Bill Text: NY S08138 | 2017-2018 | General Assembly | Introduced

---

Bill Title: Establishes the offenses of phishing in the third degree, phishing in the second degree and phishing in the first degree; and relates to the time in which prosecution of such offenses must be commenced.

Spectrum: Bipartisan Bill

Status: (Introduced - Dead) 2018-06-20 - COMMITTED TO RULES [S08138 Detail]

Download: New_York-2017-S08138-Introduced.html

---

                STATE OF NEW YORK
        ________________________________________________________________________
                                          8138
                    IN SENATE
                                      April 6, 2018
                                       ___________
        Introduced  by  Sen.  LANZA  -- read twice and ordered printed, and when
          printed to be committed to the Committee on Codes
        AN ACT to amend the penal law, in relation to establishing the  offenses
          of  phishing  in  the  third degree, phishing in the second degree and
          phishing in the first degree; and to amend the criminal procedure law,
          in relation to the time in which a prosecution of such  offenses  must
          be commenced
          The  People of the State of New York, represented in Senate and Assem-
        bly, do enact as follows:
     1    Section 1. Section 156.00 of the penal law is amended by adding a  new
     2  subdivision 10 to read as follows:
     3    10.  "Malware"  means computer software specifically designed to cause
     4  damage to a device or a network.
     5    § 2. The penal law is amended by adding  three  new  sections  156.41,
     6  156.42 and 156.43 to read as follows:
     7  § 156.41 Phishing in the third degree.
     8    A  person  is  guilty  of  phishing in the third degree when he or she
     9  sends an email to an individual:
    10    1. urging the individual to:
    11    a. send money to the person or to a third-party account to  which  the
    12  person has access;
    13    b.  download  an attachment which contains malware infecting the indi-
    14  vidual's computer or electronic device; or
    15    c. click on a link which redirects the individual to a website requir-
    16  ing the individual to input his or her login credentials, banking infor-
    17  mation, or personal information or which causes malware to automatically
    18  be downloaded onto the individual's computer or electronic device;
    19    2. with the intent to:
    20    a. steal such person's login credentials, passwords, money,  financial
    21  or personal information; or
    22    b. introduce a malware attack on such person's computer data.
    23    Phishing in the third degree is a class A misdemeanor.
    24  § 156.42 Phishing in the second degree.
         EXPLANATION--Matter in italics (underscored) is new; matter in brackets
                              [ ] is old law to be omitted.
                                                                   LBD14017-04-8
        S. 8138                             2
     1    A  person  is  guilty  of phishing in the second degree when he or she
     2  commits the crime of phishing in the third degree and causes an individ-
     3  ual to send money in the aggregate exceeding  five  hundred  dollars  or
     4  causes  damage  to the individual's computer or electronic device or the
     5  loss  of  data  in  an  amount  in  the aggregate exceeding five hundred
     6  dollars.
     7    Phishing in the second degree is a class E felony.
     8  § 156.43 Phishing in the first degree.
     9    A person is guilty of phishing in the first  degree  when  he  or  she
    10  commits the crime of phishing in the third degree and causes an individ-
    11  ual  to  send  money  in the aggregate exceeding two thousand dollars or
    12  causes damage to the individual's computer or electronic device  or  the
    13  loss  of  data  in  an  amount  in  the aggregate exceeding two thousand
    14  dollars.
    15    Phishing in the first degree is a class D felony.
    16    § 3. Subdivision 3 of section 30.10 of the criminal procedure  law  is
    17  amended by adding a new paragraph (h) to read as follows:
    18    (h)  A  prosecution  for  phishing  in  the first degree as defined in
    19  section 156.43, phishing in the second  degree  as  defined  in  section
    20  156.42  or  phishing in the third degree as defined in section 156.41 of
    21  the penal law may be commenced within twenty years after the  commission
    22  thereof.
    23    § 4. This act shall take effect on the first of November next succeed-
    24  ing the date upon which it shall have become a law.