Is it legal to launch a phishing attack for educational purposes?
<p>Currently I'm doing a internet security-related research for education. We've planned to make a public free WiFi and make a phishing website to phish login credential. We've use Facebook as our first stage of research in which we delete the login form, replace the login button with JavaScript which will redirect user to a notification page which tells them this is a phishing site and also telling them how to prevent this vulnerability.</p>

<p>If we <strong>don't collect</strong> users' login info, and we also redirect them to a page which notify and tell them how to prevent phishing, is it still illegal?</p>

<p>There is / will be no "educational exception". It is not clear whether it is possible to do anything in that direction, without violating a particular state's anti-phishing law (around half the states have them). Let me first posit a hypothetical means of doing this: put up a fake Facebook login page with boxes for name and password, where users type that data in. The data remains on the users browser and is not posted back to the phisher. In Washington, <a href="http://apps.leg.wa.gov/RCW/default.aspx?cite=19.190.080" rel="nofollow noreferrer">RCW 19.190.080</a> says</p>

<blockquote>
  <p>It is a violation of this chapter to solicit, request, or take any
  action to induce a person to provide personally identifying
  information by means of a web page, electronic mail message, or
  otherwise using the internet by representing oneself, either directly
  or by implication, to be another person, without the authority or
  approval of such other person.</p>
</blockquote>

<p>The law is broader than a prohibition against storing or receiving (and forgetting) PII, it includes asking. When a person types their PII into the boxes, they will have provide that information. They don't even have to type the information in, because setting up the web page constitutes inducing to provide that information. So don't do it in Washington, or Oregon (ORS § 646.A.808), or <a href="http://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=BPC&amp;division=8.&amp;title=&amp;part=&amp;chapter=33.&amp;article=" rel="nofollow noreferrer">California</a>.</p>

<p>The applicable Virginia law <a href="https://law.lis.virginia.gov/vacode/title18.2/chapter5/section18.2-152.5:1/" rel="nofollow noreferrer">§18.2-152.5:1(A)</a> is more general, not tailored to phishing. It says</p>

<blockquote>
  <p>It is unlawful for any person...to use a computer to obtain, access,
  or record, through the use of material artifice, trickery or
  deception, any identifying information, as defined in clauses (iii)
  through (xiii) of subsection C of § 18.2-186.3.</p>
</blockquote>

<p>Under the hypothetical scenario, you will not have recorded, and probably will not have obtained or accessed. Their law does not define "access" or "obtain". If prosecuted in Virginia, you may be able to defend yourself based on a interpretation of those terms, but that is a risk, and you should absolutely hire a cyberlaw attorney knowledgeable about Virginia.</p>

internet privacy education