S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   1511
 
                        2021-2022 Regular Sessions
 
                           I N  A S S E M B L Y
 
                             January 11, 2021
                                ___________
 
 Introduced  by  M.  of A. PERRY, COOK, TAYLOR, PICHARDO, VANEL, HYNDMAN,
   J. RIVERA -- read once and referred to the Committee on Codes
 
 AN ACT to amend the penal law, in relation to establishing the  offenses
   of  phishing  in  the  third degree, phishing in the second degree and
   phishing in the first degree; and to amend the criminal procedure law,
   in relation to the time in which a prosecution of such  offenses  must
   be commenced
 
   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. Section 156.00 of the penal law is amended by adding a  new
 subdivision 10 to read as follows:
   10.  "MALWARE"  MEANS COMPUTER SOFTWARE SPECIFICALLY DESIGNED TO CAUSE
 DAMAGE TO A DEVICE OR A NETWORK.
   § 2. The penal law is amended by adding  three  new  sections  156.41,
 156.42 and 156.43 to read as follows:
 § 156.41 PHISHING IN THE THIRD DEGREE.
   A  PERSON  IS  GUILTY  OF  PHISHING IN THE THIRD DEGREE WHEN HE OR SHE
 SENDS AN EMAIL TO AN INDIVIDUAL:
   1. URGING THE INDIVIDUAL TO:
   A. SEND MONEY TO THE PERSON OR TO A THIRD-PARTY ACCOUNT TO  WHICH  THE
 PERSON HAS ACCESS;
   B.  DOWNLOAD  AN ATTACHMENT WHICH CONTAINS MALWARE INFECTING THE INDI-
 VIDUAL'S COMPUTER OR ELECTRONIC DEVICE; OR
   C. CLICK ON A LINK WHICH REDIRECTS THE INDIVIDUAL TO A WEBSITE REQUIR-
 ING THE INDIVIDUAL TO INPUT HIS OR HER LOGIN CREDENTIALS, BANKING INFOR-
 MATION, OR PERSONAL INFORMATION OR WHICH CAUSES MALWARE TO AUTOMATICALLY
 BE DOWNLOADED ONTO THE INDIVIDUAL'S COMPUTER OR ELECTRONIC DEVICE;
   2. WITH THE INTENT TO:
   A. STEAL SUCH PERSON'S LOGIN CREDENTIALS, PASSWORDS, MONEY,  FINANCIAL
 OR PERSONAL INFORMATION; OR
   B. INTRODUCE A MALWARE ATTACK ON SUCH PERSON'S COMPUTER DATA.

  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
              

                                                            LBD05473-01-1

 A. 1511                             2
 
   PHISHING IN THE THIRD DEGREE IS A CLASS A MISDEMEANOR.
 § 156.42 PHISHING IN THE SECOND DEGREE.
   A  PERSON  IS  GUILTY  OF PHISHING IN THE SECOND DEGREE WHEN HE OR SHE
 COMMITS THE CRIME OF PHISHING IN THE THIRD DEGREE AND CAUSES AN INDIVID-
 UAL TO SEND MONEY IN THE AGGREGATE EXCEEDING  FIVE  HUNDRED  DOLLARS  OR
 CAUSES  DAMAGE  TO THE INDIVIDUAL'S COMPUTER OR ELECTRONIC DEVICE OR THE
 LOSS OF DATA IN AN  AMOUNT  IN  THE  AGGREGATE  EXCEEDING  FIVE  HUNDRED
 DOLLARS.
   PHISHING IN THE SECOND DEGREE IS A CLASS E FELONY.
 § 156.43 PHISHING IN THE FIRST DEGREE.
   A  PERSON  IS  GUILTY  OF  PHISHING IN THE FIRST DEGREE WHEN HE OR SHE
 COMMITS THE CRIME OF PHISHING IN THE THIRD DEGREE AND CAUSES AN INDIVID-
 UAL TO SEND MONEY IN THE AGGREGATE EXCEEDING  TWO  THOUSAND  DOLLARS  OR
 CAUSES  DAMAGE  TO THE INDIVIDUAL'S COMPUTER OR ELECTRONIC DEVICE OR THE
 LOSS OF DATA IN AN  AMOUNT  IN  THE  AGGREGATE  EXCEEDING  TWO  THOUSAND
 DOLLARS.
   PHISHING IN THE FIRST DEGREE IS A CLASS D FELONY.
   §  3.  Subdivision 3 of section 30.10 of the criminal procedure law is
 amended by adding a new paragraph (h) to read as follows:
   (H) A PROSECUTION FOR PHISHING IN  THE  FIRST  DEGREE  AS  DEFINED  IN
 SECTION  156.43,  PHISHING  IN  THE  SECOND DEGREE AS DEFINED IN SECTION
 156.42 OR PHISHING IN THE THIRD DEGREE AS DEFINED IN SECTION  156.41  OF
 THE  PENAL LAW MAY BE COMMENCED WITHIN TWENTY YEARS AFTER THE COMMISSION
 THEREOF.
   § 4. This act shall take effect on the first of November next succeed-
 ing the date upon which it shall have become a law.