1Amending Title 18 (Crimes and Offenses) of the Pennsylvania
2Consolidated Statutes, in computer offenses, providing for
3the offense of phishing and for protection from liability
4under certain circumstances.

5The General Assembly of the Commonwealth of Pennsylvania
6hereby enacts as follows:

7Section 1. Chapter 76 of Title 18 of the Pennsylvania
8Consolidated Statutes is amended by adding a subchapter to read:

9SUBCHAPTER F

10PHISHING

11Sec.

127671. Definitions.

137672. Phishing.

147673. Protection from liability.

157674. Civil relief.

16§ 7671. Definitions.

1The following words and phrases when used in this subchapter
2shall have the meanings given to them in this section unless the
3context clearly indicates otherwise:

4"Communication." A message or data conveyed by oral, written 
5or electronic means, including telephone, electronic mail, 
6Internet, facsimile, telex, wireless communication, web page or 
7similar transmission.

8"Identifying information." As defined in 18 Pa.C.S. § 
94120(f) (relating to identity theft).

10"Interactive computer service." An information service or 
11system that enables computer access by multiple users to a 
12computer server, including specifically a service or system that 
13provides access to the Internet or to software services 
14available on a server, and such systems operated or services 
15offered by a library or educational institution.

16"Legitimate business." A business that is registered to do 
17business under the law of any jurisdiction or any of its 
18subsidiaries.

19"Web page." A location, with respect to the World Wide Web, 
20that has a single uniform resource locator or other single 
21location with respect to the Internet.

22§ 7672. Phishing.

23(a) Offense of phishing.--An actor commits the offense of
24phishing under the following circumstances if the actor, with
25the intent to defraud or injure anyone or with the knowledge
26that a fraud is being facilitated or that an injury is being
27perpetrated by anyone:

28(1) makes a communication under false pretenses by or on 
29behalf of a legitimate business, without the authority or 
30approval of the business;

1(2) uses the communication to induce, request or solicit 
2a person to provide identifying information; and

3(3) the person provides the identifying information to
4the actor or an accomplice of the actor.

5(b) Additional violations.--It shall also be a violation of
6this section for a person to sell or distribute any identifying
7information obtained in violation of subsection (a) with the
8intent to defraud or injure anyone or with the knowledge that a
9fraud is being facilitated or that an injury is being
10perpetrated by anyone.

11(c) Venue.--An offense committed under this section may be
12deemed to have been committed at any of the following locations:

13(1) The place where a person possessed, obtained or used
14the identifying information of another person under false
15pretenses.

16(2) The residence of the person whose identifying 
17information has been obtained or used under false pretenses.

18(3) The business or employment address of the person 
19whose identifying information has been obtained or used under 
20false pretenses, if the identifying information at issue is 
21associated with the person's business or employment.

22(d) Grading.--A violation of subsection (a) shall be graded
23as a felony of the third degree. A violation of subsection (b)
24shall be graded as a felony of the second degree.

25(e) Concurrent jurisdiction to prosecute.--In addition to 
26the authority conferred upon the Attorney General by the act of 
27October 15, 1980 (P.L.950, No.164), known as the Commonwealth 
28Attorneys Act, the Attorney General shall have the authority to 
29investigate and to institute criminal proceedings for any 
30violation of this section or any series of violations involving
 

1more than one county of this Commonwealth or another state. No 
2person charged with a violation of this section by the Attorney 
3General shall have standing to challenge the authority of the 
4Attorney General to investigate or prosecute the case, and if 
5the challenge is made, the challenge shall be dismissed and no 
6relief shall be made available in the courts of this 
7Commonwealth to the person making this challenge.

8§ 7673. Protection from liability.

9No interactive computer service provider may be held liable 
10under any provision of the laws of this Commonwealth or of one 
11of its political subdivisions for removing or disabling access 
12to content that resides on an Internet website or other online 
13location controlled or operated by the provider which the 
14provider believes in good faith is used to engage in a violation 
15of this subchapter.

16§ 7674. Civil relief.

17(a) Civil action.--An interactive computer service provider
18and a business shall each have a civil cause of action against
19any person who utilizes the interactive computer service to make
20a communication under false pretenses by or on behalf of the
21business, without the authority of the business, for the purpose
22of inducing, requesting or soliciting a person to provide
23identifying information.

24(b) Civil remedies.--A person permitted to bring a civil
25action under this section may do any of the following:

26(1) Seek injunctive relief to restrain the violator from
27continuing the violation.

28(2) Recover damages in an amount equal to the greater of
29the following:

30(i) Actual damages arising from the violation.

1(ii) Statutory damages, as determined by the court, 
2of not more than $100,000 for each violation of the same 
3nature.

4(3) Obtain both injunctive relief and damages as
5provided in this subsection.

6(c) Treble damages.--The court may increase an award of 
7actual damages in an action brought under this section to an 
8amount not to exceed three times the actual damages sustained if 
9the court finds that the violations have occurred with a 
10frequency as to constitute a course of conduct.

11(d) Attorney fees.--A person who prevails in an action filed
12under this section shall be entitled to recover reasonable
13attorneys fees and court costs.

14(e) Venue.--An action under this section may be brought:

15(1) At the residence or principal place of business of a
16person who receives a communication.

17(2) The principal place of business of the interactive
18computer service.

19(3) Such other location as provided for by the
20Pennsylvania Rules of Civil Procedure.

21Section 2. This act shall take effect in 60 days.