OLR Research Report

August 9, 2005




By: Sandra Norman-Eady, Chief Attorney

You asked for information on identity theft, including actions New York Attorney General Eliot Spitzer has taken to combat it and how spyware, adware, and malware are used to steal identities.

Identity theft is a type of fraud that occurs when one person uses another person's personal identifying information illegally and without permission. All 50 states and the federal government have laws addressing identity theft. However, despite these efforts identity theft appears on the rise with a few state exceptions. The latest Federal Trade Commission (FTC) statistics show that 645,000 consumers filed complaints reporting losses of over $565 million in 2004, up from over 500,000 complaints and $425 million in reported losses in 2003. These same statistics show that Connecticut ranked 27th among the 50 states in the number of identity theft victims per 100,000 people, down from 23rd in 2003.

Generally, states have taken various but similar approaches to identity theft; with no one state appearing as a leader. However, to crack down on New York's rising identity thefts, Attorney General Eliot Spitzer produced an identity theft prevention pamphlet for New York residents and introduced identity theft legislation. The pamphlet, which was released in April 2005, provides self-help tips for privacy protection and includes an overview of federal and New York privacy and identity theft laws and contact information. The pamphlet is available at

Attorney General Spitzer's 2005 legislative package included proposals to (1) create tougher penalties for identity theft crimes, (2) allow courts to order restitution to identity theft victims, (3) give consumers better control over their personal information by requiring companies to give them notice before sharing their personal information with a third party, (4) enhance the state's ability to prosecute crimes that lead to identity theft, and (5) allow consumers to place a security freeze on their consumer information. None of these proposals became law. For more information on SB 3494 and AB 6651 and 7013, visit

Spyware, malware, and adware are types of software that people use to illegally obtain personal identifying information, profile computer users, or damage equipment. “Spyware” is a type of snoopware that allows a person monitor another person's actual computer activity, including the online user's username, password, shopping purchases, and e-mail correspondences. “Malware” is short for malicious software and usually takes the form of a virus designed to damage or disrupt a computer system. “Adware” installs a reminder service or spawns targeted ads as a person surfs the Internet. These ads or “pop-ups” might profile a person's surfing or shopping habits and most gather information in the aggregate.