Slashdot Mirror

← Back to Stories (view on slashdot.org)

First CAN-SPAM Lawsuit Filed in California

Posted by timothy on from the this-old-big-house dept.

rocketjam writes "Foster City, California-based ISP Hypertouch, Inc. has filed the first lawsuit alleging violations of the new Federal CAN-SPAM Act of 2003. The lawsuit was filed against BobVila.com and the spammer they hired, Bluestream Media, for sending Hypertouch customers unwanted, unsolicited email advertisements for Vila's "Home Again Newsletter." The suit alleges the defendents sent spam email ads with fraudulent headers and no physical address. It also alleges the emails were sent to randomly generated and harvested addresses as well as addresses that had replied to opt-out links in other spams. Hypertouch's attorney, John L. Fallat, said the CAN-SPAM Act offers little protection to the public, but they would use the few protections it offers to punish spammers." Reader Clemence links to Wired's coverage of the suit.

34 of 167 comments (clear)

  1. Fraud by ScooterBill · · Score: 5, Insightful

    IANAL so I'll ask this question.

    Faking an email header, return address, etc. is supposedly illegal under CAN-SPAM. If this is fraud, then wasn't this illegal before CAN-SPAM?

    M

    1. Re:Fraud by Tango42 · · Score: 4, Insightful

      To you and me (and the rest of /.), that might make sense, because we are used to thinking of the internet as just another part of life. For some (most) people, that isn't yet the case. They seem to think that something happening online is inherently different from the same thing happening IRL. That will probably change over the next decade, but until then laws will have to be tested twice, once for real life, and then again for the net.

    2. Re:Fraud by IANAAC · · Score: 5, Insightful
      No it wasn't. To wit, if I ask a girl for her phone number, and she gives me a fake one, is that fraud under some law? No. However, pretend next year a law is passed that says girls giving out fake phone numbers at bars is now illegal because it is fraudulant. The point is, everything dishonest isn't fraud.

      If you're trying to sell me something with false information, it's fraud. If all your doing is trying to get someone drunk and naked, well...

      Your example is just garden-variety dishonesty (unless, of course, one of you expects a bill or two left on the nightstand).

  2. Hmm by Anonymous Coward · · Score: 5, Insightful

    At first I was kind of worried that the first target gone after was someone "respectable"-- bob vila-- and not like the people selling penis pumps or something.

    But then I thought about it. How much of the problem is caused by ignorant businesses who just happen to hire the wrong marketing firm, and just say "we want you to increase our exposure on the internet" and don't realize this means millions of spam mails sent illegally through hijacked SMTP?

    Perhaps to some degree education is the answer. If other legitimate businesses see bob vila getting smacked for spam mail, maybe they'll panic and make absolutely certain the people they're hiring aren't sending fraudulently-sent spam.

    1. Re:Hmm by Joe+Wagner · · Score: 5, Informative
      Well, we were in contact with them for a bit before we filled the suit. Even after we told them a number of their spam were sent to addresses that were submitted to the opt-out links of other spam, they still refused to promise to never use BlueStream Media again. Shortly before we filed the suit, one of our users recieved another BobVila UCE, this time from a spammer in Florida.

      One of the most compelling aspects in deciding to file this case was that among the various emails messages in their spam run they managed violate nearly every ISP-actionable part of CAN-SPAM. Specifically various email of the spam run had one or more of the following violations:

      1) No street address
      2) False headers, including

      a) SMTP HELO's with names whose IP addresses don't match the originating IP

      b) Domain names used in the headers that were registered with false names...

      3) Addresses that had been submitted to the opt-out mechanisms of other spam
      4) Random and harvested addresses, include domain registration contact addresses.

    2. Re:Hmm by Masem · · Score: 3, Interesting
      I've gotten spam from the BlueStream Media group, that appears more legit than other spam (that is, they don't hide the fact they're advertizing something and yet the ad is readible, not mangled text, and so forth; eg it's nearly good enough to get past a number of spam filters because it looks like a legitamite written email), and representing other clients outside of BobVila. I personally think that's the way the fight has to go, is to make sure that the company that is being advertized in the spam, and not just the spam provider, is targetted in the suits, as once these companies realize that even if they don't send spam directly, usign spam to advertize is a bad idea.

      Unfortunately, more than half of the spam I'm getting lately is now from the fake viagra ones, that, while using viagra, have nothing to do with pfiser, and the actual company isn't mentioned at all, so all you can do is go after the spammer, and not their source of funding.

      --
      "Pinky, you've left the lens cap of your mind on again." - P&TB
      "I can see my house from here!" - ST:
    3. Re:Hmm by pongo000 · · Score: 5, Funny

      SMTP HELO's with names whose IP addresses don't match the originating IP

      And all this time I thought HELO DUDE was a perfectly legit way of identifying oneself to an SMTP server...

    4. Re:Hmm by rixstep · · Score: 3, Insightful

      I don't know good ol' Bob Vila. For all I know, he's just another Nathan Arizona. But it's his business; he's ultimately responsible, as are Blue Stream. I say 'good' if it helps reduce spam.

      Bob Vila might not have known, true, but that's highly unlikely. Blue Stream are in it up to their skinny necks. In either case, they're all responsible under the law, and be glad for that. Otherwise the classic defence will be 'we didn't know, and the employee who did that terrible thing for us is long gone, and we don't have a forwarding address'.

    5. Re:Hmm by ticklemeozmo · · Score: 5, Insightful

      a) SMTP HELO's with names whose IP addresses don't match the originating IP

      That's interesting.. when you send a mail from a windows machine, it uses its NetBIOS name as it's HELO.

      Surely, that's name doesn't match the original IP address when you try to resolve it from the recipients computer.

      Is it me, or is this one of those overly broad clauses they only apply when they need to?

      --
      When modding "Informative", please make sure it both has a source and IS actually informative.
    6. Re:Hmm by toast0 · · Score: 5, Funny

      I personally prefer HELO there. You never know, you could be talking to a non-dude SMTP server... wouldn't want to get them mad at you when you haven't even sent any data yet. :)

      --
      Need a Catering Connection
    7. Re:Hmm by iminplaya · · Score: 3, Funny

      If they ever find him guilty of anything, they can make him do community service, like, for instance, he can build "This old Half-way House" for Martha Stewart.

      --
      What?
  3. Show how useless it is by Lord_Dweomer · · Score: 5, Insightful
    "Hypertouch's attorney, John L. Fallat, said the CAN-SPAM Act offers little protection to the public, but they would use the few protections it offers to punish spammers."

    If this case gets a lot of press coverage, it might help show people how utterly useless the CAN-SPAM act really is.

    If a lawyer says its near useless, you know it must be bad. Hopefully the NY Times covers this in depth.

    At least for once they are suing the company who uses the spammer and not just the spammer.

    --
    Buy Steampunk Clothing Online!
    1. Re:Show how useless it is by gravyfaucet · · Score: 5, Funny

      useless. couldnt they have picked a more suitable target? Its not like Bob Villa employs cloned machines and offers to sell you a "legal" building permit, or promises "add three to five stories to your house - naturally and without a contractor". sheesh

      --
      Yes! Evil rules! Good can suck it! Suck it, good!
  4. Say it ain't so! by Anonymous Coward · · Score: 3, Funny

    Bob Vila sending spam?!?! Next you'll be telling me Norm Abrams wants me to have a longer penis.

  5. This Old Dot-Com by AndroidCat · · Score: 3, Informative

    General article on Bob Vila's ebiz

    --
    One line blog. I hear that they're called Twitters now.
  6. California's tougher law still has some effect by anonymous+cowfart · · Score: 5, Informative
    California's tough spam law is mostly preempted by the new Federal law. But not entirely. The preemption clause reads
    This Act supersedes any statute, regulation, or rule of a State or political subdivision of a State that expressly regulates the use of electronic mail to send commercial messages, except to the extent that any such statute, regulation, or rule prohibits falsity or deception in any portion of a commercial electronic mail message or information attached thereto.

    So for any spam that has a forged header or a misleading subject, California's new law, with the $1000 per spam penalty, will still apply. California allows private suits in small claims court by any party. So you can haul the bozos into court. Maybe even across state lines.

    A year or two from now, we'll be rid of the chickenboners, but we'll be getting even more spam from "legitimate businesses".

    --

    So I'm a pervert. Welcome to the Internet.
    1. Re:California's tougher law still has some effect by triclipse · · Score: 4, Informative
      You can also get attorney's fees under the California law:

      "(a)(1) In addition to any other remedies provided by this article or by any other provisions of law, a recipient of an unsolicited commercial e-mail advertisement transmitted in violation of this article, an electronic mail service provider, or the Attorney General may bring an action against an entity that violates any provision of this article to recover either or both of the following:
      (A) Actual damages.
      (B) Liquidated damages of one thousand dollars ($1,000) for each unsolicited commercial e-mail advertisement transmitted in violation of Section 17529.2, up to one million dollars ($1,000,000) per incident.
      (2) The recipient, an electronic mail service provider, or the Attorney General, if the prevailing plaintiff, may also recover reasonable attorney's fees and costs.

      California Business & Professions Code sec 17529.8

      --
      No Inflation Taxation without Representation
  7. Re:fraudulent headers? by Anonymous Coward · · Score: 4, Insightful

    "Fraudulent" refers not to the compliance of the headers with the e-mail protocol, but means that the headers contained information which was false.

  8. Opportunism by StuWho · · Score: 5, Interesting
    "Even if Hypertouch succeeds in its case, the message to spammers and the companies that hire them might not be loud enough to make a difference. The ISP is asking for $100 in damages -- the maximum allowed by the Can-Spam Act -- for each of the approximately 100 messages that it claims were sent by BlueStream Media."

    Sounds like there could be money in setting up as an ISP, and sueing any spammers who use you for $100 per message. Given the millions of messages an individual spammer can send, even one victory against them would result in a cash windfall for the ISP concerned.

    --
    "If you think nobody cares if you're alive, try missing a couple of car payments." Earl Wilson
  9. Who pays for the spam? by d474 · · Score: 3, Insightful

    Until they start punishing the companies that benefit from the ads this is never going to stop. It should be handled like the drug war. If your company is benefitting from ads spammed to millions of people, you go down unless you reveal who you hired to do it.

    --
    Authority questions you. Return the favor.
    1. Re:Who pays for the spam? by crackshoe · · Score: 5, Insightful

      Wait... something should be handled like the drug war? that highly succesful siphoning off of american tax dollars that accomplishes next to nothing? If it was handled as such, i wouldn't be suprised if spammers starting simply directing minors to do the actual spamming, much like the crack dealers that recruited under-age dealers because they wouldn't get the same jailtime.

      --
      Don't worry - its just stigmata. Pass me a napkin and don't you dare tell my mother.
  10. Real Time Filters by d474 · · Score: 3, Interesting

    Couldn't huge email centers (yahoo, msn, etc.) in real time compare source IP's from all emails moving into their systems, identify SPAM as massive amounts of identical email coming from identical IP addresses, load that data into a filter and then block? Some would always get through, say 100,000 but the rest of the 1.4 million get blocked? Isn't anything like this possible?

    --
    Authority questions you. Return the favor.
  11. Hah! by niko9 · · Score: 4, Funny

    I can see the Warden welcoming Bob Villa to the big house: "Welcome to this old Penitentiary"

  12. you can be sure... by Roger+Keith+Barrett · · Score: 5, Funny

    ...than Bob Vila isn't personally involved. Ever watch "This Old House"? The guy never does ANY projects himself. He always passes it off to that other guy! "Hi, I am Bob Vila for Sears Bulk Mail Services. For just $19.95...."

    --

    Why don't you embrace your slashbotness instead of living in a dreamworld?
  13. I wonder whose cell would be nicer... by Toxygen · · Score: 5, Funny

    ...Bob Vila's or Martha Stewart?

    1. Re:I wonder whose cell would be nicer... by shadowbearer · · Score: 3, Funny

      Well, one would have nice toilet doilies, and the other would have a working toilet. Which one would *you* rather be in? :)

      sorry, I hadda do it

      SB

      --
      It's old. The more humans I meet, the more I like my cats. At least they are honest.
  14. FYI: lawsuit homepage... by Joe+Wagner · · Score: 5, Informative
    Hi All, Just FYI, We will be posting updates to the case as they happen at http://legal.hypertouch.com. We think the CAN-SPAM Act is an open license to spam with very little protection for the public, but we are attempting to use what few protections are available to punish some unrepentant spammers.

    One of the biggest problems with CAN-SPAM Act that we are hoping to educate the press so they can inform the public is that the Act says end users _must_ contact each spammer and opt-out. This is of course exactly the opposite of what ISPs have been tell their customers to do. "Opting out" merely gives the spammer have a live address. Some of the email addresses defendants sent spam to were unique addresses submitted to a "virus software 90 % off" spam. In no uncertain terms, "opting out" of spam signs you up for more spam.

    We were surprised when even after we told BobVila.com about the quality of the lists their hired spammer was using, they still refused even just to promise they'd never use BlueStream Media again... Right before we filed the action, one of our users received a new BobVila spam, this time sent through a Florida based spammer.

  15. Bob Vila is more or less fictional... by LostCluster · · Score: 4, Informative

    Yeah, he does exist and that is his real name. However, his association with home improvement is purely a creation of television.

    He was a nobody until a PBS series called This Old House came along in 1979. He was hired as the host of that show. His job duties there were to read the opening and closing sequence lines, and to interview the experts who really did know what they were doing. He was not one of those experts, he was just asked questions to the experts.

    In 1989, when he left This Old House, he created his own TV production company, and used his association with home improvement to get endorcement deals. His primary sponsor is Sears, and his Home Again series can more or less be seen as a Sears infomerical at times. (Sears has always been a title sponsor, and controls a large chunk of the ad space within the program. The content portion of the show might not hit you over the head as an ad, but notice the clear bias when it comes time to select which company's products to work with.)

    His primary line of work these days isn't as a home improvement expert, it's in being the pitch man for Craftsman tools and other Sears brands. He'll endorse other products too, but that's really the only skill people pay him for. You never see him doing any of the work on his TV shows, and that's for good reason...

  16. Yes.... by www.sorehands.com · · Score: 3, Informative

    In many states, there were laws that made using false headers a violation of that state's laws. In addition many states have advertising laws which require the advertiser to be identified.

    --
    Fight Spammers!
  17. Will it help any? by Bagheera · · Score: 4, Interesting

    It's nice to see someone at least trying to get something from this Law, since it did such a good job of crippling the stricter state level laws. While I agree that a single national level law is a good idea, they took it in the shorts with this one. CAN-SPAM was a waste of paper.

    The sad thing is during a recent review of my spam trap account (11800+ email in 3 months) a grand total of 30 of them were from "legitimate" business. The rest were for your usual run of penis pills, bad mortgages, "Stop spam now" software, and herbal vi@gra.

    Now, if I could collect on each and every one of them, I'd be a wealthy man. But the vast majority are coming in through open proxies or trojaned Windows boxen, and are annoyingly difficult to track back to their source - which is often off-shore and out of reach of the CAN-SPAM act in any case.

    Going after a legitimate" company like this is may put a slight damper on SPAM sent by "real" companies, but it does little or nothing to stem the flood tide of crap we get from the low lifes who are at the root of the problem.

    --
    Never attribute to malice what can as easily be the result of incompetence...
  18. Windows: the (un)suspecting victim by mousse-man · · Score: 3, Funny

    I think running Windows is already legally aiding and abetting spamming. I wonder whether this is punishable...

  19. Re:foster city by Joe+Wagner · · Score: 4, Informative

    It appears that one of BlueStream Media's customers is also in Foster City, DrySkinOnly.com... Small world. The local DA is taking complaints about spam, though you have to get through a disinterested police force. If you have any pre-2004 spam that has no ADV label, that is punishable under the old CA law by up to one year in jail. If you have the time and energy, file a complaint and follow up on it...

  20. ignorant businesses by DavidDeLux · · Score: 3, Interesting

    Only yesterday I got some UCE from a local company... a nice large PDF file containing details of a promo they were doing for photocopiers. This company clearly think its OK to send out such junk... whilst they included in the message their email address to request to get off their list, the replyto address was a placebo... so for that alone they're breaking the acceptable use policy of the ISP that they sent from... who got a suitable complaint from me (and I hope they yank their account!). Now, this company were using some software to bulk send these messages (pdfmail)... and they harvested my email address from somewhere. You would have thought that by now comapnies would know better than to send out SPAM/UCE.. in my case the company sent crap themselves, so they can't even blame some unscrupulous marketing company.

  21. HELO behavior and greylisting by Frater+219 · · Score: 3, Interesting
    a) SMTP HELO's with names whose IP addresses don't match the originating IP
    That's interesting.. when you send a mail from a windows machine, it uses its NetBIOS name as it's HELO.
    ... Well, my mail server does not need to be receiving mail from remote Windows client systems. Windows mail servers, yes, but presumably those can follow the protocol and HELO with their real name, not their Microsoft made-up toy name.

    Indeed, I might be willing to discriminatorily greylist all mail from any remote Windows system. (Greylisting: Sending a 4xx temporary failure the first time a host tries to send mail to a particular recipient. This causes a normal MTA to retry in a few minutes, but fire-and-forget spamware and worms generally abort.)

    How to apply this to Windows only? OpenBSD's passive OS fingerprinting would be a start. It allows one to selectively redirect traffic based on the detected OS, and thus to offer different quality of service based on the quality of the client system. Since there is a much greater likelihood that a given Windows host's connection to my MTA is delivering spam and worms than that a given Solaris or Red Hat host is delivering spam and worms, there is a good reason to deteriorate service (as by greylisting) for Windows hosts -- as long as it can be done in a way which retains (eventual) delivery of real mail.

    If Unix mail server admins all chose to greylist remote Windows hosts -- including Windows MTAs as well as client hosts -- then Windows servers would eat the cost of keeping messages in queue during the greylisting period. This would, effectively, be the cost of proving you're a real Windows MTA, not a worm or spamware. This lays part of the burden of the Windows system's susceptibility to malware back upon those responsible for it (deployers of Windows) whereas currently they are able to offload it upon the rest of us in the form of junk mail from worms.

    (Incidentally, yes, the majority of mail exchangers run some form of Unix. Less than half, however, run Sendmail.)