Slashdot Mirror

Hi All, Just FYI, We will be posting updates to the case as they happen at http://legal.hypertouch.com. We think the CAN-SPAM Act is an open license to spam with very little protection for the public, but we are attempting to use what few protections are available to punish some unrepentant spammers.

One of the biggest problems with CAN-SPAM Act that we are hoping to educate the press so they can inform the public is that the Act says end users _must_ contact each spammer and opt-out. This is of course exactly the opposite of what ISPs have been tell their customers to do. "Opting out" merely gives the spammer have a live address. Some of the email addresses defendants sent spam to were unique addresses submitted to a "virus software 90 % off" spam. In no uncertain terms, "opting out" of spam signs you up for more spam.

We were surprised when even after we told BobVila.com about the quality of the lists their hired spammer was using, they still refused even just to promise they'd never use BlueStream Media again... Right before we filed the action, one of our users received a new BobVila spam, this time sent through a Florida based spammer.

That is true that individuals may sue under other laws. However, the true power in anti-spam laws came from statutory damages, i.e. $XXX/dollars per message. Otherwise you have a huge hurtle of proving the amount of damage you suffered, from each individual message. That makes your lawsuit a much larger gamble as far as even recovering your expenses, to say nothing of providing incentive for the spammer to stop.

Junk faxes cost me over 10 cents a page. If you had to prove your damages in court, junk faxing exploded and essentially ended faxing as a useful medium. The TCPA essentially dealt with the explosive growth of junk faxers by giving individuals a $500-$1500 incentive to enforce the law. That still is not enough to stop some companies for using junk faxes.

We are currently involved in a junk fax class action against Perry Johnson for sending a huge number of junk faxes. In 2000 they were cited by the FTC for junk faxing. They continued to send them out. After getting sixteen junk faxes, we finally filed suit in 2001. The case is still ongoing. In contradiction of previous statements, including in Perry Johnson's written response to the FCC's citation for TCPA violations, they have now asserted in sworn testimony they do not maintain and have Never maintained a Do Not Fax database. So we subpoenaed their phone company for their records. Global Crossing, as indicated in an affidavit, has 59,099 records of calls to the "Removal" number on Perry Johnson's junk faxes. A subpoena to another phone company who also provided service for Perry Johnson's toll-free "Remove" number has provided documentation of another large number of phone calls. That could bring the size of the class to well over 100,000 identified members, just from those companies and individuals who took the time and effort to ask to be placed in Perry Johnson's (nonexistent) "Do Not Call" database.

Perry Johnson is faxing a huge number of people. If there were no statutory damages for this, there would be no way to induce them to stop. A smack by the FTC did not do it. (preview for the future there?) Iindividuals complaining and opting out did not do. Individual prior lawsuits didn't do it.Proving actual damages for each class member can be a huge barrier for a plaintiff.

And heads up boys and girls -- Perry Johnson has now also begun to advertise via spam (using "throw away" domains like onlinepji.net, infoiso.net and isomail.net) They've even tried to relay their spam through our servers. That would be illegal under the new law, but under the new, why would they bother relaying through someone else. At the moment, it now appears there will be little hope in ever stopping them from legally pumping spam after spam into your mailbox.

That's exactly right. False or misleading is not the same as ambiguous. Or even pointlessly accurate:

• Subj: Did you get this email?
• Subj: Something to think about
• Subj: Re: what was on the news last night
• Subj: She was very pleased

But even if they are accurate, our user's in boxes will still get creamed:

• Subj: 1.95% Mortgage Rate - NO JOKE
• Subj: have hundreds of lenders help you get the lowest rates
• Subj: Mortgage Leads as Low as $8.00/lead vovlmh.hhpdo tmfkieqjl ffkdly:

Now that last one, can I afford to bank roll a Federal Lawsuit on the gamble that a hash buster is ruled misleading by a jury -- and then gamble on what portion of the "up to $25" the judge gives us?

Finally, the point is spammers can now consider putting their real IP addresses in their headers because what they are sending is now legal. If their IP addresses begin to get blacklisted, then they can and will again pump their spam through any number of overseas IP addresses without breaking the law. I do not like to black list all of Russia or China to block spam, even if I know I will lose little legitamate email. There is nothing illegal in the law about making it difficult to contact the sender, as long as its legal.

The spammer we brought a class action against, Link It Software (legal.hypertouch.com) did just that. After we filed they stopped sending through their California Sprint T-1 line and started sending via a front business in India (xactmailer.net) No hidden IP address of the "originating machine" but the domain was registered to some company in India and the header trail ended in India.

I am the CEO of Hypertouch Inc, one of the few corporations in California to have brought suit against a spammer under the existing CA anti-spam laws, and the only person so far who has be able to get the local DA to take a criminal complaints against spammers under the criminal provision of CA law. (see http://press.hypertouch.com/) Some of the "minor changes" that the Senate made before sending it back to the House include changing the statutory damages from a flat $25 to "up to $25." Now small ISPs can't even count on the paltry $25/message when they decide to take a spammer on in Federal Court.

I should note one interesting wrinkle. Unlike what is common in other Federal laws, the act "supersedes any statute, regulation, or rule of a State or political subdivision of a State " but says _nothing_ about the District of Columbia. Soooo, if people can rally the DC council to pass a California-like law, perhaps there may be a new place to host your mail servers.

A final copy of the act can be found on my website. http://www.hypertouch.com/legal/s877-eas.html
I'm pretty pessimistic about things right now. Here are my chief concerns about the bill.

1."I CAN SPAM " Act legalizes unlimited spam -- even after"opt-outs "
The "SEPARATE LINES OF BUSINESS OR DIVISIONS " clause in the act permits spammers to send repeatedly to you even after you've opted out as long as they change domain names, a.k.a. lines of business.

(B) SEPARATE LINES OF BUSINESS OR DIVISIONS- If an entity operates through separate lines of business or divisions and holds itself out to the recipient of the message, in complying with the requirement under section 5(a)(5)(B) [the opt out section], as that particular line of business or division rather than as the entity of which such line of business or division is a part, then the line of business or the division shall be treated as the sender of such message for purposes of this Act.

The impression we have is that the DMA asked for this so that one cannot opt out of spam from the Fortune 500 by giving notice to their corporate HQ, you have to track down each"Division. " But more to the glorious point from the Viagra spammers perspective, see what happens if I opt out of a spam for today's mail bin: (picked at random)

Easiest method to enlarge your $&#@%, stick on the patch, and forget about it! easy as 1-2-3. Find out how we can help your manhood [url in spam: www.prosize-health.biz/in.php?id=43&p_id=2 ]

By my sending email (or going to Prosize-Health.biz or whatever hoops they choose to put up for their process), I can"opt out. " However that spammer will be able to spam me LEGALLY from all of their other lines of business, e.g. Biggersize-health.biz, etc. Note that the spammer's email only represents itself as Prosize-Health.biz... All they have to do is spend $7 every couple of weeks for a new domain for their new"Line of Busines " (they might even bother to call it a new Division) and they are home free. There is NOTHING I can do to stop this. I can track down every big spammer and personally serve them with an opt-out, but that doesn't trickle down to their thousands of "Divisions. "
Let's be clear -- Spammers are already talking about this open license on their bulletin boards and mailing lists.

2."I CAN SPAM " punishes only the spammer, not the marketer
By rotating through US based spammers, or using untraceable overseas spammers, often in Russia or China, businesses will be allowed to advertise via spam with abandon. The great strength of the upcoming California law is that is target both the marketer and the spammer. That will be gone when California laws are made void. For example, we have been trying to get Discover Credit Card to stop sending spam to us for over 18 months. They literally just regularly rotate through new

As owner of a business who has taken spammers to court and whose lawfirm defended California's current antispam law in the CA Supreme Court, let me be emphatic: This is a horrible law. It absolutely overides California and all other state laws which is why the DMA is pushing for it so hard. It removes a private right of action for end users. Let's be clear:

This law makes it legal to send spam in all 50 states.

The law has many things wrong with it:

• It removes any and all laws individual states passed to protect their citizens.
• It removes private right of actions. Junk faxes are only just annoying rather than crippling today because of the TCPA, which allows Joe Public call to carpet any junk faxer in small claims court for $1500/fax.
• Anyone can spam you until you specifically asked them to stop -- what percentage of the 25 million business in the US do you think you have time to individually contact.
• "Valid" return addresses on spam offers no aid to people fighting spam. How does a spammer having some (possibly even valid) street address in an obscure corner of the world and an mail server that dumps all incoming email to /dev/null give me any help in fighting spam. A large percentage of our incoming spam all have "valid" return addresses.
• In 1991, Congress authorized the telephone "do not call list" by the FTC. That list took more than a decade to go into effect. How long do you think you'll wait for this one?
• "At the FTC's Spam Forum in May 2003, FTC officials and a representative of the National Association of Attorney's General stated clearly that neither the FTC nor state law enforcement agencies have the time, money, or resources, needed to engage in enough anti-spam prosecutions to make a dent in the problem." (Cauce.org)
• As currently written, the email "do not call list" will only be by individual email address, not by domain.

Time in earnest to call your local congressional rep. The Senate appears to be a lost cause.