THE GENERAL ASSEMBLY OF PENNSYLVANIA

HOUSE BILL

INTRODUCED BY NEUMAN, MARKOSEK, BAKER, BROWNLEE, CALTAGIRONE, CARROLL, CLYMER, D. COSTA, CRUZ, DAVIS, DEASY, DeLUCA, DONATUCCI, FABRIZIO, FARRY, GEIST, GIBBONS, GOODMAN, HESS, HORNAMAN, JOSEPHS, KAVULICH, W. KELLER, KORTZ, KULA, LONGIETTI, MAHONEY, MANN, MILLARD, MILNE, M. O'BRIEN, PASHINSKI, PETRARCA, PYLE, QUINN, REICHLEY, SAINATO, STURLA, SWANGER, VULAKOVICH, COHEN AND DENLINGER, MARCH 21, 2011

AS REPORTED FROM COMMITTEE ON JUDICIARY, HOUSE OF REPRESENTATIVES, AS AMENDED, OCTOBER 25, 2011   

AN ACT

Amending Title 18 (Crimes and Offenses) of the Pennsylvania

Consolidated Statutes, in computer offenses, providing for

the offense of phishing and for protection from liability

under certain circumstances.

The General Assembly of the Commonwealth of Pennsylvania

hereby enacts as follows:

Section 1.  Chapter 76 of Title 18 of the Pennsylvania

Consolidated Statutes is amended by adding a subchapter to read:

SUBCHAPTER F

PHISHING

Sec.

7671.  Definitions.

7672.  Phishing.

7673.  Protection from liability.

7674.  Civil relief.

§ 7671.  Definitions.

The following words and phrases when used in this subchapter

shall have the meanings given to them in this section unless the

context clearly indicates otherwise:

"Communication."  A message or data conveyed by oral, written

<--

or electronic means, including telephone, electronic mail,

Internet, facsimile, telex, wireless communication, web page or

similar transmission.

"Identifying information."  Any document, photographic,

<--

pictorial or computer image of another person or any fact used

to establish identity, including any of the following:

(1)  Name.

(2)  Birth date.

(3)  Social Security number.

(4)  Driver's license number or nondriver governmental

identification number.

(5)  Telephone number.

(6)  Checking or savings account number.

(7)  Student identification number.

(8)  Employee or payroll number.

(9)  Electronic signature. As defined in 18 Pa.C.S. §

<--

4120(f) (relating to identity theft).

"Interactive computer service."  An information service or

system that enables computer access by multiple users to a

computer server, including specifically a service or system that

provides access to the Internet or to software services

available on a server, and such systems operated or services

offered by a library or educational institution.

"Legitimate business."  A business that is registered to do

business under the law of any jurisdiction or any of its

<--

subsidiaries.

"Web page."  A location, with respect to the World Wide Web,

that has a single uniform resource locator or other single

location with respect to the Internet.

§ 7672.  Phishing.

(a)  Offense of phishing.--An actor commits the offense of

phishing under the following circumstances if the actor, with

the intent to defraud or injure anyone or with the knowledge

that a fraud is being facilitated or that an injury is being

perpetrated by anyone:

(1)  makes a communication under false pretenses by or on

behalf of a legitimate business, without the authority or

approval of the business;

(2)  uses the communication to induce, request or solicit

a person to provide identifying information; and

(3)  the person provides the identifying information to

the actor or an accomplice of the actor.

(b)  Additional violations.--It shall also be a violation of

this section for a person to sell or distribute any identifying

information obtained in violation of subsection (a) with the

intent to defraud or injure anyone or with the knowledge that a

fraud is being facilitated or that an injury is being

perpetrated by anyone.

(c)  Venue.--An offense committed under this section may be

deemed to have been committed at any of the following locations:

(1)  The place where a person possessed, obtained or used

the identifying information of another person under false

pretenses.

(2)  The residence of the person whose identifying

information has been obtained or used under false pretenses.

(3)  The business or employment address of the person

whose identifying information has been obtained or used under

false pretenses, if the identifying information at issue is

associated with the person's business or employment.

(d)  Grading.--A violation of subsection (a) shall be graded

as a felony of the third degree. A violation of subsection (b)

shall be graded as a felony of the second degree.

(e)  Concurrent jurisdiction to prosecute.--In addition to

the authority conferred upon the Attorney General by the act of

October 15, 1980 (P.L.950, No.164), known as the Commonwealth

Attorneys Act, the Attorney General shall have the authority to

investigate and to institute criminal proceedings for any

violation of this section or any series of violations involving

more than one county of this Commonwealth or another state. No

person charged with a violation of this section by the Attorney

General shall have standing to challenge the authority of the

Attorney General to investigate or prosecute the case, and if

the challenge is made, the challenge shall be dismissed and no

relief shall be made available in the courts of this

Commonwealth to the person making this challenge.

§ 7673.  Protection from liability.

No interactive computer service provider may be held liable

under any provision of the laws of this Commonwealth or of one

of its political subdivisions for removing or disabling access

to content that resides on an Internet website or other online

location controlled or operated by the provider which the

provider believes in good faith is used to engage in a violation

of this subchapter.

§ 7674.  Civil relief.

(a)  Civil action.--An interactive computer service provider

and a business shall each have a civil cause of action against

any person who utilizes the interactive computer service to make

a communication under false pretenses by or on behalf of the

business, without the authority of the business, for the purpose

of inducing, requesting or soliciting a person to provide

identifying information.

(b)  Civil remedies.--A person permitted to bring a civil

action under this section may do any of the following:

(1)  Seek injunctive relief to restrain the violator from

continuing the violation.

(2)  Recover damages in an amount equal to the greater of

the following:

(i)  Actual damages arising from the violation.

(ii)  Statutory damages, as determined by the court,

of not more than $100,000 for each violation of the same

nature.

(3)  Obtain both injunctive relief and damages as

provided in this subsection.

(c)  Treble damages.--The court may increase an award of

actual damages in an action brought under this section to an

amount not to exceed three times the actual damages sustained if

the court finds that the violations have occurred with a

frequency as to constitute a pattern or practice course of

<--

conduct.

(d)  Attorney fees.--A person who prevails in an action filed

under this section shall be entitled to recover reasonable

attorneys fees and court costs.

(e)  Venue.--An action under this section may be brought:

(1)  At the residence or principal place of business of a

person who receives a communication.

(2)  The principal place of business of the interactive

computer service.

(3)  Such other location as provided for by the

Pennsylvania Rules of Civil Procedure.

Section 2.  This act shall take effect in 60 days.