PRINTER'S NO. 1211
THE GENERAL ASSEMBLY OF PENNSYLVANIA
HOUSE BILL
No.
969
Session of
2015
INTRODUCED BY NEUMAN, COHEN, CALTAGIRONE, V. BROWN, DUNBAR,
McNEILL, D. COSTA, DRISCOLL, KOTIK, YOUNGBLOOD, TRUITT,
KAVULICH, BISHOP, DONATUCCI, MILLARD, READSHAW, BOBACK,
W. KELLER, SCHLOSSBERG, SCHWEYER, CUTLER, M. K. KELLER,
MATZIE, SABATINA, BROWNLEE, MURT, HARHAI, McCARTER, B. MILLER
AND GIBBONS, APRIL 14, 2015
REFERRED TO COMMITTEE ON CONSUMER AFFAIRS, APRIL 14, 2015
AN ACT
Amending Title 18 (Crimes and Offenses) of the Pennsylvania
Consolidated Statutes, in computer offenses, providing for
the offense of phishing and for protection from liability
under certain circumstances.
The General Assembly of the Commonwealth of Pennsylvania
hereby enacts as follows:
Section 1. Chapter 76 of Title 18 of the Pennsylvania
Consolidated Statutes is amended by adding a subchapter to read:
SUBCHAPTER F
PHISHING
Sec.
7671. Definitions.
7672. Phishing.
7673. Protection from liability.
7674. Civil relief.
§ 7671. Definitions.
The following words and phrases when used in this subchapter
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
shall have the meanings given to them in this section unless the
context clearly indicates otherwise:
"Communication." A message or data conveyed by oral, written
or electronic means, including telephone, electronic mail,
Internet, facsimile, telex, wireless communication , web page or
similar transmission.
" Identifying information. " As defined in 18 Pa.C.S. §
4120(f) (relating to identity theft).
" Interactive computer service. " An information service or
system that enables computer access by multiple users to a
computer server, including specifically a service or system that
provides access to the Internet or to software services
available on a server, and such systems operated or services
offered by a library or educational institution.
" Legitimate business. " A business that is registered to do
business under the law of any jurisdiction or any of its
subsidiaries.
" Web page. " A location, with respect to the World Wide Web,
that has a single uniform resource locator or other single
location with respect to the Internet.
§ 7672. Phishing.
(a) Offense of phishing.--An actor commits the offense of
phishing if he:
(1) intends to defraud or injure another person or knows
that a fraud is being facilitated or that an injury is being
perpetrated by anyone and;
(2) makes a communication under false pretenses by or on
behalf of a legitimate business without the authority or
approval of the business and uses the communication to
induce, request or solicit a person to provide identifying
20150HB0969PN1211 - 2 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
information and the person provides the identifying
information to the actor or an accomplice of the actor.
(b) Additional violations.--It shall also be a violation of
this section for a person to sell or distribute any identifying
information obtained in violation of subsection (a) with the
intent to defraud or injure anyone or with the knowledge that a
fraud is being facilitated or that an injury is being
perpetrated by anyone.
(c) Venue.--An offense committed under this section may be
deemed to have been committed at any of the following locations:
(1) The place where a person possessed, obtained or used
the identifying information of another person under false
pretenses.
(2) The residence of the person whose identifying
information has been obtained or used under false pretenses.
(3) The business or employment address of the person
whose identifying information has been obtained or used under
false pretenses, if the identifying information at issue is
associated with the person's business or employment.
(d) Grading.--A violation of subsection (a) shall be graded
as a felony of the third degree. A violation of subsection (b)
shall be graded as a felony of the second degree.
(e) Concurrent jurisdiction to prosecute.--In addition to
the authority conferred upon the Attorney General by the act of
October 15, 1980 (P.L.950, No.164) , known as the Commonwealth
Attorneys Act, the Attorney General shall have the authority to
investigate and to institute criminal proceedings for any
violation of this section or any series of violations involving
more than one county of this Commonwealth or another state. No
person charged with a violation of this section by the Attorney
20150HB0969PN1211 - 3 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
General shall have standing to challenge the authority of the
Attorney General to investigate or prosecute the case, and if
the challenge is made, the challenge shall be dismissed and no
relief shall be made available in the courts of this
Commonwealth to the person making this challenge.
§ 7673. Protection from liability.
No interactive computer service provider may be held liable
under any provision of the laws of this Commonwealth or of one
of its political subdivisions for removing or disabling access
to content that resides on an Internet website or other online
location controlled or operated by the provider which the
provider believes in good faith is used to engage in a violation
of this subchapter.
§ 7674. Civil relief.
(a) Civil action.--An interactive computer service provider
and a business shall each have a civil cause of action against
any person who utilizes the interactive computer service to make
a communication under false pretenses by or on behalf of the
business, without the authority of the business, for the purpose
of inducing, requesting or soliciting a person to provide
identifying information.
(b) Civil remedies.--A person permitted to bring a civil
action under this section may do any of the following:
(1) Seek injunctive relief to restrain the violator from
continuing the violation.
(2) Recover damages in an amount equal to the greater of
the following:
(i) Actual damages arising from the violation.
(ii) Statutory damages, as determined by the court,
of not more than $100,000 for each violation of the same
20150HB0969PN1211 - 4 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
nature.
(3) Obtain both injunctive relief and damages as
provided in this subsection.
(c) Treble damages.--The court may increase an award of
actual damages in an action brought under this section to an
amount not to exceed three times the actual damages sustained if
the court finds that the violations have occurred with a
frequency as to constitute a course of conduct .
(d) Attorney fees.--A person who prevails in an action filed
under this section shall be entitled to recover reasonable
attorneys fee and court costs.
(e) Venue.--An action under this section may be brought at
one of the following locations:
(1) The residence or principal place of business of a
person who receives a communication.
(2) The principal place of business of the interactive
computer service.
(3) Such other location as provided for by the
Pennsylvania Rules of Civil Procedure.
Section 2. This act shall take effect in 60 days.
20150HB0969PN1211 - 5 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20