Legislature introduced in Utah means it could soon be illegal there to pretend to be someone else when engaging in certain types of deceptive activities on the internet, a practice known as “catfishing.”
The Online Impersonation Prohibition up for debate this week in the Utah House of Representatives, “makes it a criminal offense, under certain circumstances, to impersonate an individual online with the intent to harm, defraud, intimidate, or threaten any individual,” according to the current draft of the legislation.
The legislation, officially known as House Bill (HB) 239 and sponsored by Utah Rep. Karianne Lisonbee, is part of a larger submission, HB 80, which seeks to amend privacy laws to create an “affirmative defense” for companies in lawsuits over data breaches, according to a report posted online by Fox 13 in Salt Lake City.
Actions that would become a third-degree felony under the scope of the HB 239 include sending an e-mail, text or instant message to someone under the identity of someone else without their consent or in a way that makes the recipient believe the person with whom they are communicating authorized or sent the communication.
Moreover, if such a law is passed in Utah, it could be something other states in the future also may adopt as a way to curtail the use of catfishing by cybercriminals.
The practice of catfishing often occurs in online dating or social-networking scenarios in which someone takes someone else’s personally identifiable information–such as photos, addresses, educational history or professions–to pretend to be that person to seem more attractive or interesting to people they meet online. It also serves to hide someone’s own identity in some way.
Threat actors have adopted catfishing over the years to ensnare and defraud victims in various cybercriminal activities. Last year, the Palestinian group Hamas used the tactic for the third time by posing as teen girls looking for quality chat time on Facebook, Instagram and Telegram to tempt Israeli soldiers into installing spyware on their phones.
In 2018, a catfishing scam bilked 42 service members from the Army, Navy, Air Force and Marine Corps out of more than $560,000 when prison inmates in South Carolina posed as attractive women online and lured the men into online romances.
The year before that, an APT with ties to the Iranian government also used a similar lure by creating an online identity called Mia Ash, who appeared to be a 20-something London-based photographer and amateur model with an interest in tech-savvy guys with ties to the oil and gas industry. The threat group used the persona to target telecommunications, government, defense, oil and financial services firms located in the Middle East and North Africa.
These are the type of scams that HB 239 aims to identify and make criminal, according to Lisonbee, who told FOX 13 that the bill targets those who actively take on someone else’s identity to defraud or harass someone rather than prosecute people merely for creating anonymous online accounts.
“It can have really serious and harmful consequences in people’s lives,” Lisonbee told FOX 13. “A lot of times people tend to hide behind the guise of social media and online anonymity and don’t really put the consequences of their actions together.”
