Source: https://www.nysenate.gov/legislation/bills/2017/S8138
Timestamp: 2019-12-06 13:36:02
Document Index: 20927762

Matched Legal Cases: ['§156', '§156', '§30', '§ 156', '§ 156', '§ 156', '§ 156', '§ 156', '§ 156', '§ 156', '§\n30', '§ 2', '§ 156', '§ 156', '§ 156', '§ 3']

NY State Senate Bill S8138
senate Bill S8138
Establishes the offenses of phishing in the third degree, phishing in the second degree and phishing in the first degree; and relates to the time in which a prosecution of such offenses must be commenced
Get Status Alerts for S8138
Apr 17, 2018 1st report cal.833
Apr 06, 2018 referred to codes
Apr 17, 2018 - Codes committee Vote
Codes Committee Vote: Apr 17, 2018
S8138 (ACTIVE) - Details
Amd §156.00, add §§156.41, 156.42 & 156.43, Pen L; amd §30.10, CP L
S3172, A6514
S8138 (ACTIVE) - Summary
Establishes the offenses of phishing in the third degree, phishing in the second degree and phishing in the first degree; and relates to the time in which prosecution of such offenses must be commenced.
S8138 (ACTIVE) - Sponsor Memo
BILL NUMBER: S8138
lishing the offenses of phishing in the third degree, phishing in the
second degree and phishing in the first degree; and to amend the crimi-
nal procedure law, in relation to the time in which a prosecution of
such offenses must be commenced
To make phishing a high felony and to set the statute of limitations for
committing such crimes at twenty years.
Section one of the bill adds subdivision 10 to § 156 of the penal law to
define malware as computer software specifically designed to cause
damage to a device or network.
Section two of the bill adds § 156.41, § 156.42, and § 156.43 to the
penal law. § 156.41 of penal law creates the crime of phishing in the
third degree when a person sends an email to another individual urging
them to send money to the person or to a third-party account to which
the person has access, download an attachment which contains malware
infecting the individual's computer or electronic device, or click on a
link which redirects the individual to a website requiring the individ-
ual to input his or her login credentials, banking information, or
personal information or which causes malware to automatically be down-
loaded onto the individual's computer or electronic device with the
intent to either steal such person's login credentials, passwords,
money, financial or personal information or introduce a malware attack
on such person's computer data.Phishing in the third degree is classi-
fied as a class A misdemeanor.
§ 156.42 of the penal law creates the crime of phishing in the second
degree when a person commits the crime of phishing in the third degree
and causes an individual to send money in the aggregate exceeding $500
or damages the individual's computer or electronic device or causes the
loss of data in an amount in the aggregate exceeding $500. Phishing in
the second degree is classified as a class E felony.
§ 156.43 of the penal law creates the crime of phishing in the first
and causes an individual to send money in the aggregate exceeding $2,000
loss of data in an amount in the aggregate exceeding $2,000. Phishing in
the first degree is classified as a class D felony.
Section three of the bill adds paragraph (h) to subdivision three of §
30.10 of the penal law to provide a twenty year statute of limitation
for the prosecution of phishing in the first, second, or third degree.
Section four of the bill provides the effective date.
The internet has brought about an explosion of opportunist looking to
exploit the public by committing cybercrimes such as spam emails and
phishing attacks operating in the dark web.
Spam emails are unsolicited bulk messages typically sent by spambots,
which are automated programs that search the internet looking for email
addresses. Spammers then create email distribution lists which typically
send an email to millions of email addresses which can be used to,
amongst other things, promote scams which may utilize a phishing attack.
Phishing is the fraudulent practice of sending emails purporting to be
from reputable source in order to induce individuals to reveal personal
information, such as passwords and credit card numbers. Many times the
email pressures or entices the person to download an attachment or open
a link to a website (which is designed to mimic the site of a legitimate
business) by telling the person that they will face some difficulty if
they don't, such as their account being frozen. This is done to trick
the person into divulging or providing their personal and financial
information, including, but not limited to, passwords, account IDs,
credit card information, and personal health information. The attachment
or fake website may also install malware onto a person's device which is
meant to obtain access to or steal the aforementioned information or
other information on the device or network the device is connected to.
New York would not be alone in combatting cybercrimes. In 2016, Washing-
ton State enacted legislation which addressed various types of cyber-
crimes, including those related to phishing and malware. 12 other states
have imposed criminal penalties for committing cybercrimes. Other
states, including New Jersey, Pennsylvania, and South Carolina, have
introduced legislation to try and tackle the phishing problem.
According to Symantec Corporation (Symantec), which provides security
against cyberattacks, July 2017 found that 55.3% of all emails globally
were spam email, a rate which was expected to continue to increase, and
saw the phishing rate grow to 1 in 1,968 emails.  Symantec also found
that 1 out of every 9 email users encounter email malware in the first
Internet crime can be a profitable business. The FBI's 2016 Internet
Crime Report found that there were almost 20,000 victims of phishing
attacks in 2016 resulting in losses in excess of $31 million. This does
not include targets of malware, scareware, or ransomware which impacted
another 5,000 victims, resulting in losses exceeding an additional $6
Unfortunately, perpetrators of cyberattacks are difficult to identify,
locate, and apprehend.Quite often, the person committing a cybercrime is
doing so outside the jurisdiction of the United States. As such, even
though police investigators may amass strong legal evidence to verify
the identity and location of the cybercriminal, many times law enforce-
ment has no legal ability to arrest the person.Therefore, because such
individuals are difficult to bring into custody, the typical statute of
limitations in New York State of 3-5 years for a misdemeanor or felony
is an insufficient timeframe and is required to be substantially longer
which this legislation accordingly provides for.  Because cybercriminals
operate in the dark web, making it almost impossible to pinpoint their
location, the difficulty in identifying and apprehending them within a
reasonable timeframe means that they are assured of getting away with
the crime simply because investigators lose their lead and the case goes
For perpetrators of cybercrimes, a short statute of limitations for the
nature of the crimes that they commit means they will almost always get
away simply because they are extremely unlikely to be caught quickly
enough to enable successful prosecution.This bill will serve as a deter-
rent to cybercriminals committing these crimes against New Yorkers
because they will know that the 20 year statute of limitations means
they will face certain prosecution and will be more likely to be brought
to justice by the law enforcers of the future.
First of November next succeeding the date after becoming law.
S8138 (ACTIVE) - Bill Text download pdf
AN ACT to amend the penal law, in relation to establishing the  offenses
of  phishing  in  the  third degree, phishing in the second degree and
phishing in the first degree; and to amend the criminal procedure law,
in relation to the time in which a prosecution of such  offenses  must
Section 1. Section 156.00 of the penal law is amended by adding a  new
10.  "MALWARE"  MEANS COMPUTER SOFTWARE SPECIFICALLY DESIGNED TO CAUSE
DAMAGE TO A DEVICE OR A NETWORK.
§ 2. The penal law is amended by adding  three  new  sections  156.41,
156.42 and 156.43 to read as follows:
§ 156.41 PHISHING IN THE THIRD DEGREE.
A  PERSON  IS  GUILTY  OF  PHISHING IN THE THIRD DEGREE WHEN HE OR SHE
SENDS AN EMAIL TO AN INDIVIDUAL:
1. URGING THE INDIVIDUAL TO:
A. SEND MONEY TO THE PERSON OR TO A THIRD-PARTY ACCOUNT TO  WHICH  THE
PERSON HAS ACCESS;
B.  DOWNLOAD  AN ATTACHMENT WHICH CONTAINS MALWARE INFECTING THE INDI-
VIDUAL'S COMPUTER OR ELECTRONIC DEVICE; OR
C. CLICK ON A LINK WHICH REDIRECTS THE INDIVIDUAL TO A WEBSITE REQUIR-
ING THE INDIVIDUAL TO INPUT HIS OR HER LOGIN CREDENTIALS, BANKING INFOR-
MATION, OR PERSONAL INFORMATION OR WHICH CAUSES MALWARE TO AUTOMATICALLY
BE DOWNLOADED ONTO THE INDIVIDUAL'S COMPUTER OR ELECTRONIC DEVICE;
2. WITH THE INTENT TO:
A. STEAL SUCH PERSON'S LOGIN CREDENTIALS, PASSWORDS, MONEY,  FINANCIAL
OR PERSONAL INFORMATION; OR
B. INTRODUCE A MALWARE ATTACK ON SUCH PERSON'S COMPUTER DATA.
PHISHING IN THE THIRD DEGREE IS A CLASS A MISDEMEANOR.
§ 156.42 PHISHING IN THE SECOND DEGREE.
LBD14017-04-8
S. 8138                             2
A  PERSON  IS  GUILTY  OF PHISHING IN THE SECOND DEGREE WHEN HE OR SHE
COMMITS THE CRIME OF PHISHING IN THE THIRD DEGREE AND CAUSES AN INDIVID-
UAL TO SEND MONEY IN THE AGGREGATE EXCEEDING  FIVE  HUNDRED  DOLLARS  OR
CAUSES  DAMAGE  TO THE INDIVIDUAL'S COMPUTER OR ELECTRONIC DEVICE OR THE
LOSS  OF  DATA  IN  AN  AMOUNT  IN  THE AGGREGATE EXCEEDING FIVE HUNDRED
PHISHING IN THE SECOND DEGREE IS A CLASS E FELONY.
§ 156.43 PHISHING IN THE FIRST DEGREE.
A PERSON IS GUILTY OF PHISHING IN THE FIRST  DEGREE  WHEN  HE  OR  SHE
UAL  TO  SEND  MONEY  IN THE AGGREGATE EXCEEDING TWO THOUSAND DOLLARS OR
CAUSES DAMAGE TO THE INDIVIDUAL'S COMPUTER OR ELECTRONIC DEVICE  OR  THE
LOSS  OF  DATA  IN  AN  AMOUNT  IN  THE AGGREGATE EXCEEDING TWO THOUSAND
PHISHING IN THE FIRST DEGREE IS A CLASS D FELONY.
§ 3. Subdivision 3 of section 30.10 of the criminal procedure  law  is
(H)  A  PROSECUTION  FOR  PHISHING  IN  THE FIRST DEGREE AS DEFINED IN
SECTION 156.43, PHISHING IN THE SECOND  DEGREE  AS  DEFINED  IN  SECTION
156.42  OR  PHISHING IN THE THIRD DEGREE AS DEFINED IN SECTION 156.41 OF
THE PENAL LAW MAY BE COMMENCED WITHIN TWENTY YEARS AFTER THE  COMMISSION