Currently I'm doing a internet security-related research for education. We've planned to make a public free WiFi and make a phishing website to phish login credential. We've use Facebook as our first stage of research in which we delete the login form, replace the login button with JavaScript which will redirect user to a notification page which tells them this is a phishing site and also telling them how to prevent this vulnerability.

If we don't collect users' login info, and we also redirect them to a page which notify and tell them how to prevent phishing, is it still illegal?

| improve this question | | | | |
  • If you're not collecting users' info, then what you are doing does not sound like phishing. – Brandin Mar 6 '18 at 8:54
  • @Brandin We're doing research that how many people will actually fill in the login form, the login button (which will redirect to notice page) will act as a counter too. – Andrew.Wolphoe Mar 6 '18 at 10:19
  • So what you are doing is setting up a public WiFi and a web server that responds, to, say 'www.facebook.com' with a fake version of Facebook, with a fake login page, but then you are not collecting any info that someone puts in? – Brandin Mar 6 '18 at 10:51
  • @Brandin yep, something like that, a url like facebooook.ml with a fake login page just to take a research of how many people will enter their login credential to the fake login page. – Andrew.Wolphoe Mar 6 '18 at 11:00
  • 2
    "I don't even read the value passed by the form." - But the form is still passing the value? If you're using plain HTTP, realize that even if you don't collect this, someone else could read their username/password. – D M Mar 6 '18 at 17:26

There is / will be no "educational exception". It is not clear whether it is possible to do anything in that direction, without violating a particular state's anti-phishing law (around half the states have them). Let me first posit a hypothetical means of doing this: put up a fake Facebook login page with boxes for name and password, where users type that data in. The data remains on the users browser and is not posted back to the phisher. In Washington, RCW 19.190.080 says

It is a violation of this chapter to solicit, request, or take any action to induce a person to provide personally identifying information by means of a web page, electronic mail message, or otherwise using the internet by representing oneself, either directly or by implication, to be another person, without the authority or approval of such other person.

The law is broader than a prohibition against storing or receiving (and forgetting) PII, it includes asking. When a person types their PII into the boxes, they will have provide that information. They don't even have to type the information in, because setting up the web page constitutes inducing to provide that information. So don't do it in Washington, or Oregon (ORS § 646.A.808), or California.

The applicable Virginia law §18.2-152.5:1(A) is more general, not tailored to phishing. It says

It is unlawful for any person...to use a computer to obtain, access, or record, through the use of material artifice, trickery or deception, any identifying information, as defined in clauses (iii) through (xiii) of subsection C of § 18.2-186.3.

Under the hypothetical scenario, you will not have recorded, and probably will not have obtained or accessed. Their law does not define "access" or "obtain". If prosecuted in Virginia, you may be able to defend yourself based on a interpretation of those terms, but that is a risk, and you should absolutely hire a cyberlaw attorney knowledgeable about Virginia.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.