Many phishing and spear-phishing operators employ mail spoofing techniques to get their target to open emails, read them and act on them. When acted upon, the phisher either steals something or gets control over the target's computer.
Mail spoofing is the term sending an email where the "sender address"is a valid legitimate email address. The phisher would craft the the email in such a way to entice the target to click on a link since the author of the email is either known to them, or from a respectable organisation.
You may have received emails from people complaining that you have spammed them and that they ask you to stop. That is exactly what happens when spammers, instead of phishers use mail spoofing techniques to get people to click on their links.
I am considering sending a specially crafted mail (spoofed of course) to my friends and family who claim to not be vulnerable to phishing, and especially spear-phishing attacks for the purpose of waking them up to the reality that in the last years nobody is immune from attacks, particularly identity theft.
Now to my questions ... know that what I intend to do is quite questionable, whether for good intentions or not:
a) What is the legality of using someone else's email address as a return address? What if the address is something like firstname.lastname@example.org (just came to mind)
b) What is the legality of using logos and stationary elements in an email to make it look like it came from a particular source (something like white house graphics from their website)
c) What is the legality of pasting a signature of a celebrity inside the email and signing it as that person (say Barack Obama, whose signature is available on Wikipedia?)
d) Would there be a difference if one is not an US citizen, living outside the US, but in a country with (or without) extradition agreements?
I am not really interested about any copyright / media ownership issues, but the gravity of using someone else's name / identity /reputation to make someone believe an email is real.
Please note that this would be NOT for criminal intent, so any other content / links in the email would be 100% legit.