First CAN-SPAM Lawsuit Filed in California

rocketjam writes "Foster City, California-based ISP Hypertouch, Inc. has filed the first lawsuit alleging violations of the new Federal CAN-SPAM Act of 2003. The lawsuit was filed against BobVila.com and the spammer they hired, Bluestream Media, for sending Hypertouch customers unwanted, unsolicited email advertisements for Vila's "Home Again Newsletter." The suit alleges the defendents sent spam email ads with fraudulent headers and no physical address. It also alleges the emails were sent to randomly generated and harvested addresses as well as addresses that had replied to opt-out links in other spams. Hypertouch's attorney, John L. Fallat, said the CAN-SPAM Act offers little protection to the public, but they would use the few protections it offers to punish spammers." Reader Clemence links to Wired's coverage of the suit.

Comments

Fraud

[ScooterBill]

IANAL so I'll ask this question.

Faking an email header, return address, etc. is supposedly illegal under CAN-SPAM. If this is fraud, then wasn't this illegal before CAN-SPAM?

M

Re:Fraud

[Tango42]

To you and me (and the rest of /.), that might make sense, because we are used to thinking of the internet as just another part of life. For some (most) people, that isn't yet the case. They seem to think that something happening online is inherently different from the same thing happening IRL. That will probably change over the next decade, but until then laws will have to be tested twice, once for real life, and then again for the net.

Re:Fraud

[IANAAC]

No it wasn't. To wit, if I ask a girl for her phone number, and she gives me a fake one, is that fraud under some law? No. However, pretend next year a law is passed that says girls giving out fake phone numbers at bars is now illegal because it is fraudulant. The point is, everything dishonest isn't fraud.

If you're trying to sell me something with false information, it's fraud. If all your doing is trying to get someone drunk and naked, well...

Your example is just garden-variety dishonesty (unless, of course, one of you expects a bill or two left on the nightstand).

Hmm

[Anonymous Coward]

At first I was kind of worried that the first target gone after was someone "respectable"-- bob vila-- and not like the people selling penis pumps or something.

But then I thought about it. How much of the problem is caused by ignorant businesses who just happen to hire the wrong marketing firm, and just say "we want you to increase our exposure on the internet" and don't realize this means millions of spam mails sent illegally through hijacked SMTP?

Perhaps to some degree education is the answer. If other legitimate businesses see bob vila getting smacked for spam mail, maybe they'll panic and make absolutely certain the people they're hiring aren't sending fraudulently-sent spam.

Re:Hmm

[Joe Wagner]

Well, we were in contact with them for a bit before we filled the suit. Even after we told them a number of their spam were sent to addresses that were submitted to the opt-out links of other spam, they still refused to promise to never use BlueStream Media again. Shortly before we filed the suit, one of our users recieved another BobVila UCE, this time from a spammer in Florida.

One of the most compelling aspects in deciding to file this case was that among the various emails messages in their spam run they managed violate nearly every ISP-actionable part of CAN-SPAM. Specifically various email of the spam run had one or more of the following violations:

1) No street address
2) False headers, including

a) SMTP HELO's with names whose IP addresses don't match the originating IP

b) Domain names used in the headers that were registered with false names...

3) Addresses that had been submitted to the opt-out mechanisms of other spam
4) Random and harvested addresses, include domain registration contact addresses.

Re:Hmm

[pongo000]

SMTP HELO's with names whose IP addresses don't match the originating IP

And all this time I thought HELO DUDE was a perfectly legit way of identifying oneself to an SMTP server...

Re:Hmm

[ticklemeozmo]

a) SMTP HELO's with names whose IP addresses don't match the originating IP

That's interesting.. when you send a mail from a windows machine, it uses its NetBIOS name as it's HELO.

Surely, that's name doesn't match the original IP address when you try to resolve it from the recipients computer.

Is it me, or is this one of those overly broad clauses they only apply when they need to?

Re:Hmm

[toast0]

I personally prefer HELO there. You never know, you could be talking to a non-dude SMTP server... wouldn't want to get them mad at you when you haven't even sent any data yet. :)

Show how useless it is

[Lord_Dweomer]

"Hypertouch's attorney, John L. Fallat, said the CAN-SPAM Act offers little protection to the public, but they would use the few protections it offers to punish spammers."

If this case gets a lot of press coverage, it might help show people how utterly useless the CAN-SPAM act really is.

If a lawyer says its near useless, you know it must be bad. Hopefully the NY Times covers this in depth.

At least for once they are suing the company who uses the spammer and not just the spammer.

Re:Show how useless it is

[gravyfaucet]

useless. couldnt they have picked a more suitable target? Its not like Bob Villa employs cloned machines and offers to sell you a "legal" building permit, or promises "add three to five stories to your house - naturally and without a contractor". sheesh

California's tougher law still has some effect

[anonymous cowfart]

California's tough spam law is mostly preempted by the new Federal law. But not entirely. The preemption clause reads

This Act supersedes any statute, regulation, or rule of a State or political subdivision of a State that expressly regulates the use of electronic mail to send commercial messages, except to the extent that any such statute, regulation, or rule prohibits falsity or deception in any portion of a commercial electronic mail message or information attached thereto.

So for any spam that has a forged header or a misleading subject, California's new law, with the $1000 per spam penalty, will still apply. California allows private suits in small claims court by any party. So you can haul the bozos into court. Maybe even across state lines.

A year or two from now, we'll be rid of the chickenboners, but we'll be getting even more spam from "legitimate businesses".

Re:California's tougher law still has some effect

[triclipse]

You can also get attorney's fees under the California law:

"(a)(1) In addition to any other remedies provided by this article or by any other provisions of law, a recipient of an unsolicited commercial e-mail advertisement transmitted in violation of this article, an electronic mail service provider, or the Attorney General may bring an action against an entity that violates any provision of this article to recover either or both of the following:
(A) Actual damages.
(B) Liquidated damages of one thousand dollars ($1,000) for each unsolicited commercial e-mail advertisement transmitted in violation of Section 17529.2, up to one million dollars ($1,000,000) per incident.
(2) The recipient, an electronic mail service provider, or the Attorney General, if the prevailing plaintiff, may also recover reasonable attorney's fees and costs.

California Business & Professions Code sec 17529.8

Re:fraudulent headers?

[Anonymous Coward]

"Fraudulent" refers not to the compliance of the headers with the e-mail protocol, but means that the headers contained information which was false.

Opportunism

[StuWho]

"Even if Hypertouch succeeds in its case, the message to spammers and the companies that hire them might not be loud enough to make a difference. The ISP is asking for $100 in damages -- the maximum allowed by the Can-Spam Act -- for each of the approximately 100 messages that it claims were sent by BlueStream Media."

Sounds like there could be money in setting up as an ISP, and sueing any spammers who use you for $100 per message. Given the millions of messages an individual spammer can send, even one victory against them would result in a cash windfall for the ISP concerned.

Hah!

[niko9]

I can see the Warden welcoming Bob Villa to the big house: "Welcome to this old Penitentiary"

Re:Who pays for the spam?

[crackshoe]

Wait... something should be handled like the drug war? that highly succesful siphoning off of american tax dollars that accomplishes next to nothing? If it was handled as such, i wouldn't be suprised if spammers starting simply directing minors to do the actual spamming, much like the crack dealers that recruited under-age dealers because they wouldn't get the same jailtime.

you can be sure...

[Roger Keith Barrett]

...than Bob Vila isn't personally involved. Ever watch "This Old House"? The guy never does ANY projects himself. He always passes it off to that other guy! "Hi, I am Bob Vila for Sears Bulk Mail Services. For just $19.95...."

I wonder whose cell would be nicer...

[Toxygen]

...Bob Vila's or Martha Stewart?

FYI: lawsuit homepage...

[Joe Wagner]

Hi All, Just FYI, We will be posting updates to the case as they happen at http://legal.hypertouch.com. We think the CAN-SPAM Act is an open license to spam with very little protection for the public, but we are attempting to use what few protections are available to punish some unrepentant spammers.

One of the biggest problems with CAN-SPAM Act that we are hoping to educate the press so they can inform the public is that the Act says end users _must_ contact each spammer and opt-out. This is of course exactly the opposite of what ISPs have been tell their customers to do. "Opting out" merely gives the spammer have a live address. Some of the email addresses defendants sent spam to were unique addresses submitted to a "virus software 90 % off" spam. In no uncertain terms, "opting out" of spam signs you up for more spam.

We were surprised when even after we told BobVila.com about the quality of the lists their hired spammer was using, they still refused even just to promise they'd never use BlueStream Media again... Right before we filed the action, one of our users received a new BobVila spam, this time sent through a Florida based spammer.

Bob Vila is more or less fictional...

[LostCluster]

Yeah, he does exist and that is his real name. However, his association with home improvement is purely a creation of television.

He was a nobody until a PBS series called This Old House came along in 1979. He was hired as the host of that show. His job duties there were to read the opening and closing sequence lines, and to interview the experts who really did know what they were doing. He was not one of those experts, he was just asked questions to the experts.

In 1989, when he left This Old House, he created his own TV production company, and used his association with home improvement to get endorcement deals. His primary sponsor is Sears, and his Home Again series can more or less be seen as a Sears infomerical at times. (Sears has always been a title sponsor, and controls a large chunk of the ad space within the program. The content portion of the show might not hit you over the head as an ad, but notice the clear bias when it comes time to select which company's products to work with.)

His primary line of work these days isn't as a home improvement expert, it's in being the pitch man for Craftsman tools and other Sears brands. He'll endorse other products too, but that's really the only skill people pay him for. You never see him doing any of the work on his TV shows, and that's for good reason...

Will it help any?

[Bagheera]

It's nice to see someone at least trying to get something from this Law, since it did such a good job of crippling the stricter state level laws. While I agree that a single national level law is a good idea, they took it in the shorts with this one. CAN-SPAM was a waste of paper.

The sad thing is during a recent review of my spam trap account (11800+ email in 3 months) a grand total of 30 of them were from "legitimate" business. The rest were for your usual run of penis pills, bad mortgages, "Stop spam now" software, and herbal vi@gra.

Now, if I could collect on each and every one of them, I'd be a wealthy man. But the vast majority are coming in through open proxies or trojaned Windows boxen, and are annoyingly difficult to track back to their source - which is often off-shore and out of reach of the CAN-SPAM act in any case.

Going after a legitimate" company like this is may put a slight damper on SPAM sent by "real" companies, but it does little or nothing to stem the flood tide of crap we get from the low lifes who are at the root of the problem.

Re:foster city

[Joe Wagner]

It appears that one of BlueStream Media's customers is also in Foster City, DrySkinOnly.com... Small world. The local DA is taking complaints about spam, though you have to get through a disinterested police force. If you have any pre-2004 spam that has no ADV label, that is punishable under the old CA law by up to one year in jail. If you have the time and energy, file a complaint and follow up on it...