Analysis: Results are mixed after four years under the CAN-SPAM Act.
Grant Gross, IDG News Service
PC World
Monday, March 31, 2008
8:19 AM
When the U.S. Federal Trade Commission announced a US$2.9 million settlement with online marketing firm ValueClick this month, it wasa record monetary settlementunder the 4-year-old CAN-SPAM Act.
That announcement came just days after so-calledspam king Robert Soloway pleaded guiltyin Seattle to a number of criminal charges. Soloway, who faced one count related to CAN-SPAM in addition to mail fraud, wire fraud and other charges, faces up to 26 years in prison.
But despite these recent court cases, some critics don't see a lot of value in CAN-SPAM, short for Controlling the Assault of Non-Solicited Pornography and Marketing.
"CAN-SPAM has had virtually no impact on the spam problem at large," said Ray Everett-Church, a longtime spam fighter and director of policy and professional services at Habeas, a company that provides e-mail authentication services. "It has enabled the FTC to take action against a few bad actors, and that has worked to deter some otherwise legitimate companies from playing fast and loose with the rules."
Butspamis as big a problem as ever, and the worst spammers "remain unfazed and undeterred" by CAN-SPAM, Everett-Church said. Everett-Church and other antispam activists criticize CAN-SPAM for allowing marketers to send unsolicited commercial e-mail until people opt out.
Harvard University technology security officer Scott Bradner called spam prosecutions and settlements "all too rare" in arecent columnat Network World. "To say that the FTC has been careful in its approach to enforcing this act would be misleading -- a better word would be 'lethargic' or maybe 'comatose,'" he wrote.
Officials with the FTC and the U.S. Department of Justice say criminal spam cases can be difficult to investigate because spammers often hide their identities through falsified e-mail headers, offshore servers, and affiliate senders and payment processors. Still, the DOJ has prosecuted about a dozen criminal spam cases in the past four years, and the FTC has taken civil action in 31 CAN-SPAM cases, according to officials at both agencies.
Including cases before CAN-SPAM passed, the FTC has taken action in more than 90 spam cases, involving more than 250 defendants. In addition, CAN-SPAM allows state attorneys general to file lawsuits against spammers, and several have done so.
At the DOJ, CAN-SPAM has helped prosecutors build cases against spammers, and in some cases, the spam charges have led to other charges, DOJ officials said.
Spam Hit Parade
Among the cases: The DOJ in Januaryindicted 11 people, including alleged master spammer Alan Ralsky, accusing them of using a sophisticated and extensive spamming operation that fueled a stock pump-and-dump scheme. The defendants allegedly used spam to tout Chinese penny stocks, driving up the price of the stock and selling it at artificially inflated prices, according to the DOJ.
In June 2007, afederal jury in Phoenix convicted two U.S. menon charges of conspiracy, fraud, money laundering and transportation of obscene materials, in a case in which the defendants were accused of sending pornographic images in millions of pieces of unwanted e-mail. The case, which began as a CAN-SPAM investigation, escalated to include other charges, and the DOJ found that children had received some of the "hardcore" e-mails, a DOJ official said.
CAN-SPAM allowed the DOJ to investigate the defendants for falsifying headers on their e-mail and their domain name registrations, said a DOJ official. That led investigators to find other illegal behavior, she said.
The FTC sees a couple of large benefits from CAN-SPAM, said Lois Greisman, associate director of the FTC's Division of Marketing Practices. The law set the rules for legitimate marketers: Commercial e-mail must have a working opt-out mechanism, must include a valid postal address for the sender, and cannot contain falsified header information or deceptive subject lines, among other rules. CAN-SPAM and FTC rules also require pornographic e-mail to be labeled as such.
CAN-SPAM "set out, in black and white, what the rules of the road are," Greisman said.
In addition, the law gives the FTC the power to seek civil penalties against spammers, authority the agency doesn't have under the FTC Act, the law that prohibits unfair business practices and governs most FTC action. The ValueClick settlement and other large CAN-SPAM settlements should put other spammers on notice, Greisman said.
In November, the FTC announced a $650,000settlement with Adteractive, which sent spam promising free gifts such as Xboxes and television sets. And in January, the FTC announced a $200,000settlement with Member Source Media, which promised free iPods, gift cards and other products in its e-mail messages.
"Our ability to obtain civil penalties there, I think, will have an effective deterrent impact," Greisman said.
The FTC doesn't need additional spam-fighting tools, she said. CAN-SPAM can be used in conjunction with the FTC's other powers, including the ability to seek asset freezes and injunctions in court, Greisman said. "We can walk into federal court, and with the right set of facts, shut down fraudulent operations," Greisman said. "That's a powerful tool." In addition, spam filters are largely working, even if the amount of spam that's sent isn't going down, she said. "It's less the bombardment than it used to be," she said.
Spam By the Numbers
Antispam vendors say CAN-SPAM's had no real impact on the amount of spam being sent, however. In 2003, 35 to 40 percent of all e-mail was spam, and now that number is 80 to 90 percent, said Matt Sergeant, senior antispam technologist at MessageLabs. But at the same time, MessageLabs has gone from blocking about 90 percent of spam to 99 percent, he added.
But CAN-SPAM has provided some benefits, added Eytan Urbas, vice president of products for Mailshell, another antispam vendor. CAN-SPAM created rules for the "good guys" to follow and allowed the prosecution of the "biggest and worst" spammers, he said. "Spam is growing, but I don't blame CAN-SPAM for that," he added.
Many smaller spammers continue to get away with it, however, Urbas said. "In most cases, [spam] is not the highest priority for law enforcement," he added.
And much of the spam in U.S. inboxes comes from outside the country, he said. "It's hard enough to extradite major criminals, or violent criminals, but there's no extradition for spam," he said.