Spam
Spam Basics
 E-mail version of mass distribution of direct marketing




solicitations, formally known as “unsolicited commercial
e-mail” (UCE)
Cost –effective for the sender because of low marginal
costs (low costs to add one more recipient to list)
Spammers free-ride on ISP networks which increase
their costs to accommodate the growing volume of spam
There exists a conflict between antispam laws (focusing
on fraud, trespass, hacking, infringement) and the
Constitution (First Amendment freedom of speech,
press)
Commerce clause may prohibit state antispam laws if
they unduly burden on interstate commerce
Where does junk mail (spam)
come from?
 From software called Spam ware.
Spam ware is software that
automatically searches the Web to
collect what it recognizes as email
addresses.
Federal Laws Can Be Adapted To
Prohibit Some Aspects of Spam
 Telephone Consumer Protection Act (TCPA)
 Prohibits automated dialing systems that charge the call to the
receiving landline or wireless phone
 Prohibits fax flooding
 Consumers have the right to be removed from the telemarketing list
 Computer Fraud and Abuse Act (CFAA)
 Intentional access that causes damage
 Sending commands, data, or software that causes damage
 Intentional fraudulent access to obtain something of value
 FTC Act § 5
 Prohibits unfair and deceptive trade practices
 Lanham Act
 Federal trademark law
 False designation of origin can apply to spam
State Laws Are Cracking Down
On Spam
 Usually only apply to spam originating from
within their state or destined to their state
 California requires spam to include return
addresses or toll-free numbers in the first
message line so the recipient can opt out
 California, Washington, and Virginia require
spammers to comply with ISP’s privacy policies
(criminal offense to falsify/impersonate the
domain name of a spam sender- form of
technical fraud)
 Maryland criminalizes harassing or obscene email
Constitutional and Tort Law In
The Battle Against Spam
 Cyber Promotions, Inc. v. AOL, Inc.
 AOL refused to deliver 2 million daily UCEs from
Cyber Promotions
 AOL not found to have violated Cyber Promotions’
First Amendment rights
 Intel Corporation v. Hamidi
 Former employee sent 30,000 e-mails on six
occasions to all Intel employees
 Spam constituted a trespass to chattels
New Legislation To Combat
Spam
 Controlling the Assault of Non-Solicited
Pornography and Marketing Act of 2003 (CANSPAM) passed by Congress in December 2003
 Highlights of CAN-SPAM
 Permits e-mail advertising
 Prohibits misleading headers and other practices
that mask origin of e-mail ads
 Recipients must be allowed to opt out of future
mailings
 E-mail ads may not be sent to receipts who opt out
 E-mails ads must be identified as such
 State antispam laws are generally preempted
New Legislation To Combat
Spam
 Highlights of CAN-SPAM continued
 Does not give right to recipients to sue spammers
 FTC may clarify law requirements
 Enforcement
 FTC proceedings
 Criminal prosecutions
 State attorney general actions
 Private lawsuits brought by ISPs
CAN-SPAM Act of 2003
Background; Pre-emption
 Background
 Law signed by President Bush December 2003
 Law effective January 1, 2004
 Pre-emption
 Pre-empts state laws regulating commercial email
 States may continue to regulate email fraud
 Several states now implementing spam fraud laws
 Pre-empts California’s SB 186
 No litigation brought under SB 186
CAN-SPAM Refresher
 Prohibitions
 False header information (deception re source of email)
 Deceptive subject lines (deception re content of email)
 “Aggravated offenses” – either of the above together with:
 Address harvesting
 Dictionary attacks
 Unauthorized relays
 Unauthorized sending through third-party computers
 Sending more than 10 business days following opt out
 Required Inclusions
 Clear and conspicuous notice that email is commercial
 Does not apply if sender has “affirmative consent” of recipient
 Clear and conspicuous notice of ability to opt out
 Working unsubscribe functionality
 Return email address
 Internet-based mechanism
 Valid physical postal address (OK to include PO box with street address)
Sample Disclosure
“Commercial” notice
This is a promotional email from Nextel Communications, Inc. If you wish to
unsubscribe from Nextel customer emails or to change your email address,
please click here or use the link below.
http://nextel.m0.net/m/u/nex/n.asp?e=khirschman%40digitalimpact.com&cid
=XXXXXXXXXXX
Nextel Communications, Inc. is located at 2001 Edmund Halley Drive,
Reston, VA 20191.
Placement
Just below creative, but above disclaimers
Size
Same as text in ad, larger than disclaimers
Color
Black – same as ad, darker than disclaimers
Opt out notice and functionality
Valid physical postal address
Enforcement and Penalties
 Civil enforcement
 Federal Trade Commission
 Applicable general regulatory agency enforces for financial
institutions
 OCC, Fed, FDIC
 Standard enforcement powers of particular agency
 State enforcement agencies
 $250 per violation; $2 million cap
 Injunctive relief
 “Internet access services” – primarily ISPs
 $25/$100 per violation; $1 million cap
 Injunctive relief
 “Good actor” damage reduction
 Court may triple damages for aggravated violations
 Criminal enforcement
 DOJ enforcement
 One year in prison
 Up to five years for aggravated or repeated violations
CAN-SPAM Regulatory Update
 Request for Information issued for Do-Not-Email List
 Issued March 2004
 Seeks technical information re implementation and security
 Advanced Notice of Proposed Rulemaking
 Issued March 2004
 Two purposes
 Seeks comments on merits of DNE
 Seeks ideas for future rulemakings:
 transactional or relationship emails
 10-business-day rule for unsubscribe
 “primary purpose” test
 forward-to-a-friend
 Multiple sender problem
 ESPC submitted comments on both
 Next steps
 FTC to issue proposed regulations and invite further comment
 FTC to publish DNE implementation plan and report to Congress
CAN-SPAM Litigation Update
 March 2004
 AMEY cases
 AOL, MSN, Yahoo! and Earthlink cooperating in litigation effort
 Several spammers sued; focus on false header violations
 Goal – well-publicized suits and ensuing personal bankruptcies
should dissuade spammers from this line of business
 Hypertouch v BobVila.com
 Aggressive, litigious, small ISP suing Bob Vila’s online business
 Probably not a case of intentionally fraudulent header information,
but an example of how sloppy practices can invite unnecessary
attention
 April 2004
 First government prosecutions filed April 27 by FTC
 Defendants in Michigan and Australia
 Fraudulent header information
 Promoting fraudulent products
 TRO; asset freeze
FTC Predictions (1)
 Do-Not-Email Registry




FTC questioning effectiveness (spammers will ignore)
FTC skeptical of security (valuable list of real names)
Required to propose something
Prediction:
 FTC will propose a do-not-spam registry
 FTC will recommend against implementation
 FTC will support industry “Lumos” initiatives
 “primary purpose” test (i.e., what is a commercial email)
 FTC sympathetic to possibly overly broad interpretations
 Offered multiple methods of determining purpose in ANPR
 Prediction:
 FTC will embrace a “totality of the circumstances” test
 FTC analysis will take into account the sender’s intent, not
just the content and the impression of the recipient
FTC Predictions (2)
 forward-to-a-friend/affiliate marketing programs
 FTC concerned about marketers inducing third parties to send email on
the marketer’s behalf and recipients having no unsub recourse
 Prediction:
 FTC will impose CAN-SPAM obligations (disclosure; unsub; dedupe)
on induced forwarding
 Non-induced forwarding (traditional FTAF w/o more) will not be
subject to CAN-SPAM
 Contingent compensation affiliate marketing programs will be treated
as induced forwarding
 multiple sender problem/list rental issues
 FTC concerned with administrative complexity in multiple sender
situations
 FTC also concerned with compliance resulting in consumer confusion
 Prediction:
 Where a list owner is mailing on behalf of multiple third parties in a
single email, and list owner is disclosed, list owner will be treated as
sender
 Fingers crossed: disclosed list owner will be “sender” for all list
rental campaigns (even single advertiser campaigns)
Compliance Recommendations
 Review the FTC’s “clear and conspicuous” guidance





 FTC “dot com disclosure” guidance:
http://www.ftc.gov/bcp/conline/pubs/buspubs/dotcom/index.html#
III
 Important factors: placement, prominence, distractions,
understandability
Avoid accidentally deceptive subject lines
Review unsubscribe practices
 Offering ability to unsubscribe from sender or just program?
 Is 10-business day rule manageable?
Use commercial notice despite possible “affirmative consent”
exception
Use your company name in the “from” line
 Any party initiating is sufficient to comply with CAN-SPAM
Make sure DNS registrations are up to date
 Avoid attention from small litigious internet access services
What can you do to help prevent
spam?
Spam ware software failed when an
email address was obscured in some
way
For example, writing “at” instead of
the @ symbol.
CyberBrief: Spam ware
 The
How
doesCenter for Democracy and
Technology (CDT) investigated
it work?
how
junk-mail spammers get hold of email
addresses.
 They created 100s of email addresses
and used each one only once.
 After 6 months, over 8,000 unsolicited
emails arrived to these email addresses.