President Bush on Thursday signed the Identity Theft Penalty Enhancement Act, which boosts the minimum amount of prison time for those convicted of using someone else's identity to commit fraud, terrorism, and other crimes.

During the signing ceremony, Bush said the law "sends a clear message that a person who violates another's financial privacy will be punished," according to a White House transcript of the event.

The law expands the federal penalty for identity theft from three to five years. In addition, the law adds five years in prison to the sentence of anybody convicted of using stolen identities to commit terrorism. It also creates a new crime: aggravated identity theft, which occurs when someone is convicted of possessing, transferring, or using another's identity during the commission of a felony. Those convicted of aggravated identity theft will have to serve a mandatory two-year prison term on top of any sentence for the original crime.

Identity-theft has proved a widespread and growing problem in recent years. Security, law-enforcement, and legal experts have maintained that the penalties for identity theft have not been stiff enough to act as a deterrent. They also say that identity thieves have operated under the assumption that there was little chance of getting caught.

"Although Congress has provided for several laws pertaining to identity theft, identity thieves can operate with the belief that, in the event that their crimes are investigated and prosecuted, the criminal penalties are not so severe as to deter their actions," Robert Ryan, senior director of government relations for credit-reporting firm TransUnion LLC, said before the House Judiciary Subcommittee on Crime, Terrorism, and Homeland Security earlier this year. "We believe more can be done to find, investigate, and prosecute identity thieves and to punish them more severely."

The cost of identity theft is high. Before signing the law, Bush said nearly 10 million Americans have had their identities swiped and the cost of fraudulent transactions has taken nearly $50 billion from the nation's businesses.

Many cases of identity theft are perpetrated by insiders, those with direct access to the financial information of a company's customers, law-enforcement experts say. The new law requires that the U.S. Sentencing Commission stiffen penalties for insiders who steal data used in identity-theft crimes.