Nigerian scam >>Legislation against Phishing

Federal and state governments have earnestly begun to commence legislation to officially address phishing. Numerous government privacy watchdog committees, such as CDT and NASCIO, have become very vigorous in providing existing technology updates that emphasize the guard of personal data, citizen faith and assurance in government, identity management, and theft concerns.

The new uniqueness Theft Penalty Enhancement Act (HR-1731) addresses the core tactic of Internet scammers; it prohibits the creation of e-mail that represents itself as a rightful message to hoax the recipient into revealing personal information with the intention to pinch the recipient’s individuality.

Everyone, particularly law enforcement, hope that this new legislation will facilitate a quicker turnaround time for arrests, and more important, the capability of the courts to convict. Although HR-1731 still require enforcement to stay for a person to be persecuted before action can be taken against the phisher, certainty carries a mandatory two-year sentence.This means that coverage phishing movement to law enforcement could simply fill up their incoming mailbox, unless an person reported the crime after they had naively fell for the scam. .

1. Anti-Phishing Act of 2004, S2636

2. The Spy Block Act, S2145

3. Safeguard against Privacy Invasion Act (or SpyAct), HR-2929

4.Social Security Number Privacy and Identity Theft Prevention Act of 2003, HR-2971

Which states that the act of phishing would be measured a federal crime. This invoice would forbid the act of spoofing a Web site for the purpose of acquiring another person’s identity. Although this bill will facilitate law enforcement to react to specific phishing attacks in a more timely fashion, will it actually aid in tracking the phishers more competently and eventually lead to arrests? This is a question with both technical and legal ramifications.

1. Technical Ramifications

2. Lawful Ramifications

The reason that phishers are often not being prosecuted nowadays involves many factors. Simply put, from a technical perspective, phishing is a very fast-paced criminal action. The act of phishing can be performed immediately; as fast as phishers strike, they vanish back into cyberspace.There is no getaway car to chase, no literal fingerprints to lift, and no face for a witness to identify. By the time customary forensics teams become involved, far too much damage has occurred and the trail is long cold.

The phony Web sites are now very quickly migrating from one server to another, in their effort to stay one step ahead of Internet service providers (ISPs) and law enforcement. Secure Science has observed new phishing sites becoming active within as small time as six hours and as long as 10 days. Practical detection and tracking of victim-zero, or when the phishers perform their first target test, is the key to being able to stop phishing attacks, despite of their intended payload (malware/spam).

Merely enacting new legislation with heavy penalty and ramping up law enforcement by you are not enough to stop phishing.The existing approach require a person to become mistreated before law enforcement and trial can take action against the phisher. Even when a technically savvy Internet user forwards suspected e-mail fraud to the DOJ or FTC, no enforcement can take place until a mistreated individual can be identified.

Since a phisher’s whole intention is to commit fraud, why shouldn’t a phisher be punishable before someone is victimized? The bulk of current spyware legislation may be too wide to really do much more than create a mountain of litigation flanked by legitimate e-commerce business owners and the state(s). Antivirus and ant spam vendors are included in this litigation, since their traditional collecting of data over the Internet to analyze and prevent virus attack by as long as online updates is construed as illegal under Utah’s SB-323 spyware law.

The Anti-Phishing Act of 2004 (S2636) is the primary legislation of its type that really addresses the entire scam. This includes formation of fake Web sites and sending fraudulent e-mail. Freedom of talking issue are avert by simply stipulate that the performer has the specific criminal purpose of committing a crime of fraud or identity theft.This bill makes it illegal to intentionally send a spoofed e-mail that is connected to a fraudulent Web site, with the purpose of commit a crime, and it criminalizes the operation of a fraudulent Web site. If the bill were to become law, each identifiable element of a phishing scam would become a felony, subject to five years in prison and/or a fine up to $250,000.

But even if the Anti-Phishing Act were to become law, there is unmoving much work to be done on a global basis. Most phishing scams operate outside North America, and it is exceedingly difficult and time intense to attempt to prosecute an individual residing in an overseas country. Even if law enforcement successfully track a phishing site outside the United States, not only do the cost and time connected with making an arrest on a quickly disappearance performer become prohibitive, but effective collaboration between international law enforcement agencies needs much work. Overall trust in the Internet for secure infrastructure for not only ecommerce but all forms of electronic exchange is simply not addressed by current legislation. Antivirus and ant spam companies that offer Internet mail filtering will face an increasing level of sophistication from phishers that could ultimately slow down vendors’ ability to sieve legitimate communications from the fake ones. .