Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Security Government The Courts News

First Anti-Phishing Law Enacted in California 137

Posted by CmdrTaco from the sure-is-annoying dept.
Steve writes "Arnold Schwarzenegger, governor of California, signed a bill yesterday that makes phishing a civil liability. According to MSNBC, the new law is the first of its kind in the country: "The bill, advanced by state Sen. Kevin Murray, is the first of its kind in the United States and makes 'phishing'... a civil violation. Victims may seek to recover actual damages or $500,000 for each violation, depending upon which is greater." This is an expensive penalty for phishers who are litigated against, but do the lack of criminal accountability and the burden of action on the victim hinder the effectiveness of this bill?"
This discussion has been archived. No new comments can be posted.

First Anti-Phishing Law Enacted in California More

First Anti-Phishing Law Enacted in California

Comments Filter:
  • You have got to be kidding me. The elaborate system of dams, resevoirs and aqueducts that serve Los Angeles *alone* do more damage to the environment than any amount of commercial or recreational fishing in California or along the Pacific coast. And don't even get me started on Disneyland. 150 years since slavery was abolished, and mice and ducks are still held in thrall.
    • The Republican Gourd speaks: environmental damage is acknowledged only to make light of criminal fraud. And racism is also just a joke. Must be nice never to bump into any limits on rich white privilege. Until some sleazy banker siphons your bank account.
      • Moderation -1
            100% Troll

        TrollMods: "Troll" means a post designed to elicit only a predictable response, usually based on a fallacy. Not "scary poster said the ugly truth about Republicans out loud". You sissies.

  • Awesome! (Score:3, Funny)

    by Beatlebum ( 213957 ) on Sunday October 02, 2005 @11:31AM (#13698463)
    No more phishing! We should enact laws against spam too and solve that problem.

    • Phishing is serious crime - Spam is just annoying (Score:4, Insightful)

      by Simonetta ( 207550 ) on Sunday October 02, 2005 @02:38PM (#13699426)
      Spam is an annoying side effect of allowing open access to the web to the masses. You're going to get a lot of scumbags, er... people who don't share the same ethical standards as the original web designers. Spam is the pollution (unlimited access for commercial messages) of a general community resource (the web) for individual private gain (selling ad space in a medium that you don't own).

          Phishing is a serious attempt to defraud individuals of large amounts of money by sending false e-mail communications that appear to be from official financial institutions. Phishing must be stopped because it will destroy the ability of people to use the web for commercial transactions (and defraud individuals of large amounts of money).

          These criminals can be quite clever. For example, I received an e-mail that appeared to be a question from an eBay bidder about an item that I wasn't selling. The e-mail graphics looked exactly like eBay's question-from-bidders form. I clicked on reply to inform the writer that I was not offering this item at auction. The screen appeared for me to enter my eBay user name and password. It looked exactly like the standard eBay screen. I was about to when I realized that it was unlikely that eBay would misdirect a question like this. I went to eBay's site and did a search for the auction number from the phish email. It didn't exist. I forwarded the phish message to eBay's fraud department. I was pissed, because they almost got my account password.

              People who do this should be thrown into an American rape torture prison for years. This shit is serious. Same with those Nigerian assholes. This shit isn't funny anymore and no one in the government will do anything about it. I believe that this Nigerian bank fraud transfer scam is something that the international web community should handle by themselves because the authorities won't touch it. The Americans get a large percentage of their oil from Nigeria so they just look the other way at all this endless fraud and theft inflicted on the American people by these clowns.

              We, the web designers and internet system administrators, should shut off all internet communication to and from Nigeria until the bank transfer scam criminals are imprisoned and the defrauded funds returned. Remember, in the new information age, it is not the governments or violence technicians that control the power, it's the people who control the information. It's time to let the world understand this new reality. And shutting down the Nigerian bank fraud scammers by an ad-hoc group action is just the way to get that point across.

      • Spam is an annoying side effect of allowing open access to the web to the masses.

        Not really, since email usually doesn't go over 80/tcp. Oh, you meant net access? I can understand PHBs failure to understand the Intarwebs, but on a Geek site, there's no excuse for such sloppy language.

        The e-mail graphics looked exactly like eBay's question-from-bidders form. I clicked on reply to inform the writer that I was not offering this item at auction. The screen appeared for me to enter my eBay user name and

        • Including the part where it says "https://www.ebay.com" in the address bar?

          Actually, some phishing sites can do just that using international characters in the domain name. For example, a lower-case Cyrillic 'a' looks almost the same as the lowercase Latin 'a'. The only difference is the Unicode.

          This problem only exists with Firefox, and can be turned off easily, but it does exist.
      • It's already criminal, though. Misrepresenting one's identity in a transaction of business, or offer of transaction, is a serious felony (i.e., FRAUD). We're talking slammer time!

        I guess the hope here is that the civil violation part will encourage some cowboy lawyers to do civil take downs on these folks. Apparently the cops can't make the time...

        I'm just waiting for a bunch of pissed off black hats to start offering $500 cash rewards for the heads of nigerian scammers, though. You'd be surprised at how en

  • $500,000 (Score:4, Funny)

    by teidou ( 651247 ) <`tait' `at' `fitis.com'> on Sunday October 02, 2005 @11:31AM (#13698464) Homepage
    $500,000? I'm in.

    Aw man: I just deleted about $6,000,000 worth of opportunities, er, scams last week.

    • Re:$500,000 (Score:4, Funny)

      by Anonymous Brave Guy ( 457657 ) on Sunday October 02, 2005 @12:57PM (#13698913)

      Dear sir,

      I am write to you with very important business proposition. I understanding you recently to have lost much valuable data. I very please to offer you my services to recover this data.

      I am expert computer consultant from Nigeria, able to help you in many ways to recover your valuable data. Please just to click here [r.us] to send me details your bank accounts, so that $10,000 seed money can be taken (temporary only!) to secure our services. Honourable guarantee of funds to be returned is provided.

      Looking forward to working with you,

      Mr A Cowboy
      Customers Service Us Department
      Best Antiphishing Company In The World, Inc.
      Nigeria

  • I the msnbc article is rather vague.
    • SB 355 [ca.gov]

      Page with information on votes [ca.gov]

      THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS:

      SECTION 1. Chapter 33 (commencing with Section 22948) is added to
      Division 8 of the Business and Professions Code, to read:
      CHAPTER 33. ANTI-PHISHING ACT OF 2005

      22948. This chapter shall be known and may be cited as the
      Anti-Phishing Act of 2005.
      22948.1. For the purposes of this chapter, the following terms
      have t

  • Useless (Score:3, Insightful)

    by cdrguru ( 88047 ) on Sunday October 02, 2005 @11:31AM (#13698471) Homepage
    1. There is no accountability on the Internet. Domain registration is (or can be) anonymous, so even if you have a domain, it is meaningless. ISPs aren't going to cooperate, especially those outside of the US. It would cost $500,000 to find out who hooked you with thier phishing, so you might as well forget about it.
    2. It's their own damn fault. If you are silly enough to click links that people IM you or email you, then you are silly enough to buy a bridge from a guy on a street corner. This has been happening sinces, well, the beginning of time. The Internet just makes it a lot easiler, anonymous and risk-free. You can't stop it. It's like trying to stop daylight.

    I guess it makes the legislators in California feel good, but it isn't going to do anything to stop it. It might stop someone who lives in California, uses their home ISP account to collect information and deposits the money in their parent's bank account.

    • Re:Useless (Score:5, Insightful)

      by jurgen ( 14843 ) on Sunday October 02, 2005 @12:17PM (#13698692)
      Huh?

      Ok you're saying: a) it's too expensive to go after the criminals, and b) it's the victims own fault.

      What kind of defeatist BS is that?

      But what's more, this law addresses precisely those points... for a) it creates an economic incentive for someone to at least /try/ to go after the perps, and for b) it lets the intended victims (even if they were never actually stupid enough to fall for it) fight back.

      Seems like you should agree with those goals.

      :j

    • Re:Useless (Score:4, Insightful)

      by ash ( 98519 ) on Sunday October 02, 2005 @02:32PM (#13699404)
      Regarding your second point that "It's their own damn fault":

      Equating this to a person selling you a bridge on street corner is not a fair comparison. A person selling a bridge is something highly unusual and operating as an independent group, whereas a phisher is attempting to break in on a very common transaction, by impersonating a trusted agent with a prior relationship. For your street corner comparison, a more accurate comparison would be a group coming in and setting up a fake Bank of America location and executing transactions.

      As the other respondent says, your attitude is defeatist--too many people say things cannot be done. Just because something is difficult to defeat, or apparently impossible to stop, that is absolutely no reason to tolerate it. Murder is going to happen no matter what. Should we remove our laws against that?

      Instead of being so negative, try seeing the positive side of this: the ground-breaking it sets for other states and countries that, through continued improvement, will hopefully greatly reduce the amount of phishing by giving courts a strong set of tools with which to punish violators.
    • The way they've done it is interesting. They've basically said "it's illegal - but you go find the guy, then we'll prosecute.". Which, in the cases of companies like EBay, they might just do. Now of course, you're right, there's no way we can reach the Nigerians (etc) yet, but there are plenty of Americans out there doing it. And those that are stupid enough to defy laws within their own country where they can be easily pinned - well, at least you're getting some of them. http://www.silicon.com/re [silicon.com]
    • > # It's their own damn fault. If you are silly enough ...

      The age of reason is limited at both ends of the human life span. Below perhaps 7 years old, and above some indefinite age that could be as low as retirement age or could be past a century, human beings don't always have sufficient judgment to distinguish scams and high risk situations.

      The argument that "it's their own damn fault" is a license to prey on those who aren't as clever as the predator.

      Is "social Darwinism" still a morally credible app

  • Anti-Phishing Act, 2005 ? (Score:4, Informative)

    by karvind ( 833059 ) <karvind.gmail@com> on Sunday October 02, 2005 @11:32AM (#13698476) Journal
    Senator Patrick Leahy (D-VT) introduced an anti-phishing bill [senate.gov] that proposed stiff penalties including up to 5 years in prison and fines as steep as $250,000. I wonder what happened to that ?
    • Senator Patrick Leahy (D-VT) introduced an anti-phishing bill that proposed stiff penalties including up to 5 years in prison and fines as steep as $250,000. I wonder what happened to that ?

      They decided that when a DUI that results in the death of the non-influenced party scores you on average less than 5 years the 5 year sentence for putting up a website might have been a little extreme. Especially when you consider there are existing laws that cover this behavior (fraud, theft via misrepresentation, id t

  • Here we go again... (Score:5, Insightful)

    by QuaintRealist ( 905302 ) <quaintrealist&gmail,com> on Sunday October 02, 2005 @11:32AM (#13698478) Homepage Journal
    New laws (all laws) have unintended consequences, and fraud is already illegal. TFA provides no details, but I am always skeptical of new regulations which seem to "protect us" from something which is already covered by existing statute.

    The real difficulty is that phishers tend to operate from outside jurisdiction and for very brief periods of time. I fail to see how a new "anti-phishing" law will do much to solve the problem - but elections are soon...I doubt that is coincedence.

    • Re:Here we go again... (Score:3, Interesting)

      by saskboy ( 600063 )
      Has a court in North America ever prosecuted someone for phishing though? I've not heard of a single case, and if it had happened, I'd expect an alert Slashdotter would have informed everyone by now.

      Yes it is fraud, but I doubt a court will see a case for quite a while, what with many of the phishers being overseas, and the police resources to deal with online fraud stretched quite thin as it is. It's all they can do to take down child porn rings.

      I'm glad California is taking steps to allow citizens to su

      • Indeed (Score:2, Insightful)

        by QuaintRealist ( 905302 )
        There have been phishing convictions under existing fraud statutes (google "phishing conviction" for some examples), but that wasn't really my point. It seems that we laud politicians for sweeping "initiatives" and "wars on $badthing", but can't find the money for the folks in the trenches who are doing the real work.

        Police resources are stretched too thin - tell the politicians to get off the soapbox and support them.
        • The police (including FBI, etc), don't have the resources to go after EVERY person who does this. By making it a civil law, and attaching damages to that law, you allow individuals to get lawyers and sue the person into bankruptcy. The number of junk faxes have gone way down since the junk fax laws were passed.

          Murray passed the California anti-spam law which provided $1,000 for each spam (until the scum passed the CAN-SPAM, law). Now, the law provides for $1,000 per spam that uses a deceptive header. I, w

          • By making it a civil law, and attaching damages to that law, you allow individuals to get lawyers and sue the person into bankruptcy.

            That's the problem, even if the case is won, very likely the perp will either be broke, or have hidden away his assets and cheefully go into bankruptcy, leaving the lawyer and/or the "victim" with nothing to cover their expenses. Lawyers aren't going to be eager to go after unrecoverable awards. Perhaps a few cases will get publicity and scare some of the local phishers, but

            • You are correct. Of course, if they try to hide the money, you can go after them for it and dig. I know someone who will be filing a suit against Soloway (for spamming), but he will be in line after Braverman and Microsoft -- But he is determined to "make him my bitch."

              Even if they are overseas, you can still go after them. I went after Global Web Promotions [spamhaus.org] in a California court. They spent at least $25K tried to fight. I cannot discuss what happened after. They are subject to the jurisdiction that they i
      • The worst part is that the phishers are getting better. It's easy to ignore mail from a bank I don't have an account with, but I had to look at the headers of my last few paypal/ebay phishes to confirm they weren't real.
        How many people can do this?
        • Why would you have to do that?

          It's really this simple:
          You get an email from PayPal or your bank? It's fake. Delete it.

          Open your web browser. Log into your account, read the news there. If everyone did it that way, there'd be no problems [but for the silly few].
          • It's really this simple:
            You get an email from PayPal or your bank? It's fake. Delete it.

            Uhh, yeah, except for the legitimate e-mails that I get from PayPal or my bank which aren't fake.

            PayPal's legit e-mails will always start with your name, so if they don't, that's an easy sign it's fake.
      • I couldn't find any cases where someone was prosecuted for phishing, but I did find a case where Associated Bank-Corp. sued Earthlink for errantly labeling http://www.associatedbank.com/ [associatedbank.com] as a phishing site when it really was the bank's official website. Earthlink's anti-phishing tool redirected those attempting to navigate to the site to the following message:

        POTENTIALLY FRAUDULENT WEB SITE ALERT generated by ScamBlocker from EarthLink You have been redirected to this page by ScamBlocker from EarthLink. T

    • You miss the point. It's fraud of course, but LE doesn't have the resources to go after it. This is a bounty law... it creates an incentive for private parties to do LE's work for them. I think that's a damn good idea, but we'll have to see if it works.

      :j

    • Fraud is a crime, and if you are accused, the prosecution has to "prove beyond a reasonable doubt". This brings it into the domain of civil law, where, to lose, your opposition just needs the "preponderance of the evidence".

      So, under the new scheme, you could lose the greater of actual damages (which might be $150) or $500,000 because, you know, it sorta looks like your guilty.

      What if it sorta looks like your kid's Windows box was used in a phishing venture?

      Civil law can be scary.

    • Another problem is that people committing this kind of fraud are unlikely to have assets beyond a computer, a rented apartment and maybe a cable modem, iPod and cheap sportscar.

      So a $500,000 judgement against them is probably worthless, since bankruptcy law generally allows you to keep what you have that's worth less than a few thousand dollars.

      D

  • Is CAN-PHISH next? (Score:3, Insightful)

    by dragon_imp ( 685750 ) on Sunday October 02, 2005 @11:33AM (#13698482) Homepage

    Now, if the other states will just take notice...

    It's a shame Congress won't act, but we do not need a CAN-PHISH act.

  • at $500k a pop, very few have to actually take action for the desired effect to take place. That's not a heavy burden either, really.
    • at $500k a pop, very few have to actually take action for the desired effect to take place.

      Only if the Phisher gets caught, and in a useful jurisdiction. Furthermore, Phishers don't usually start rich. (If you start with some money, Spamming is a more effective way to make a dishonest buck.) However, they do usually work in bulk. So, the victims get to divide up: his original assets, what he stole from everyone, and the proceeds of any (legitimate) winning lottery tickets he's bought... LESS what he's sp

  • Is it not already coverd (Score:3, Insightful)

    by FidelCatsro ( 861135 ) <fidelcatsro&gmail,com> on Sunday October 02, 2005 @11:35AM (#13698492) Journal
    Under laws which control Fraud , Identify theft ,and such like .
    IANAL but why would there need to be a new law for phishing? it is after all just fraud .
    • Fraud is already illegal, but the cops do nothing at any level. It is said that they have bigger fish to fry like terrorism, speeding and adult porn. The solution seems to make it profitable for the victims to enforce the law and let legal vigilantes clean up the net. This seems like a reasonable solution.
      • Of course they have to have the money to fight it . Perhaps some lawyers would do it on a no-win no-fee basis .If you lose the case or the perpetrators have no way of paying the fine ,then nothing can replace the time you lost on the case .

      • If you combine this with the new florida law that makes it legal to shoot someone if they piss you off or maybe look a bit foreign, then it'd work very well... find phisher/spammer, shoot them in the head... profit!

  • A real representative (Score:3, Insightful)

    by canuck57 ( 662392 ) on Sunday October 02, 2005 @11:35AM (#13698493)

    This is why we need to elect normal people to government. Normal people as defined as not a professional politician. Arnold isn't corrupted with long ties to special interests and can pass laws for the people. Established politicians wouldn't be too concerned about a law like this because of special interests.

    So we get laws with teeth to protect people. Good deal.

    So vote for non-politicians to administer government, it always seems to work better over time.

    • I see, so what you're saying is that Arnold is "normal people" and has no special interest ties. Right. I'd agree with you if he were a teacher, a construction worker, a small business owner. But Arnold?
    • Arnold isn't corrupted with long ties to special interests and can pass laws for the people.

      MPAA [afterdawn.com]?

      (Of course, that's not a long tie, that's a very short leash indeed. That may be the only one... which could well be an improvement. He's also probably harder to bribe than most....)

    • There is no "special interest" for scam artists, or even really for spammers. Thats why these laws get passed about as frequently as resolutions commemorating new Foreign Legion Posts or peans to Mom's American Apple Pie. And with about as much effect, because the civil legal system is singularly incapable of pinning a real life identity to a phisher and then suing them, regardless of putting redundant laws into place to enable you to do so (you still have, lets see, fraud, wire fraud, mail fraud, and pro
  • I'm sick of those darn emails that tell me i need to update my paypal info. Of course they do look believable to normal people, except for the fact that the url is http://insert/ [insert] random ip address here]/paypal.htm

    not a good thing for people who dont know a lot.
    • If you look at the location of most of those fake paypal URL's, you'll notice most of them come from a specific region, which is easy to block.

      On the other hand, if you restrict yourself or others from those particular regions then it makes it hard to "poke around" on whatever server they may be using... Not that I would condone such behavior!

      I get them as well on my old hotmail account as well, you'd think more of the major ESPs would do something about it.

  • Why does the world need anti phishing laws? (Score:3, Insightful)

    by backslashdot ( 95548 ) on Sunday October 02, 2005 @11:37AM (#13698498)
    Actually why do we have so many damn laws? We can get rid of legislators by getting rid of laws.

    Think of the saving to sanity and finances?

    We should have only one law: "Don't do anything to harm someone else intentionally". God had the right idea when he gave Moses ten laws, provide us the bible as a sort of guideline to acheiving those laws. Not kidding.

    We should have the one law of "don't hurt others intentionally" and then have a transparent system that enables qualified judges to make justified decisions on what appropriate punishments are based on circumstances and deservement (is that a word).

    Laws get bought and even in democracies are based on people's current emotions at the time, and they are too non specific in the way they are written anyway. My point is that by have so many laws, they are over specific and miss too many situations.

    It just seems like there are an infinite number of situations and deserved punishments that trying to codify them can lead to problems and more injustice than what the intent of laws is. Each crime is slightly different.
    • Put the pipe down mister, and take three steps back...
    • You answered your own question. Because there are an infinite number of situations and deserved punishments, ten laws (or your proposed ONE law) will not work.

      Which is why we have different crimes such as manslaughter and 1st degree murder.

      With ONE law, how do you set the punishment/rehabilitation for the offender? Does stealing a loaf of bread merit the same punishment as killing an entire family?

      If not, then you get into ranking the punishments based upon the crime which requires you to define the crime w
    • That's like saying "Why does an OS have to take up so much disk space? All it needs to do is run programs". While technically correct, it's so general as to be useless in a practical situation. The same is true of laws- while they do share something like that as a fundamental basis, they have to be written down and made specific so that the decisions of law enforcement can be consistent and fair across similar situations.

    • This was tried... (Score:3, Insightful)

      by KingSkippus ( 799657 ) *

      Actually why do we have so many damn laws?

      We didn't, at least, we used to not. At one time, our whole legal system was just a few pages long [house.gov]. But our government decided that it wasn't enough, and so we've ended up with the billions of pages of legal code we have today.

      In a utopian world, I would agree with you. Unfortunately, there are just too many people who look for too many loopholes trying to screw other people over. And even that doesn't take into account the many gray areas. For example, I

      • Even at the start, the US legal system not only contained the laws passed by Congress, but all of British common law; pretty much every legal precedent back to the 1300s. All of that history could be and was considered by judges when deciding cases.

      •   Unfortunately, there are just too many people who look for too many loopholes trying to screw other people over.

        I really have to ask: why is this so? Is it an innate compulsion to fuck people over or is it a self-serving, invisible (and non-understood) sociological need to get more stuff, attention and babes, thus demonstrating dominance.
    • We should have only one law: "Don't do anything to harm someone else intentionally".

      The Golden Rule, of sorts!

      Unfortunately for this idea, there is a subjective moral base to most of our laws. Your idea would repeal all kinds of laws in various states that are covered, such as gays getting married, couples buying sex toys, adults gambling, people eating kittens, and so on.

      I'm not saying repealing those laws is good or bad, but I am saying it would make you unpopular. :-)

    • ACtually, God gave Moses 613 laws, but it had to be dumbed down to 10.
    • I've heard people say that all we need is the Golden Rule: "Do unto others as you would have them do unto you."

      But I don't like it. Why? Because the Golden Rule implies that action is a far honorable stance than inaction.

      Instead, the Golden Rule should have been this: "Don't do unto others as you would not have them do unto you."

      Humanity has paid dearly because of this mistake.

      Also, JFK got it wrong too: "Ask not what your country can do for you, but what you can do for your country."

      He should have said: "A

  • Phishing (Score:3, Funny)

    by PhoenxHwk ( 254106 ) on Sunday October 02, 2005 @11:37AM (#13698500) Homepage
    Now who ever thought they'd see politicians using the word "phishing", more or less putting it into a bill?

  • How is fishing legal now? (Score:3, Insightful)

    by autopr0n ( 534291 ) on Sunday October 02, 2005 @11:42AM (#13698519) Homepage Journal
    Isn't it just straight up fraud right now? I'm guessing this law lets you sue without actualy needing to give up your information?

  • The Phishers will be Terminated... (Score:1, Funny)

    by Anonymous Coward
    ...or the Terminators will be phished... He'll be back... I presume,,, sooner or later...
  • "...but do the lack of criminal accountability..."

    It is tough to find accountable criminals these days....
  • I had a personal website QaBOjk.com, i forgot to renew, and when i got around to it some company snatched it on me.. pissed me right off because i've used that nickname since i started using the net, and i was rather fond of my email address: jerome[at]qabojk.com They have no justify reason to steal my domain name! what? qabojk enterprises might wanna buy it? QABOJK?? its not even a word!!! those bastards..
  • Why not tweak the existing fraud statutes to close any loopholes that phishers can use to cover their asses?

    Why do they have to go through the effort of creating a whole new law when there are other laws covering this basic acticity?

    Shit like this pisses me off. Rather than tweaking the existing laws a bit, politicians need to create whole new laws when a lot of time and effort can be saved, and probably end up with a more effective law, by tweaking a close fit we already have. But new laws get more press

  • New age of bounty hunters? (Score:4, Interesting)

    by jurgen ( 14843 ) on Sunday October 02, 2005 @11:57AM (#13698587)
    Will this start a new age of bounty hunters?

    Tracing a phisher back can be pretty hard and you pretty much have to do illegal things yourself in the process since their webservers usually run on some hacked machine and the only way to trace them fast enough will be to hack into that machine yourself. But a half million bucks is enough money to make it worth it and some of the phishers may decide that it's more profitable to go after their own kind.

    Of course collecting may be the most difficult part... you can sue someone who is located in Russia in a California court, but if you win how are you going to collect?

    Btw., as I understand US law only it's probably enough if any one of the recipient, the email account that got the phishing email, the fake web server, or the company that was being spoofed are located in California for you to sue in a Cal court.

    Anyway, it'll be really interesting to see what happens with this. I've long thought that the best way to combat all sorts of scum on the internet is to create a sufficient economic incentive for bounty hunters since LE is never going to put their resources in the right places. This is the first anit-internet-scum law that makes the (potential) reward high enough, so if it works expect to see more.

    And good hunting! :j

  • Is the old-fashioned way, talking people out of their ATM PIN without using email, computers or other fancy gear [wikipedia.org], still a fair sport in California?
  • There's laws against fraud in the first place. Or does the whole 'billed your credit card under fraudulent means' no longer apply once the bad guys use computers?

  • Of course the burden is on the victim, fraud is already a criminal offense. This bill classifies phishing specifically as a CIVIL offense so the victim can collect damages. In order to collect, the victim has to sue. Don't you remember the OJ civil trial?

    Oh, and IANAL. Just knows what I sees on the teevee.

  • Huh? (Score:3, Insightful)

    by jurgen ( 14843 ) on Sunday October 02, 2005 @12:11PM (#13698664)
    Huh?

    Ok you're saying: a) it's too expensive to go after the criminals, and b) it's the victims own fault.

    What kind of defeatist BS is that?

    But what's more, this law addresses precisely those points... for a) it creates an economic incentive for someone to at least /try/ to go after the perps, and for b) it lets the intended victims (even if they were never actually stupid enough to fall for it) fight back.

    Seems like you should agree with those goals.

    :j

  • Why? (Score:2)

    by Tim C ( 15259 )
    What's wrong with existing anti-fraud legislation? Just because something involves computers doesn't mean it automatically requires a whole new law...
  • but do the lack of criminal accountability and the burden of action on the victim hinder the effectiveness of this bill?

    Phishing is already illegal across the US, if not the world. It's called "fraud". This bill merely adds more ammunition to the public's arsenal.

  • Civil vs. Criminal (Score:3, Insightful)

    by zotz ( 3951 ) on Sunday October 02, 2005 @12:38PM (#13698810) Homepage Journal
    "This is an expensive penalty for phishers who are litigated against, but do the lack of criminal accountability and the burden of action on the victim hinder the effectiveness of this bill?"

    You know, this may be worse for those who have a suit brought against them as the burden of proof for the other side is smaller. At least this is what I have been made to understand for years. (I may be using the incorrect language however.) Also, can someone who knows tell us if you can have a jury in civil suits?

    Now, as much as I dislike the activity, I also dislike laws that have such large statutory damages. (And the whichever is greater provisions.) You may have only suffered a ten dollar loss as a result of someone's foolishness, but you can collect $500,000.00 from them? We really need to go back to the thought of the punishment fitting the crime instead of trying to scare people into compliance. (I am talking in general here and not about phiching.)

    all the best,

    drew
    --
    http://www.ourmedia.org/node/57503 [ourmedia.org]
    Paper Plane Design 001 Video
    Creative Commons Attribution-ShareAlike License
    • Also, can someone who knows tell us if you can have a jury in civil suits?

      Of course you can, and when a civil suit goes to trial, it's almost always in front of a jury. I know for sure, because I've served on the jury for a civil suit.

  • I don't know about you all, but I'd rather have $500k in cash than send a phisher to jail. If only I lived in California...

  • Civil Issue (Score:3, Insightful)

    by nurb432 ( 527695 ) on Sunday October 02, 2005 @12:59PM (#13698921) Homepage Journal
    Well, at least he didnt create an entire governmental department to handle this and pushed it back out to the civil arena like other things should be ( hint : *AA ).

    However, since this often involves stealing of personal information and actual theft, perhaps it should have remained a criminal issue..
  • ...when the government figures out how to tax a sunbeam, and we'll have effective anti-Internet-fraud laws when it becomes feasible to get an anonymous Romanian into court.
  • Interesting. This is in effect a bounty for attorneys to hunt phishers.

    Expect to see some fraction of ambulance-chaser commercials in California turn into phisher-chaser commercials.
  • The slashdot way to make money:

    1. Create new PayPal account
    2. Put $10 into it
    3. Wait for a PayPal phisishing email (I get a couple a week)
    4. Fill in the new PayPal details
    5. Wait for the $10 to disappear
    6. Report the phishers
    7. Profit!

    Sorry, a few more steps that the usual profit posts, but at least this one has a better chance of making it!

  • PC Manufacturers can educate users. (Score:3, Funny)

    by Chatmag ( 646500 ) <editor@chatmag.com> on Sunday October 02, 2005 @01:30PM (#13699073) Homepage Journal
    I've made the same suggestion a few other times, and it still applies here.

    The PC manufacturers can configure a start up sequence. When a user starts their computer, a series of screens appear which demonstrate the various Internet evils and countermeasures. One can show information on spam, another on phishing, etc.

    As each screen is displayed, the user must click on a "I understand" button before going to the next screen. Only after each screen is viewed will their PC fully boot.

    How simple can it be for the PC manufacturers to do this? At least the user cannot say "I didn't know".
    • I think you're forgetting something. You'll have to do this at OS level because the BIOS isn't quite large enough to store your warning in the various languages this world is equipped with.

      (I'm assuming here you don't want to restrict this idea to only the English speaking part, and you have to target the 'not-so-computer-literate' to get any positive effect).

      As for having to plough through many "I understand" buttons, two observations:

      (1) how do you think Microsoft gets away with an almost insane amount o
  • One of the biggest problems is that banks, auction sites, and other online entities don't really seem to care. They'll do things to make it look like they care such as send out an email every now and then warning you to check the URL and set up email addresses for reporting complaints. The few times I've actually tried to report a phishing site to these large corporations, I haven't get a response for days or weeks. At that point the damage is done. Most of the phishing sites even use graphics linked fr

  • Submitter moran (Score:1)

    by Anonymous Coward
    Christ, the lame sentence after a posting pondering broader questions is always so lame on Slashdot. "Will the burden on the victim hinder enforcement?" This shows the submitter doesn't understand government at all. That is the key point of the whole measure, without which NOBODY would sue the phishers. It puts power into the hands of the people instead of people trying to complain to an uninterested distant bureaucracy with their own problems.

  • Legislation? (Score:3, Informative)

    by Sheepdot ( 211478 ) on Sunday October 02, 2005 @02:53PM (#13699485) Journal
    The solution to the problem isn't legislation, it's litigation. The problem is that the people that do phishing aren't usually from the U.S. In fact, I would even go so far as to say that only maybe 1% of phishers even live in California. And that's probably stretching it.

    Really, if you want to solve the problem of phising, what better/easier way than to remove the stupid social security number (SS#) from existence? People are worried about identity theft of credit card numbers(CC#) and we have a NATIONAL ID CARD proposal? Sounds kind of ridiculous to me.

    I know a lot of you really probably don't know the technicalities of phishing, but the only reason why identity theft is an issue is because of the holy grail of all numbers, the SS#. If I get someone's SS#, it's better than a CC#, because now I can register a CC# under their name and SS#. If you think that phishers do what they do to get a CC#, you're wrong. The SS# is what many of them are *really* after.

  • "Arnold Schwarzenegger, governor of California..."

    It's governator, baby!

  • Minnesota did this before California (Score:3, Informative)

    by dieman ( 4814 ) on Sunday October 02, 2005 @06:21PM (#13700441) Homepage
    We've had an anti-phishing law since August 1st.

    332.4 Subd. 5a. [CRIME OF ELECTRONIC USE OF FALSE PRETENSE TO
    332.5 OBTAIN IDENTITY.] (a) A person who, with intent to obtain the
    332.6 identity of another, uses a false pretense in an e-mail to
    332.7 another person or in a Web page, electronic communication,
    332.8 advertisement, or any other communication on the Internet, is
    332.9 guilty of a crime.
    332.10 (b) Whoever commits such offense may be sentenced to
    332.11 imprisonment for not more than five years or to payment of a
    332.12 fine of not more than $10,000, or both.
    332.13 (c) In a prosecution under this subdivision, it is not a
    332.14 defense that:
    332.15 (1) the person committing the offense did not obtain the
    332.16 identity of another;
    332.17 (2) the person committing the offense did not use the
    332.18 identity; or
    332.19 (3) the offense did not result in financial loss or any
    332.20 other loss to any person.
    332.21 [EFFECTIVE DATE.] This section is effective August 1, 2005,
    332.22 and applies to crimes committed on or after that date.
  • For even a slice of a half-mil judgement, it'd be profitable for those of an 'adventurist' bent to fly to Ratholistan, find the phishers, show 'em a good time and when they're good and drunk, invite them to go jet-setting to a wild party in LA. Once they're on the ground, slap 'em with a legally served summons and wait for the judgement. (But there's always the small matter of collection, I suppose).

  • "Private Attorney General" Laws (Score:3, Interesting)

    by originalhack ( 142366 ) on Monday October 03, 2005 @08:25AM (#13703141)
    This is part of a trend in consumer protection laws that is pretty effective. Instead of just providing a mechanism to allow governments agencies to enforce consumer protection laws, they give indivdual consumers the right to persue the offenders. This means that an offender cannot rely on the apathy of a government agency to permit them to flout the law. This works pretty well with telemarketing violations and deceptive advertising. Unfortunately, CAN-SPAM did the opposite so it is close to worthless.

    That said, this would work better as a national law that permits state courts to be used for action.

Slashdot Top Deals

Without life, Biology itself would be impossible.

Close