent at least $25K tried to fight. I cannot discuss what happened after. They are subject to the jurisdiction that they inject themselfs into.
Fight Spammers!
We've had an anti-phishing law since August 1st.
332.4 Subd. 5a. [CRIME OF ELECTRONIC USE OF FALSE PRETENSE TO
332.5 OBTAIN IDENTITY.] (a) A person who, with intent to obtain the
332.6 identity of another, uses a false pretense in an e-mail to
332.7 another person or in a Web page, electronic communication,
332.8 advertisement, or any other communication on the Internet, is
332.9 guilty of a crime.
332.10 (b) Whoever commits such offense may be sentenced to
332.11 imprisonment for not more than five years or to payment of a
332.12 fine of not more than $10,000, or both.
332.13 (c) In a prosecution under this subdivision, it is not a
332.14 defense that:
332.15 (1) the person committing the offense did not obtain the
332.16 identity of another;
332.17 (2) the person committing the offense did not use the
332.18 identity; or
332.19 (3) the offense did not result in financial loss or any
332.20 other loss to any person.
332.21 [EFFECTIVE DATE.] This section is effective August 1, 2005,
332.22 and applies to crimes committed on or after that date.
-- dieman - Scott Dier
Including the part where it says "https://www.ebay.com" in the address bar?
Actually, some phishing sites can do just that using international characters in the domain name. For example, a lower-case Cyrillic 'a' looks almost the same as the lowercase Latin 'a'. The only difference is the Unicode.
This problem only exists with Firefox, and can be turned off easily, but it does exist.
This is part of a trend in consumer protection laws that is pretty effective. Instead of just providing a mechanism to allow governments agencies to enforce consumer protection laws, they give indivdual consumers the right to persue the offenders. This means that an offender cannot rely on the apathy of a government agency to permit them to flout the law. This works pretty well with telemarketing violations and deceptive advertising. Unfortunately, CAN-SPAM did the opposite so it is close to worthless.
That said, this would work better as a national law that permits state courts to be used for action.