Bill Text: PA SB299 | 2009-2010 | Regular Session | Introduced

---

Bill Title: Providing for the offense of phishing.

Spectrum: Slight Partisan Bill (Republican 17-9)

Status: (Engrossed - Dead) 2009-08-06 - Re-referred to APPROPRIATIONS [SB299 Detail]

Download: Pennsylvania-2009-SB299-Introduced.html

---

PRINTER'S NO. 298
THE GENERAL ASSEMBLY OF PENNSYLVANIA
SENATE BILL
No. 299 Session of2009
INTRODUCED BY CORMAN, WONDERLING, BAKER, BROWNE, ERICKSON, ALLOWAY, BRUBAKER, GORDNER, ORIE, FONTANA, KASUNIC, LOGAN, O'PAKE, PIPPY, STACK, STOUT, TARTAGLIONE, WILLIAMS, RAFFERTY, ROBBINS, TOMLINSON, WAUGH, D. WHITE, M. WHITE AND WARD, FEBRUARY 20, 2009
REFERRED TO COMMUNICATIONS AND TECHNOLOGY, FEBRUARY 20, 2009
AN ACT
Amending Title 18 (Crimes and Offenses) of the Pennsylvania
Consolidated Statutes, providing for the offense of phishing.
The General Assembly of the Commonwealth of Pennsylvania
hereby enacts as follows:
Section 1. Chapter 76 of Title 18 of the Pennsylvania
Consolidated Statutes is amended by adding a subchapter to read:
SUBCHAPTER F
PHISHING
Sec.
7671. Definitions.
7672. Phishing.
7673. Protection from liability.
7674. Civil relief.
§ 7671. Definitions.
The following words and phrases when used in this subchapter
shall have the meanings given to them in this section unless the
context clearly indicates otherwise:
"Communication." A message conveyed by oral, written or
electronic means, including telephone, electronic mail,
Internet, facsimile, telex, wireless communication, web page or
similar transmission.
"Identifying information." Any document, photographic,
pictorial or computer image of another person, or any fact used
to establish identity, including any of the following:
(1) Name.
(2) Birth date.
(3) Social Security number.
(4) Driver's license number or nondriver governmental
identification number.
(5) Telephone number.
(6) Checking or savings account number.
(7) Student identification number.
(8) Employee or payroll number.
(9) Electronic signature.
"Interactive computer service." An information service or
system that enables computer access by multiple users to a
computer server, including specifically a service or system that
provides access to the Internet or to software services
available on a server, and such systems operated or services
offered by a library or educational institution.
"Legitimate business." A business that is registered to do
business under the law of any jurisdiction.
"Web page." A location, with respect to the Internet
website, that has a single uniform resource locator or other
single location with respect to the Internet.
§ 7672. Phishing.
20090SB0299PN0298 - 2 -
(a) Offense of phishing.--A person commits the offense of
phishing under the following circumstances if the person, with
the intent to defraud or injure another or with the knowledge
that a fraud is being facilitated or that an injury is being
perpetrated by another person:
(1) (i) makes a communication requesting or soliciting
a person to provide identifying information under false
pretenses by or on behalf of a legitimate business,
without the authority or approval of the business; and
(ii) receives identifying information pursuant to
the action taken under subparagraph (i); or
(2) sells or distributes any identifying information
obtained under paragraph (1).
(b) Venue.--An offense committed under this section may be
deemed to have been committed at any of the following locations:
(1) The place where a person possessed, obtained or used
the identifying information of another person under false
pretenses.
(2) The residence of the person whose identifying
information has been obtained or used under false pretenses.
(3) The business or employment address of the person
whose identifying information has been obtained or used under
false pretenses if the identifying information at issue is
associated with the person's business or employment.
(c) Grading.--A violation of subsection (a)(1) shall be
graded as a felony of the third degree. A violation of
subsection (a)(2) shall be graded as a felony of the second
degree.
(d) Concurrent jurisdiction to prosecute.--In addition to
the authority conferred upon the Attorney General by the act of
20090SB0299PN0298 - 3 -
October 15, 1980 (P.L.950, No.164), known as the Commonwealth
Attorneys Act, the Attorney General shall have the authority to
investigate and to institute criminal proceedings for any
violation of this section or any series of violations involving
more than one county of this Commonwealth or another state. No
person charged with a violation of this section by the Attorney
General shall have standing to challenge the authority of the
Attorney General to investigate or prosecute the case, and, if
the challenge is made, the challenge shall be dismissed and no
relief shall be made available in the courts of this
Commonwealth to the person making this challenge.
§ 7673. Protection from liability.
No interactive computer service provider may be held liable
under any provision of the laws of this Commonwealth or of one
of its political subdivisions for removing or disabling access
to content that resides on an Internet website or other online
location controlled or operated by the provider which the
provider believes in good faith is used to engage in a violation
of this subchapter.
§ 7674. Civil relief.
(a) Civil action.--An interactive computer service provider
and a legitimate business shall each have a civil cause of
action against any person who utilizes the interactive computer
service to make a communication under false pretenses by or on
behalf of the business, without the authority of the business,
for the purpose of requesting or soliciting a person to provide
identifying information.
(b) Civil remedies.--A person permitted to bring a civil
action under this section may do any of the following:
(1) Seek injunctive relief to restrain a person from
20090SB0299PN0298 - 4 -
continuing the violation.
(2) Recover damages in an amount equal to the greater of
the following:
(i) Actual damages arising from the violation.
(ii) Statutory damages, as determined by the court,
of not more than $100,000 for each violation of the same
nature.
(c) Treble damages.--The court may increase an award of
actual damages in an action brought under this section to an
amount not to exceed three times the actual damages sustained if
the court finds that the violations have occurred with a
frequency as to constitute a pattern or practice.
(d) Attorney fees.--A person who prevails in an action filed
under this section shall be entitled to recover reasonable
attorneys fees and court costs.
(e) Venue.--An action under this section may be brought:
(1) At the residence or principal place of business of a
person who receives a communication.
(2) At the principal place of business of the
interactive computer service.
(3) At such other location as provided for by the
Pennsylvania Rules of Civil Procedure.
Section 2. This act shall take effect in 60 days.
20090SB0299PN0298 - 5 -