MIT Spam Conference 2006 How Spammers Deal with CAN-Spam: Costa Rica, “microbranding” & 18 USC §2257 Jon Praed Internet Law Group jon.praed(at)i-lawgroup.com

CAN-Spam in a Nutshell Effective January 1, 2004 Criminal and civil penalties Enforced by: –Federal Gov’t (DOJ, FTC & other agencies) –State Attorneys General –ISPs

CAN Spam – Criminal use a computer without authorization to send commercial from or through it use a computer to relay commercial messages falsify headers in commercial Send commercial from falsely registered accounts or domain names, or from zombie IP blocks

CAN Spam - Civil Bans false header information Prohibits deceptive subject lines Requires recipients be able to opt-out Requires that commercial be identified as an advertisement and include the sender's valid physical postal address

CAN Spam Effectiveness 50+ enforcement actions $10s millions in judgments 2 primary effects, reported by the FTC (12/05 Report): –CAN-Spam encouraged adoption of “best practices” by legitimate mailers –CAN-Spam serves as additional tool for law enforcement & ISPs Yet MX Logic reports compliance rates below 5%…

How Have Spammers Reacted to CAN-Spam? Ignore or redouble efforts to evade “Microbrand” to avoid name recognition –Acquire & burn out large IP blocks (20 C’s/mo) –Create shell corporations to disperse complaints –Use PO Boxes for physical addresses Calibrate spam volume to match spam resources Avoid known “Enforcers,” spam everyone else Flee offshore with $/equipment/personnel; but in fleeing they have NOT abandoned U.S. citizenship

Spammers Fleeing U.S. Must Ponder Surrendering U.S. Citizenship U.S. Burdens Obligation to report and pay U.S. taxes federal courts retain power to order US citizens outside the US to submit to discovery (depositions and document production) U.S. Benefits Citizenship elsewhere also has costs Post 9/11 world is dangerous (U.S. taxes pay for U.S. Marines)

CAN Spam Costs Little hard data Google “science” –“CAN Spam compliance costs” produces 18M Google hits –“Spammer caught” produces 534K Google hits Legitimate mailers spend large sums on compliance Enforcers spend large sums on enforcement Non-enforcers may be increasingly victimized

Possible Legal Approaches to Supplement CAN-Spam Custodian of Records Disclosure –Modeled on 18 USC § 2257, which requires “producers” of adult content to obtain proof of age records for all performers, and to disclose the custodian of these records with all displays of the performance –Facial compliance rate on § 2257 disclosures appears extremely high (“18 USC 2257” produces 10 million Google hits; “porn” produces 150 million hits) –Compliance is straightforward and inexpensive –If it’s good enough for porn, it’s probably good enough for spam Do Not Registry –Funding source for law enforcement efforts

How a Custodian of Records Disclosure Requirement Might Work All Bulk Commercial ers would be required to include in their bulk s a disclosure of the custodian possessing records that establish recipients’ consent Sliding Penalties for violations – contains no disclosure = Substantial fine ($100/ ) – contains truthful disclosure of custodian, but custodian lacks valid records of consent = Lesser fine (pennies/ ) – contains false disclosure of custodian = Crime Government & ISP Enforcement in Court Limited Consumer “Notice” Rights (similar to right to see your own credit report) Custodian Disclosure would be placed in X-Headers

Custodian of Records X-Headers X-Custodian of Records Name: X-Custodian Physical Address: X-Custodian Address: X-Custodian Telephone Number:

Key Reasons Why a Custodian of Records Disclosure Might Help Reduce Spam Solicited commercial ers can easily comply with the disclosure requirement; spammers cannot Spammers naturally prefer to hide (they avoid branding); but spammers who disclose no custodian can be easily blocked by filters Spammers who disclose a custodian provide actionable information to consumers who will act en masse on that information Consumers unable to flush out a real custodian through engagement (phone calls and s) would expose the underlying as a crime, and enforcers could easily quantify frequency of each crime via consumer reports Consumers can easily “engage” real custodians in dialog, without need for recourse to courts Spammers who disclose a real custodian will be “engaged” more often than custodians for legitimate mailers (orders of magnitude more often) Spammers operate on such thin margins, they cannot afford to pay custodians to engage frequently, and even when their custodians do engage they will lose the engagement because they lack proper records of consent Spammers face a Hobbesian Dilemma: disclose a false custodian and commit a crime, disclose no custodian and get easily blocked; or disclose a real custodian and face immediate prohibitive costs of “engagement”

Jeremy Jaynes Update 9 year sentence, VA law Convicted by jury 11/04 Spammed AOL 7/03 ROKSO aka Gavin Stubberfield Sentence stayed pending appeal Currently under “house arrest” in Loudoun County, Virginia

Jaynes Appeal Oral argument, March 2006, Virginia state Court of Appeals (3 judge panel) Challenges: 1 st Am. & commerce clause Judge: “spam = bomb in UPS package” Decision likely in 90 days Then appeal to Virginia Supreme Court

Questions? How Spammers Deal with CAN Spam: Costa Rica,“microbranding” & 18 USC §2257 Jon Praed Internet Law Group jon.praed(at)i-lawgroup.com