3

Many phishing and spear-phishing operators employ mail spoofing techniques to get their target to open emails, read them and act on them. When acted upon, the phisher either steals something or gets control over the target's computer.

Mail spoofing is the term sending an email where the "sender address"is a valid legitimate email address. The phisher would craft the the email in such a way to entice the target to click on a link since the author of the email is either known to them, or from a respectable organisation.

You may have received emails from people complaining that you have spammed them and that they ask you to stop. That is exactly what happens when spammers, instead of phishers use mail spoofing techniques to get people to click on their links.

I am considering sending a specially crafted mail (spoofed of course) to my friends and family who claim to not be vulnerable to phishing, and especially spear-phishing attacks for the purpose of waking them up to the reality that in the last years nobody is immune from attacks, particularly identity theft.

Now to my questions ... know that what I intend to do is quite questionable, whether for good intentions or not:

a) What is the legality of using someone else's email address as a return address? What if the address is something like potus@whithouse.gov (just came to mind)

b) What is the legality of using logos and stationary elements in an email to make it look like it came from a particular source (something like white house graphics from their website)

c) What is the legality of pasting a signature of a celebrity inside the email and signing it as that person (say Barack Obama, whose signature is available on Wikipedia?)

d) Would there be a difference if one is not an US citizen, living outside the US, but in a country with (or without) extradition agreements?

I am not really interested about any copyright / media ownership issues, but the gravity of using someone else's name / identity /reputation to make someone believe an email is real.

Please note that this would be NOT for criminal intent, so any other content / links in the email would be 100% legit.

2

(d) Your citizenship doesn't matter much. If you live in a country without extradition agreements with the USA, then you likely won't get extradited by that country to the USA. If you do something extraordinarily bad then laws might not apply :-(

If you live in a country with an extradition agreement, then the rules are usually: You will be extradited if what you did was illegal in both countries, if there is enough evidence that you could be reasonably taken to court, and that the matter is serious enough that extradition alone wouldn't be a worse punishment already than the crime deserves.

(b) Most likely copyright infringement. Impersonating a government agency might be a very bad idea.

(c) Barack Obama is not a celebrity, he is the president of the USA. I could imagine that copying his signature could be a significant crime.

(a) In general, you may fall foul of any number of anti-hacking laws that make it illegal to manipulate a computer system without authorisation. So the whole action would be with criminal intent.

"Criminal intent" is an intent to do an action which (with or without your knowledge) is criminal, not the intent to do something you know or (possibly falsely) believe to be illegal.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.