infosec4all.com

For the first time, identity theft was recognized as a crime at the state level – in Arizona in 1996. (Newman, 2005) The federal penalty code was amended in 1998 to introduce the Identity Theft Assumption and Deterrence Act (U.S. Public Law, 1998). This act was again amended in 2004, and the amendments are still in force. Today, with the exception of Colorado, Vermont, and US Virgin Islands, all states and US territories have special laws dealing with identity theft. This is especially important since most identity theft prosecutions and majority of law enforcement takes place at the state level (Perl, 2003). At the same time each state’s identity theft law is unique (Perl, 2003) which makes things a little bit more difficult.

Legal definition
Acting as an umbrella, the federal law set standards for all other states. This law, with subsequent amendments defines the identity theft in the following way:

[One is guilty of identity theft if...] knowingly and without lawful authority produces an identification document, authentication feature, or a false identification document (hereafter identification document); [...] transfers an identification document,[...] knowing that such document [...] was stolen or produced without lawful authority;[...] possesses with intent to use unlawfully or transfer unlawfully five or more identification documents[...] possesses an identification document, [...] with the intent such document [...] be used to defraud the United States;[...] produces, transfers, or possesses a document-making implement [...] with the intent such document-making [...] will be used in the production of a false identification document or another document-making implement [...] which will be so used; [...] possesses an identification .. that is or appears to be an identification document [...] of the United States which is stolen or produced without lawful authority knowing that such document [...] was stolen or produced without such authority;[...] transfers, possesses, or uses, without lawful authority, a means of identification of another person with the intent to commit, or to aid or abet, or in connection with, any unlawful activity that constitutes a violation of Federal law, or that constitutes a felony under any applicable State or local law; or [...] traffics in false authentication features for use in false identification documents, document-making implements, or means of identification[...]

Most definitions of identity theft, both legal and academic, can be summarized as unauthorized use of someone else’s identities. Newman at al define identity as a psychological construct used by individuals to refer to themselves as ‘a person’ and used by others to identify themselves as unique or particular individuals. (Newman, 2005) Other scholars reject the notion of identity as being no longer rationed to one per physiological specimen and adopt the term human identification as association of data with a particular human being. (Clarke, 1994) The science of information security, for purposes of dealing with authentication, or confirmation of someone’s identity defines identity as a combination of three factors – something we are, something we know, and something we have. The legal language cleverly avoids this problem by using the term identification or means of identification which, in the federal law, is defined as:

[...] any name or number that may be used, alone or in conjunction with any other information, to identify a specific individual, including any [...] name, social security number, date of birth, official State or government issued driver’s license or identification number, alien registration number, government passport number, employer or taxpayer identification number; [...] unique biometric data, such as fingerprint, voice print, retina or iris image, or other unique physical representation; [...]unique electronic identification number, address, or routing code; or [...] telecommunications identifying information or access device [...]

At the federal level, a separate law (Title 18, Chapter 1029 Fraud and Related Activity in Connection with Access Devices) addresses credit card fraud. The two federal laws clearly separate identity theft from credit card (access device) fraud. This clearly supports my argument that credit card fraud is not identity theft, or to be more specific, some credit card frauds can be associated with identity theft but some (if not most of them) can not not. Although it might sound as a nuance, it is credit card fraud that most seriously distorts the course of action for prevention and fight against identity theft.

The federal act defines an ‘access device’ as:

[...] any card, plate, code, account number, electronic serial number, mobile identification number, personal identification number, or other telecommunications service, equipment, or instrument identifier, or other means of account access that can be used, alone or in conjunction with another access device, to obtain money, goods, services, or any other thing of value, or that can be used to initiate a transfer of funds (other than a transfer originated solely by paper instrument); [...]

And makes it a crime to:

[...] knowingly and with intent to defraud produce, use, [...] traffic in, [...]poses[...] counterfeit access devices; knowingly and with intent to defraud effect transactions; [...] with [...]access devices issued to another person [...]receive payment [...]

State laws define identity theft in very similar way, except for two differences – the penalty for the crime, and treatment of credit card fraud. With the exception of three states that still do not have identity theft laws all other states have amended their criminal codes to recognize identity theft. Twenty four of them use the term identity theft to describe the crime, seven states call it identity fraud, while others use a range of less specific terms such as criminal impersonation, taking identity of another person, false personation, identity deception, misuse of identification, unauthorized or fraudulent use of personal identifying information, and identity crime. Only the state of Nebraska clearly differentiates between identity theft and credit card fraud while others did not follow the federal example and separated the two. Most states completely failed (or did it intentionally) to address the difference between two crimes, leaving it up to the judges to decide on treatment of the crime. Bibliography section lists state laws that address identity theft and/or credit card fraud.

Two important flaws are worth mentioning here as most of the states used federal identity theft law as a template: failure to clearly define identity at federal level, and failure to introduce separate credit card fraud laws at state levels lead to a situation where credit card frauds are confused with real identity theft cases.

This review would not be complete without mentioning the third federal law that directly addresses the issues related to identity theft is U.S. Public Law, Title 42, Chapter 408 – Fraud in Connection with the Misuse of Social Security Numbers. As the name suggests, the law focuses on the issues related to misuse of social security numbers and its terms are not relevant for this definition of the crime, but the number itself and its use is. 

Related legislation
In addition to the three laws above that directly deal with and define identity theft, there are a number of federal laws that significantly affect the combat against identity theft, and are relevant for further actions to fight this crime. In fact, according to the Identity Theft Literature Review (Newman, 2005) there are 180 federal statutes that prescribe the same conduct under the Identity Theft Act. According to Newman (Newman, 2005) the three most important ones laws are:

The Fair Credit Reporting Act (FCRA)
Originally passed in 1970 and last amended in 2003. One of the most significant provisions of this law related to identity theft prevents states from passing more stringent financial privacy rules than federal government.

The Fair and Accurate Credit Transactions Act
Passed in 2003 with sections specifically designed to combat identity theft, it protects consumers’ credits and calls for enhancements in identity authentication.

Gramm-Leach-Bliley Act (GLBA)
Enacted in 1999 it instructs financial institutions to have policies, procedures, and controls to prevent unauthorized disclosure of financial information, and allows consumers to opt-out from having financial institutions disclose their private financial information.

Bibliography

Clarke, Roger, Human Identification in Information Systems: Management Challenges and Public Policy Issues, Information Technology and People, December 1994

Newman, Graeme R. and Megan M. McNally, Identity Theft Literature Review, National Institute of Justice Focus Group Meeting, July 2005

Perl, Michael W., It’s not always about the money: Why the state identity theft laws fail to adequately address criminal record identity theft, Journal of Criminal Law and Criminology, 94(1): 169-2008, 2003

U.S. Public Law, Identity Theft Assumption and Deterrence Act of 1998, Title 18, U.S. Code, Section 1029. 1998 ed.

U.S. Public Law, Fraud and Related Activity in Relation with Access Devices Act, Title 18, U.S. Code, Section 1029. 2005 ed.

U.S. Public Law, Social Security Number Privacy and Identity Theft Prevention Act of 2003, Title 42, U.S. Code, Section 405. 2003 ed.
Additional Sources
Federal laws

U.S. Public Law, The Fair and Accurate Credit Transaction Act of 2003 (FACTA), Title 15, U.S. Code, Section 1681. 2003 ed.

U.S. Public Law, The Fair Credit Reporting Act (FCRA), Title 15 U.S. Code, Section 1681. 2001 ed.

U.S. Public Law, Gramm Leach Bliley Act, Title 12 U.S. Code, Section 1811. 1999 ed.
State laws

The Code of Alabama 1975, Section 13A-8-192- Identity theft

Alaska Statute Title 11. Criminal Law, Chapter 46. Offenses Against Property Section 565. Criminal Impersonation in the First Degree.

Arizona Revised Statutes, Title 13 Criminal Code, Chapter 20 Forgery and related offenses, 13-2008. Taking identity of another person or entity; classification

Arkansas Code, Title 5 Criminal Offences, Subtitle 4 Offences Against Property, Subchapter 2 Offences Generally, 5-37-227 Financial Identity Fraud

California Penal Code, Title 13 Of Crimes Against Property, Chapter 8 False Personation and Cheats

General Statutes of Connecticut, Volume 13, Title 53a Penal Code, Chapter 952 Offences, Section 53a-129a Identity Theft

Delaware Criminal Code, Title 11 Crimes And Criminal Procedure, Chapter 5. Specific Offenses, Subchapter III.. Offenses Involving Property, Subpart A. Arson And Related Offenses, § 854. Identity theft

District Of Columbia Official Code, Title 22. Criminal Offenses And Penalties, Chapter 32. Theft; Fraud; Stolen Property; Forgery; And Extortion, Subchapter III-C. Identity Theft, 22-3227

The Florida 2006 Statutes, Title XLVI Crimes, Chapter 817 Fraudulent Practices, Part I: False Pretenses and Frauds, Subsection 817.568 Criminal use of personal identification information

Georgia Code, Title 16 Criminal Code of Georgia, Chapter 16-9, Sections 16-9-120 – 16-9-128

Hawaii Revised Statutes, Volume 14, Chapter 708

Idaho Statutes, Title 18 Crimes And Punishments, Chapter 31 False Pretenses, Cheats And Misrepresentations, 18-3126. Misappropriation Of Personal Identifying Information.

Illinois Compiled Statutes, Chapter 720 Criminal Offenses, 720 Ilcs 5/ Criminal Code of 1961. Article 16G – Financial Identity Theft and Asset Forfeiture Law

Indiana Code, Title 35 Criminal Law and Procedure, Article 44 Offences Against Property, Chapter 4. Theft, Conversion, and Receiving Stolen Property

Iowa Code, Title XVI Criminal Law and Procedure, Subtitle 1 Crime Control and Criminal Acts, Chapter 715A Forgery and Related Fraudulent Criminal Acts, 715A.8 Identity Theft

Kansas Statutes, Chapter 21 Crimes And Punishments, Part Ii.–Prohibited Conduct, Article 40 Crimes Involving Violations Of Personal Rights, 21-4018 Identity theft; identity fraud

Kentucky Revised Statutes, Title L – Kentucky Penal Code, Chapter 514 Theft and Related Offenses, 160 Theft of Identity.
Maine Revised Statutes, Title 17a Maine Criminal Code, Part 2: Substantive Offenses, Chapter 37: Fraud, §905-A. Misuse Of Identification

Maryland Code, Criminal Laws, Title 8 Fraud and Related Crimes, Subtitle 3 Identity Fraud

The General Laws Of Massachusetts, Part Iv. Crimes, Punishments And Proceedings In Criminal Cases, Title I. Crimes And Punishments, Chapter 266. Crimes Against Property, Chapter 266: Section 37e. Use Of Personal Identification Of Another; Identity Fraud; Penalty; Restitution

Michigan Compiled Laws, Chapter 445 Trade and Commerce, Act 452 of 2004 Identity Theft Protection Act

Minnesota Statutes, Chapter 609 Criminal Code, Theft and Related Crimes, 609.527 Identity Theft

Mississippi Code, Title 97 Crimes, Chapter 19 False Pretenses and Cheats, SEC. 97-19-85. Fraudulent use of identity, social security number or other identifying information to obtain thing of value.

Missouri Revised Statutes, Title XXXVIII Crimes and Punishment; Peace Officers and Public Defenders, Chapter 570 Stealing and Related Offenses, 570.223. Identity Theft–Penalty–Restitution–Other Civil Remedies Available–Exempted Activities

Montana Code, Title 45 Crimes, Chapter 6 Offences Against Property, Part 3 Theft and Related Offences, 45-6-332 Theft of identity.

Nebraska Revised Statutes, Chapter 28 Crimes and Punishments, 28-608 Criminal Impersonation; Penalty; Restitution and 28-620 Unauthorized use of a financial transaction device; penalties; prosecution of offense.

Nevada Revised Statutes, Title 15 Crimes and Punishments, Chapter 205 Crimes Against Property, NRS 205.463 Obtaining and using personal identifying information of another person to harm person or for unlawful purpose and NRS 205.464 Obtaining, using, possessing or selling personal identifying information for unlawful purpose by public officer or public employee; penalties. And NRS 205.465 Possession or sale of document or personal identifying information to establish false status or identity; penalties.

New Hampshire Statutes, Title LXII Criminal Code, Chapter 638 Fraud, Section 638:26 Identity Fraud

New Jersey Permanent Statues, Title 2C The New Jersey Code of Criminal Justice, 2C:21-17 Impersonation; theft of identity; crime.

New Mexico Statutes and Court Rules, Chapter 30 Criminal Offences, Article 16 Larceny, 30-16-24.1. Theft of identity; obtaining identity by electronic fraud.

New York Laws, Penal, Title K Offences Involving Fraud, Article 190 Other Frauds, 190.77 Offenses involving theft of identity; definitions, and 190.78 Identity theft in the third degree, and 190.79 Identity theft in the second degree, and 190.80 Identity theft in the first degree.

North Carolina General Statutes, Chapter 14 Criminal Law, Article 19C Identity Fraud
14?113.20. Identity theft.

North Dakota Century Code, 12.1 Criminal Code, 12.1-23 Theft and Related Offences, 12.1-23-11. Unauthorized use of personal identifying information – Penalty.

Ohio Revised Code, Title XIX Crimes – Procedure, Chapter 2913 Theft and Fraud, 2913 Identity Fraud

Oklahoma Statutes, Title 21 Crimes and Punishments, 21-1533.1 Identity theft – Penalties – Civil action.

Oregon Revised Statutes, Volume 4, Chapter 165 Offenses Involving Fraud or Deception
165.800 Identity theft.

Pennsylvania Statutes, Title 18 Crimes and Offences, Chapter 41 Forgery and Fraudulent Practices, 4120. Identity theft.

State of Rhode Island General Laws, Title 11 Criminal Offences, Chapter 49.1 Impersonation and Identity Fraud

South Carolina Code Of Laws, Title 16 – Crimes and Offenses, Chapter 13 Forgery, Larceny, Embezzlement, False Pretenses and Cheats, Article 2 Personal Financial Security Act Section 16-13-510 “Financial identity fraud” and “identifying information” defined; penalty and restitution.

South Dakota Codified Laws, Title 22 Crimes, Chapter 40 Identity Crimes

Tennessee Code, Title 39 Criminal Offences, Chapter 14 Offences Against Property, Part 1 Theft, 39-14-150. Identity theft victims’ rights.

Texas Statutes, Penal Code, Chapter 32 Fraud, 32.51. Fraudulent Use or Possession of Identifying Information.

Utah Code, Title 76 Utah Criminal Code, 76-6-1101 Identity Fraud Act

Code of Virginia, Title 18.2 Crimes and Offences Generally, Chapter 6 Crimes Involving Fraud, 18.2-186.3. Identity theft; penalty; restitution; victim assistance.

Revised Code of Washington, Title 9 Crimes and Punishments, Chapter 9.35 Identity Crimes

West Virginia Code, Chapter 61 Crimes and Their Punishment, 61-3-54. Taking identity of another person; penalty.

Wisconsin Statutes, Chapter 943 Crimes Against Property, 943.201Unauthorized use of an individual’s personal identifying information or documents.

Wyoming Statutes, Title 6 Crimes and Offences, Chapter 3 Offences Against Property, Article 9 Theft of Identity, 6-3-901. Unauthorized use of personal identifying information; penalties; restitution.