Anti-Phishing Legislation: Catch Me If You Can?
In February 2005, Joe Lopez, a Miami businessman sued his bank after a phishing attack wire transferred US$90,348 from his online banking account to a bank in Riga (Latvia). After carrying out an investigation, his bank claimed that its e-banking systems had not been breached and refused to compensate Lopez. A forensic examination of Lopez’s PC revealed his antivirus protection was outdated, and this was the probable reason for his credentials being stolen to transfer the money1.
While this case is yet to be decided it has brought into focus some of the key issues regarding phishing: who is liable for phishing related losses? Is it the bank or is it the individual? Are there any limits to each one’s liability?
Almost simultaneously, a legislation called the Anti-Phishing Act 2005 was introduced in the US Senate. This Act, inter-alia, criminalizes the act of sending a phishing mail or setting up a phishing website. It provides victims and authorities with an additional charge under which they can prosecute phishers. However, the questions remain: is this law going to bring phishers to justice? Is it going to deter criminals from phishing?
The FSTC2 defines phishing as ‘a broadly launched social engineering attack in which an electronic identity is misrepresented in an attempt to trick individuals into revealing personal credentials that can be used fraudulently against them’.
The modus operandi of a basic phishing attack is simple. A phisher sends a phishing mail to a large number of people to lure recipients to fake websites of trusted institutions. The fake website resembles the genuine website of the institution, and fools recipients into revealing authentication credentials such as credit card numbers, social security numbers, user names, passwords, etc. Alternatively, phishers introduce codes into the genuine websites of these institutions and lure customers into giving these credentials. Subsequently, the phisher uses these credentials to do fraudulent transactions in the name of the customer.
Phishing techniques have now become sophisticated to the point where a phishing mail is not a prerequisite. Thus, phishing is ‘a problem of authentication – customers can’t reliably tell if they’re hearing from their financial institution or an imposter; institutions can’t tell if they’re hearing from their customer or from a phisher who has purloined a customer’s credentials’.3
Phishing is a unique mix of criminal activity and social engineering attacks – its uniqueness further stems from the fact that there are two victims: the first is the individual or customer whose identity/authentication credentials have been stolen and secondly the financial institution, ISP or retailer who ends up picking up the bill. Hence, the key issues to be addressed by legislation are:
The following section examines the effectiveness of legislation in addressing these issues:
1. Stop the criminal act as early as possible – There are multitudes of existing anti-fraud legislations under which phishers can be charged, e.g. in the US, wire fraud, access device fraud, etc. However to apply any of these legislations, fraud as defined in the conventional sense, must be committed i.e. the victim should suffer a financial loss. The issue with phishing is that, as mentioned before, there are two acts of stealing: firstly the identity/authentication credentials are stolen and then there is a financial loss. Thus, a conventional definition of fraud is inadequate. Authorities have recognized this. For instance, the US enacted the Identity Theft Penalty Enhancement Act (ITPEA) in 2004, which makes the use of a stolen identity to commit a crime a crime in itself.
An Anti-Phishing Act is being contemplated which will criminalize the activity of sending a phishing mail or setting up the phishing website even if no one is defrauded into giving their credentials. Thus legislation is moving in the direction of trying to stop the criminal act as early as possible. A note of caution here – the new legislation seems to be narrowly defined – for example, sending a phishing mail as envisaged in the Act has become passé. Today’s sophisticated criminals are more likely to use pharming as their strategy of choice.
2. Bringing the criminals to justice – Statistics show that while a large majority of the victims of phishing are in the US, a large majority of the perpetrators are outside4, often (intentionally) in countries with poor records of acting against cyber crime. Consequently, no legislation enacted by the US alone, despite the preponderance of victims, will enable it to bring these criminals to justice. The solution for this is greater international co-operation. In practice, though, it is difficult to convince authorities in a jurisdiction to act if the victims are not within their jurisdiction.
Even when authorities are willing to act, it is difficult to track down a phisher since the crimes are committed through public networks, cybercafés, or through mules. While we do hear about spectacular phishing schemes that have been stopped, we almost never hear that the phishers have been caught. Tracking down phishers is a technological challenge rather than a regulatory challenge.
3. Acting as a deterrent to others – Since phishers are rarely caught, Anti-Phishing laws are not seen as significant deterrents. If the US were to enact an Anti-Phishing Act, all that an overly cautious phisher has to do is to move his operations to a more phisher-friendly jurisdiction.
The challenge is to restore both the stolen identity and the stolen money. One of the first consequences of an identity theft – online or otherwise – is the damage to one’s credibility, for example, credit scores. Amendments have been made to enable people to record the instance of phishing or identity theft in their credit reports. However, even with legislation to that effect, a potential creditor would take a phishing damaged credit report with a pinch of salt.
Restitution of financial losses is also equally difficult: very often it is not possible to trace the stolen money. Even if it is traced, if it is found in a jurisdiction where prosecution cannot be obtained, restitution is tricky. Hence, in the absence of a global law, to reflect the global nature of the crime, this cannot be achieved effectively.
Lopez’s bank, in the case above, refused to make good his losses on the plea that its systems had not been accessed in an irregular manner. So what is the correct regulatory position?
To answer this, one needs to go back a little bit to the Gramm-Leach-Bliley (GLB) or the Financial Services Modernization Act 1999. Under this Act, inter-alia the OCC, the Fed, the FDIC and the OTS were directed to ‘establish standards for financial institutions relating to administrative, technical and physical safeguards to (1) insure the security and confidentiality of customer records and information; (2) protect against any anticipated threats or hazards to the security or integrity of such records; and (3) protect against unauthorized access to or use of such records or information that could result in substantial harm or inconvenience to any customer.’5 The standards under this Act ‘Response Programs for Unauthorized Access to Customer Information and Customer Notice’ were released jointly by these institutions in March 2005 after considerable debate – interestingly enough, approximately a month after Lopez filed his suit.
These guidelines require every financial institution to develop a security program to protect customer information i.e. any record containing non-public personal information about a customer, whether in paper, electronic or other form, maintained by or on behalf of the institution.6 Furthermore, institutions are directed to develop response programs that specify actions to be taken when the financial institutions suspects or detects that unauthorized individuals have gained access to customer information systems.
Hence, there is an onus on financial institutions to develop a security program and a response program for unauthorized access to customer information. The 90,348 dollar question is – does this cover phishing? The answer, much to the relief of institutions, is no – the guideline itself in an explanatory section clarifies that it ‘…applies only to information that is within the control of the institution and its service providers, and would not apply to information directly disclosed by a customer to a third party, for example, through a fraudulent website’. 7
The regulatory requirement on a financial institution is to protect customer information from being accessed in an unauthorized manner from its own information system – but there is no regulatory requirement to protect a customer for losses suffered through phishing.
However, up till now financial institutions or other institutions, who have been victims of phishing, have chosen to bear the losses relating to phishing regardless of where the blame lies. Their concern has been the damaging consequences of the adverse publicity that always sides with the ‘little guy’ who is the victim. Whether this practice will continue in future remains to be seen.
Anti-phishing legislation so far has achieved very little in terms of stopping the crime, restoring stolen property or even in defining how phishing losses should be apportioned between financial institutions and customers. The reason for this is that phishing is a crime that leverages technology heavily. Hence, a solution cannot be achieved merely by legislating – especially against criminals who do not play by conventional rules. The solution that has a reasonable chance of curbing phishing is one that addresses the problem head on, i.e. the use of technological countermeasures. As far as phishers are concerned – it is still a game of ‘catch me if you can’.
1 “Florida man sues bank over $90K wire fraud” (February 2005) Source: The Register
2 “Understanding and Countering the Phishing Threat” (January 2005). A Whitepaper by the Financial Services Technology Consortium (FSTC).
3 FSTC: Ibid, Page 4
4 “Phishing Activity Trends Report” (April 2005). Anti-Phishing Working Group, April 2005. 73.7 per cent of phishing websites are hosted outside the US. More than half of the phishing websites are hosted outside OECD countries.
5 Interagency Guidance on Response Programs for Unauthorised Access to Customer Information and Customer Notice (March 2005). Page 2.
6 Interagency Guideline. Ibid. Page 32
7 Interagency Guideline. Ibid. Page 5