First CAN-SPAM Lawsuit Filed in California

rocketjam writes "Foster City, California-based ISP Hypertouch, Inc. has filed the first lawsuit alleging violations of the new Federal CAN-SPAM Act of 2003. The lawsuit was filed against BobVila.com and the spammer they hired, Bluestream Media, for sending Hypertouch customers unwanted, unsolicited email advertisements for Vila's "Home Again Newsletter." The suit alleges the defendents sent spam email ads with fraudulent headers and no physical address. It also alleges the emails were sent to randomly generated and harvested addresses as well as addresses that had replied to opt-out links in other spams. Hypertouch's attorney, John L. Fallat, said the CAN-SPAM Act offers little protection to the public, but they would use the few protections it offers to punish spammers." Reader Clemence links to Wired's coverage of the suit.

Comments

Fraud

[ScooterBill]

IANAL so I'll ask this question.

Faking an email header, return address, etc. is supposedly illegal under CAN-SPAM. If this is fraud, then wasn't this illegal before CAN-SPAM?

M

Re:Fraud

[IANAAC]

No it wasn't. To wit, if I ask a girl for her phone number, and she gives me a fake one, is that fraud under some law? No. However, pretend next year a law is passed that says girls giving out fake phone numbers at bars is now illegal because it is fraudulant. The point is, everything dishonest isn't fraud.

If you're trying to sell me something with false information, it's fraud. If all your doing is trying to get someone drunk and naked, well...

Your example is just garden-variety dishonesty (unless, of course, one of you expects a bill or two left on the nightstand).

Hmm

[Anonymous Coward]

At first I was kind of worried that the first target gone after was someone "respectable"-- bob vila-- and not like the people selling penis pumps or something.

But then I thought about it. How much of the problem is caused by ignorant businesses who just happen to hire the wrong marketing firm, and just say "we want you to increase our exposure on the internet" and don't realize this means millions of spam mails sent illegally through hijacked SMTP?

Perhaps to some degree education is the answer. If other legitimate businesses see bob vila getting smacked for spam mail, maybe they'll panic and make absolutely certain the people they're hiring aren't sending fraudulently-sent spam.

Re:Hmm

[Joe Wagner]

Well, we were in contact with them for a bit before we filled the suit. Even after we told them a number of their spam were sent to addresses that were submitted to the opt-out links of other spam, they still refused to promise to never use BlueStream Media again. Shortly before we filed the suit, one of our users recieved another BobVila UCE, this time from a spammer in Florida.

One of the most compelling aspects in deciding to file this case was that among the various emails messages in their spam run they managed violate nearly every ISP-actionable part of CAN-SPAM. Specifically various email of the spam run had one or more of the following violations:

1) No street address
2) False headers, including

a) SMTP HELO's with names whose IP addresses don't match the originating IP

b) Domain names used in the headers that were registered with false names...

3) Addresses that had been submitted to the opt-out mechanisms of other spam
4) Random and harvested addresses, include domain registration contact addresses.

Re:Hmm

[pongo000]

SMTP HELO's with names whose IP addresses don't match the originating IP

And all this time I thought HELO DUDE was a perfectly legit way of identifying oneself to an SMTP server...

Re:Hmm

[ticklemeozmo]

a) SMTP HELO's with names whose IP addresses don't match the originating IP

That's interesting.. when you send a mail from a windows machine, it uses its NetBIOS name as it's HELO.

Surely, that's name doesn't match the original IP address when you try to resolve it from the recipients computer.

Is it me, or is this one of those overly broad clauses they only apply when they need to?

Re:Hmm

[toast0]

I personally prefer HELO there. You never know, you could be talking to a non-dude SMTP server... wouldn't want to get them mad at you when you haven't even sent any data yet. :)

Show how useless it is

[Lord_Dweomer]

"Hypertouch's attorney, John L. Fallat, said the CAN-SPAM Act offers little protection to the public, but they would use the few protections it offers to punish spammers."

If this case gets a lot of press coverage, it might help show people how utterly useless the CAN-SPAM act really is.

If a lawyer says its near useless, you know it must be bad. Hopefully the NY Times covers this in depth.

At least for once they are suing the company who uses the spammer and not just the spammer.

Re:Show how useless it is

[gravyfaucet]

useless. couldnt they have picked a more suitable target? Its not like Bob Villa employs cloned machines and offers to sell you a "legal" building permit, or promises "add three to five stories to your house - naturally and without a contractor". sheesh

California's tougher law still has some effect

[anonymous cowfart]

California's tough spam law is mostly preempted by the new Federal law. But not entirely. The preemption clause reads

This Act supersedes any statute, regulation, or rule of a State or political subdivision of a State that expressly regulates the use of electronic mail to send commercial messages, except to the extent that any such statute, regulation, or rule prohibits falsity or deception in any portion of a commercial electronic mail message or information attached thereto.

So for any spam that has a forged header or a misleading subject, California's new law, with the $1000 per spam penalty, will still apply. California allows private suits in small claims court by any party. So you can haul the bozos into court. Maybe even across state lines.

A year or two from now, we'll be rid of the chickenboners, but we'll be getting even more spam from "legitimate businesses".

Opportunism

[StuWho]

"Even if Hypertouch succeeds in its case, the message to spammers and the companies that hire them might not be loud enough to make a difference. The ISP is asking for $100 in damages -- the maximum allowed by the Can-Spam Act -- for each of the approximately 100 messages that it claims were sent by BlueStream Media."

Sounds like there could be money in setting up as an ISP, and sueing any spammers who use you for $100 per message. Given the millions of messages an individual spammer can send, even one victory against them would result in a cash windfall for the ISP concerned.

Re:Who pays for the spam?

[crackshoe]

Wait... something should be handled like the drug war? that highly succesful siphoning off of american tax dollars that accomplishes next to nothing? If it was handled as such, i wouldn't be suprised if spammers starting simply directing minors to do the actual spamming, much like the crack dealers that recruited under-age dealers because they wouldn't get the same jailtime.

you can be sure...

[Roger Keith Barrett]

...than Bob Vila isn't personally involved. Ever watch "This Old House"? The guy never does ANY projects himself. He always passes it off to that other guy! "Hi, I am Bob Vila for Sears Bulk Mail Services. For just $19.95...."

I wonder whose cell would be nicer...

[Toxygen]

...Bob Vila's or Martha Stewart?

FYI: lawsuit homepage...

[Joe Wagner]

Hi All, Just FYI, We will be posting updates to the case as they happen at http://legal.hypertouch.com. We think the CAN-SPAM Act is an open license to spam with very little protection for the public, but we are attempting to use what few protections are available to punish some unrepentant spammers.

One of the biggest problems with CAN-SPAM Act that we are hoping to educate the press so they can inform the public is that the Act says end users _must_ contact each spammer and opt-out. This is of course exactly the opposite of what ISPs have been tell their customers to do. "Opting out" merely gives the spammer have a live address. Some of the email addresses defendants sent spam to were unique addresses submitted to a "virus software 90 % off" spam. In no uncertain terms, "opting out" of spam signs you up for more spam.

We were surprised when even after we told BobVila.com about the quality of the lists their hired spammer was using, they still refused even just to promise they'd never use BlueStream Media again... Right before we filed the action, one of our users received a new BobVila spam, this time sent through a Florida based spammer.