PLUGGING THE "PHISHING" HOLE: LEGISLATION VERSUS TECHNOLOGY

Abstract

This iBrief analyzes the Anti-Phishing Act of 2005, legislation aimed at curbing the problem of "phishing." Phishing is the sending of fraudulent emails which appear to be from legitimate businesses and thereby fooling the recipients into divulging personal information such as credit card numbers. While this legislation may provide some assistance in the fight against phishing, it is limited by the global nature of the Internet and the ease with which phishers can hide and avoid judgments. This iBrief therefore concludes that although the Anti-Phishing Act can play a supporting role in the battle, technological solutions are the most effective means of reducing or eliminating phishing attacks.

Introduction

¶          The Internet has created a marketplace for businesses and consumers to come together and interact in new and exciting ways. Unfortunately, it has also provided criminals and the unscrupulous with a new venue.² Nowhere is this more evident than in the recent emergence and growth of the phenomenon known as "phishing." The United States Department of Justice defines phishing as

criminals' creation and use of e-mails and websites--designed to look like e-mails and websites of well-known legitimate businesses, financial institutions, and government agencies--in order to deceive Internet users into disclosing their bank and financial account information or other personal data such as usernames and passwords.³

¶          Studies indicate that the number of phishing incidents is increasing at an alarming rate. A recent report by the Anti-Phishing Working Group⁴ ("APWG") found that phishing attacks have increased by an average of 30% each month since July 2004.⁵ In January 2005, alone, more than 12,800 phishing emails and 2,560 phishing web sites, representing 64 hijacked brands, were reported and tracked by the APWG.⁶ Perhaps the rapid growth of this new type of consumer fraud can be explained by the additional finding by the APWG that "data suggests that phishers are able to convince up to 5% of recipients to respond to them."⁷ By contrast, the estimated response rate for regular spam is 0.01%.⁸ Further research has estimated that the costs of these phishing attacks on consumers in 2003 ranged from $500 million to an amazing $2.4 billion.⁹

¶          Phishing is a particularly invidious attack on the Internet community because it almost always involves two separate acts of fraud. The phisher first "steals" the identity of the business it is impersonating and then acquires the personal information of the unwitting customers who fall for the impersonation. This has led commentators to refer to phishing as a "two-fold scam"¹⁰ and a "cybercrime double play."¹¹

¶          It is clear that something must be done soon to curb this alarming trend. The question, however, is what can and should be done to reduce or even eliminate phishing attacks.

¶          On February 28, 2005, Senator Patrick Leahy (D-VT) introduced the Anti-Phishing Act of 2005 ("the Act") in the United States Senate.¹² The Act is virtually identical to the Anti-Phishing Act of 2004, which Senator Leahy introduced last year but stalled in committee without coming to a vote before the congressional session ended.¹³ This iBrief provides an analysis of the Act and concludes that this bill would fill some gaps in the current law and would make prosecution and conviction of phishers easier. However, the Act suffers from the same inherent weaknesses as all legislation aimed at solving what is essentially a technological problem. Although Congress should enact this legislation, alone it is unlikely to truly stop the flow of phishing attacks. The only way to effectively eliminate the phishing problem is to focus on technological changes and have legislation play a supporting role.

I. The Anti-Phishing Act of 2005

¶          The Act, if passed, will add two crimes to the current federal law:It would criminalize the act of sending a phishing email regardless of whether any recipients of the email suffered any actual damages.¹⁴It would criminalize the act of creating a phishing website regardless of whether any visitors to the website suffered any actual damages.¹⁵Senator Leahy described the effects of the Act in this way:The [Act] protects the integrity of the Internet in two ways. First, it criminalizes the bait. It makes it illegal to knowingly send out spoofed email that links to sham websites, with the intention of committing a crime. Second, it criminalizes the sham websites that are the true scene of the crime.¹⁶The Act is also notable for what it does not contain. The bill provides no guidance or allocation of additional resources for its enforcement. This is in contrast with a recently proposed bill in the House of Representatives¹⁷ aimed primarily at "spyware."¹⁸ While the House bill adds no law related to phishing, it does provide for the appropriation of "the sum of $10,000,000 to the Attorney General for prosecutions needed to discourage the use of spyware and . . . phishing."¹⁹ Because the House bill adds no new law directed at phishing,²⁰ this iBrief does not further discuss or analyze it. It is noted here only for the purpose of pointing out a possible deficiency in the Act.

¶          There is little information indicating how the Act came into being. Senator Leahy, himself, at the time he introduced the 2004 version of the bill said only that "we have worked closely with various public interest organizations to ensure that the Anti-Phishing Act does not impinge on the important democratic role that the Internet plays."²¹ For instance, Senator Leahy has attempted to address First Amendment concerns that some groups may have had regarding certain provisions within the bill since Senator Leahy also stated when he introduced the bill, "[t]here are important First Amendment concerns to be protected. The Anti-Phishing Act protects parodies and political speech from being prosecuted as Phishing."²²Beyond the congressional record, there is some indication that the Act had the support of some influential Internet entities including the Anti-Phishing Working Group, the Center for Democracy and Technology, and eBay.²³

1. Where the Act helps

¶          The main area in which the Act will likely help in the current fight against phishing attacks is in allowing the prosecution of phishers without requiring a showing of specific damages to any individual. As explained by a member of Senator Leahy's staff:

[p]hishing scammers already violate a host of identity theft and fraud laws, but prosecuting them under those statutes can be challenging . . . . To charge scammers now, law enforcers need to prove that a victim suffered measurable losses. By the time they do that . . . the scammer has often disappeared.²⁴

¶          This reasoning is bolstered by data compiled by the APWG finding that the average life span for phishing sites, measured by how long they continue to respond with content, is 5.8 days.²⁵ Accordingly, law enforcement personnel have, on average, 5.8 days from the time the phisher first initiates the scam to track him or her down and compile sufficient evidence to bring charges.²⁶

¶          Additionally, removing the requirement to show damages permits businesses to more easily come forward as the prime complainant against a phisher that has "stolen" their web identity to scam their clients. Recall that a phishing attack involves two victims, the business and the consumer.²⁷ While the consumer's economic damages are usually fairly obvious, the reputational damages that a business incurs as the result of a phishing scam are often much more difficult to quantify.²⁸

¶          Any legislation aimed at punishing Internet-related offenses faces three formidable hurdles: (1) difficulty inherent in finding the perpetrator of an on-line crime, (2) obtaining personal jurisdiction, and (3) collecting the judgment. Unless these can be overcome, the net impact of bills such as the Anti-Phishing Act will be limited, at best.

¶          The first problem, finding the perpetrator, is illustrated by two related phishing incidents at the University of Michigan and Duke University. In the fall of 2002, the University of Michigan hosted a conference of the Palestinian Solidarity Movement ("PSM"). Shortly before the conference was to begin, an email was sent to "a large number of [the university's] faculty, staff, and students"²⁹ purporting to be sent by a member of a student organization involved with the conference and with the approval and assistance of university administration.³⁰ The email, which was not in fact authorized by anyone connected with the conference or the university,³¹ contained "many misstatements of fact"³² and "violated norms of civility and respect."³³ Despite "pursuing a vigorous investigation"³⁴ into the source of the offending email that included the services of "campus information technology security experts"³⁵ the investigators were only able to conclude was that "the message originated in California."³⁶

¶          A university administrator in charge of the investigation explained the inability to track down the sender of the unauthorized email more precisely:

It is important to recognize that when e-mail is sent from one point on the Internet to another, it can follow a complex path as it travels through multiple mail servers. In this case, the senders used an unsecured server known as an "open relay" in order to help hide their identity. Despite the best efforts of the investigating team, it is possible we may not be able to determine who really sent the messages.³⁷

¶          Two years after this event, an almost identical incident occurred at Duke University shortly before Duke hosted a PSM conference.³⁸ As of yet, investigators at Duke attempting to track down the source of the unauthorized e-mail were again only able to "determine that it originated in California."³⁹

¶          These incidents highlight one of the biggest roadblocks that any legislation in this area faces--finding the perpetrators. In order to punish phishers for their fraudulent actions, one must first locate them. Yet, the current state of Internet technology makes this extremely difficult. In a recent report to Congress by the Federal Trade Commission concerning the spam problem--the findings of which could apply equally as well to phishing--the situation was explained in this way:

The single greatest challenge for anti-spam law enforcement is to identify and locate the source of a particular spam campaign. Finding the wrongdoer is an important aspect of all law enforcement efforts, but in spam cases it is a particularly daunting task. Because the present email system lacks any mechanism requiring that a sender's identity be authenticated, spammers can and do conceal their identities with ease.⁴⁰

¶          Put another way,

[the] Internet allows anonymous communications that are virtually impossible to trace through Internet nodes. Cyber-tortfeasors frequently use false e-mail headers and anonymous remailers to make it difficult to retrace the steps of wrongdoing. Computer records are easy to alter and it is likely that spoliation of electronic evidence is widespread.⁴¹

¶          No threats of legal action can ever hope to effectively reduce the growing phishing problem until there is some way of finding the phishers.

¶          The second hurdle, obtaining jurisdiction over the phisher, stems from the fact that "[c]ybercrime has always been a cross-border enterprise."⁴² Even if the perpetrator can be located, it is very possible that the person is located in a foreign country outside of the legislation's jurisdictional reach. Indeed, "[c]ountries where cybercrime flourishes tend to have weak laws dealing with computer crime, law enforcement agencies that lack computer forensic capabilities and an underdeveloped apparatus for collaborating with law enforcement agencies in other countries."⁴³

¶          In fact, the APWG found that as of January 2005, only 32% of phishing web sites were located in the United States.⁴⁴ The three countries hosting the next largest percentage of phishing sites were China, South Korea and Japan.⁴⁵ Clearly, jurisdictional issues are a major hurdle in applying U.S.-based legislation to foreign phishing scheme perpetrators.

¶          The third problem is that even if the first two hurdles are overcome the perpetrator will very often be found to be "judgment proof."⁴⁶ This phenomenon is explained as follows:

Even when a prevailing plaintiff wins a large punitive damages award, collecting it is a different matter. Collecting a punitive damages award is difficult because a number of wily Internet mice either fail to make an appearance, file bankruptcy, or simply disappear after the plaintiff obtains a judgment. Default judgments outnumbered cases decided by juries in the larger cybertort dataset. . . . The large number of default judgments in cyberlaw reflects the reality that it is easy for web sites to disappear or assets to be transferred.⁴⁷

¶          The Federal Trade Commission's own experience in attempting to enforce judgments against Internet scammers illustrates the problem:

Indeed, the most egregious spammers, like other fraud operators, are likely to transfer assets offshore to place them beyond the reach of U.S. courts. . . . In the FTC's experience, attempting to reach the defendants' offshore funds necessitates a foreign action to enforce a U.S. court judgment. This is time-consuming, expensive, and, in many cases, futile, as many countries do not enforce U.S. court judgments obtained by government agencies.⁴⁸

¶          The House of Representatives itself has echoed these sentiments by acknowledging that "the vast majority of phishing would likely be unaffected by government regulation or civil enforcement."⁴⁹

¶          With these three formidable hurdles--finding the perpetrator, obtaining jurisdiction, and collecting the judgment--what options do we have to combat the ever increasing phishing problem?

II. Another option - Focus on Technology

¶          Phishing is a problem that exploits a weakness in the current state of technology and, in a manner of speaking, "uses it against us." It makes sense, then, that an effective solution to this problem should focus on repairing this weakness.⁵⁰ One commentator described the technological weakness in this way:

When the Internet was used mainly to communicate and access information, the lack of security didn't much matter. Now that it's used for online transactions and critical information, the absence of security is truly a big problem. It's as if consumers and businesses that rely on the Internet have wandered into a dangerous neighborhood of cheats, pickpockets and thieves, and don't even know it.⁵¹

¶          Now that consumers and businesses are becoming increasingly aware of the Internet's "dangerous neighborhood," what can be done about it? The House of Representatives has offered this useful suggestion: "[t]here is no silver bullet to end spyware or phishing but greater consumer awareness and use of available technological countermeasures clearly hold the greatest promise for curbing these abusive practices."⁵²

¶          Congress's first recommendation is to increase "consumer awareness." To be sure, "common sense and a healthy level of suspicion go a long way toward not becoming a victim of phishing."⁵³ Nevertheless, consumer awareness alone is not sufficient to solve the phishing problem. While it might be convenient to assume that only the gullible or Internet novices fall victim to phishing scams, the current state of technology and the phishers' ability to exploit it is such that even the most jaded and "web savvy" consumers can fall victim to a phishing scam.⁵⁴ Consumer awareness must be coupled with technological improvements.

¶          A number of Internet-industry groups and technology companies have come out with specific recommendations for changes and improvements in the current Internet technology that they feel would reduce or even eliminate the phishing problem. These groups include the APWG,⁵⁵ the Financial Services Technology Consortium,⁵⁶ Next Generation Security Software Ltd.,⁵⁷ Yahoo! Inc.⁵⁸ and Microsoft Corporation.⁵⁹

¶          Judging from the number of different sources that are making them, there seems to be no shortage of recommendations for how to make the Internet and email more secure. The real questions seem to be (1) which recommendations should be implemented, (2) how should they be done, and (3) when? It is the lack of a consensus on these details that has prevented us from already having the recommended upgrades.⁶⁰ Despite the current disagreement, the rising tide of phishing scams is prodding the various groups to work together to implement changes to alleviate the problem.⁶¹

¶          Leading the charge in calling for technology changes to combat phishing has been the APWG. In December 2003, the group proposed four possible technological solutions aimed at preventing phishing scams.⁶² These recommendations are:

1. Strong Website Authentication.⁶³
2. Mail Server Authentication.⁶⁴
3. Digitally Signed Email With Desktop Verification.⁶⁵
4. Digitally Signed Email With Gateway Verification.⁶⁶

¶          The first recommendation, strong website authentication, "would require all users of legitimate e-commerce and e-banking sites to strongly authenticate themselves to the site using a physical token such as a smart card."⁶⁷ In essence, this means that anyone wanting to bank or make purchases online from such websites would first need to swipe a card in a device connected to their computer before being allowed to do so. The APWG notes that this approach is feasible only "for e-commerce and e-banking applications that do not have a large number of users, and where the risk of a phisher gaining access to a user's account are high."⁶⁸

¶          The second recommendation, mail server authentication, would require all email to pass through a gateway server for source verification.⁶⁹ The APWG notes that the benefits of this approach include the ease with which it can be configured and the increased ability for legitimate business email to be identified.⁷⁰ Potential drawbacks, however, include the facts that both sender and recipient gateways are required and that it does not accommodate e-mail forwarding.⁷¹

¶          The third recommendation, digitally signed email with desktop verification, would have companies that feel they are vulnerable to phishing attacks attach a digital signature to all their outbound email. The digital signature would then be verified for authenticity by the email client used by the recipient.⁷² In evaluating the pros and cons of using digital signatures, the APWG notes that this approach would make it impossible to forge the "From:" address without detection.⁷³ However, it would still be possible for a phisher to obtain a valid digital certificate for a domain that is deceptively similar to that of a target company (e.g. the phisher could use "ebay.custservices.com," which is an entirely different domain from "ebay.com").⁷⁴ Concerning the use of the recipients' email client to verify the validity of the digital certificates, the main drawback is that not all email clients currently support the secure email standard that would be employed.⁷⁵

¶          The fourth recommendation, digitally signed email with gateway verification, is almost identical to the third recommendation; however, "[i]nstead of relying on the end user's email client to verify the signature on the email, a gateway server at the mail relay level would verify the signatures before they were even received by the receiver's email server."⁷⁶ While this approach solves the problem of some recipients' use of email clients that do not support the digital certificate standard, it does not address the problem noted above regarding a phisher's possible use of a deceptively similar domain name.⁷⁷

¶          After providing a detailed and critical discussion of each recommendation the APWG concludes their analysis with the opinion that "a combination of signed email with desktop verification, and either gateway verification or mail server IP verification would solve all aspects of the phishing problem for both consumers and business users."⁷⁸ Whether or not that prediction would eventually prove accurate, technological changes of the type recommended by the APWG are generally agreed to be a much needed step in the right direction to address the rising phishing problem.⁷⁹

Conclusion

¶          Something must be done to stop the increasing flow of phishing scams on the Internet and technological changes must be at the forefront of any action taken. While the Anti-Phishing Act of 2005 will likely provide some additional assistance in the fight against phishing scams--and should, therefore, be passed into law--its usefulness is limited due to the global nature of the Internet and the ease with which phishers can hide and avoid judgments. Technological changes such as those proposed by the APWG therefore offer the most hope of providing a comprehensive and lasting solution to the phishing epidemic.

Footnotes