« All It Takes Is One Sucker | Main | PayPal Phisher Going the Distance »

April 23, 2007

I'm still going through The President's Identity Theft Task Force Strategic Plan, but there is one aspect of it that already causes me to wince.

Among the recommendations (of which there are many), this one set stands out:

• Amend the identity theft and aggravated identity theft statutes to ensure that identity thieves who misappropriate information belonging to corporations and organizations can be prosecuted


• Add new crimes to the list of predicate offenses for aggravated identity theft offenses


• Amend the statute that criminalizes the theft of electronic data by eliminating the current requirement that the information must have been stolen through interstate communications


• Penalize creators and distributors of malicious spyware and keyloggers


• Amend the cyber-extortion statute to cover additional, alternate types of cyber-extortion

As noted by a CNET article covering the release of this report, it's not like there aren't already plenty of laws on the books covering identity theft. There are. And they have even led to some convictions of identity thieves.

(I also point out that identity theft is not limited to online activity. In fact, I recall reading research that claimed the majority occurred off the Net, such as through dumpster diving and such. That may well be true, but the Internet has certainly made it easier for more thieves to attack more people in more ways.)

Friends of mine who knew me waaaay-back-when are aware that I majored in classical antiquity in college and grad school. Greek and Roman history always appealed to me, although by now I feel as though I've forgotten more than I ever knew. But one thing I learned does shine through the mists of time. One of my ancient history professors pointed out that although we don't have the benefit of detailed statistics about the efficacy of many ancient Roman laws, we can deduce that when a society issues law after law after law covering the same subject, it means that the laws aren't working, or at least aren't working sufficiently well.

If a law is poorly written, or if new technology obsoletes the intent of a law, the law should be updated accordingly. But many of the offenses that continue to plague hapless consumers have been illegal for years and years. Refining the legislative language won't make such offenses any more illegal.

As usual, the issue comes down to enforcement. Prosecutions—even when they can be brought against alleged offenders within the law's jurisdiction—are extremely costly and arduous to mount. An alleged offender had better be either a Big Fish (having bilked a large number of consumers) or a Big Dummy (making it cheap to gather evidence) to make a prosecution pay for itself. Even if a conviction can be won, will it be a deterrent to the college kid in Hong Kong or criminal gang in eastern Europe?

In a word...no.