CAUCE

This Decade in Spam

CAUCE looks back at the notable events of the last decade in our industry.

2000
Y2K is possibly best described as the year the Mail Abuse Protection System got sued. A lot. MAPS, as many will remember, was the preeminent anti-spam blacklist at the time, in use by many major receiving sites, and they took some controversial steps to block some major email senders of the day, who in turn, launched lawsuits to prevent that from happening.

As well, some state and federal laws came up for consideration or were struck down in the United States, Hotmail deployed a 'This is Spam' button, and Ferris Research made a fearless prediction.

2001
2001 was a year fraught with legal wrangling in Washington State, Arizona, the U.S. congress, and the EU, false positives, ORBS operator Alan Brown being sued and threatened with arrest, and a spate of new email viruses.

2002
2002 marks a year when politicians Sean Connery, Bill Jones & Elizabeth Dole used spam to various effect, Ellen Spertus won $4.26 in her suit against a spammer, Joey McNichol was sued for calling someone a spammer in Australia, and Joel Hodgell lost a case and had to pay a spammer's legal fees. The FTC determined that unsubscribing from spam did nothing positive nor negative, Bonded Sender, Habeas, and Cloudmark all launched their services.

2003
2003 was the year of CAN-SPAM, AMEY (AOL, Earthlink, Microsoft & Yahoo!) legal initiatives, the FTC Spam Conference, Scott Richter being sued for spamming, and the Sobig and Blaster viruses.

2004
2004 saw Bill Gates make an infamous prediction, CAN-SPAM came into play and is immediately criticized by those who must enforce it, DomainKeys & Sender ID battle it out in a popularity contest, and Scott Richter appears on The Daily Show with Jon Stewart, debates a spam cop, and goes into the shmata trade. None end well.

2005
2005 saw Scott Richter file bankruptcy to avoid paying fines, Alan Ralsky arrested, and CAN-SPAM evaluated for renovations. AOL gave away gold. Spammer gold.

2006
Spam grows 143% in 2006. Christopher 'Rizler' Smith threatens to kill a witness in his trial, Alan Ralsky partner Daniel Lin pleads guilty. Datran Media settles a lawsuit filed against them over what is called "the largest deliberate breach of Internet privacy discovered by U.S. authorities". Goodmail stuns California  senators, Blue Frog hops off into the sunset, pump & dump is discovered to increase stock prices. Sanford Wallace is fined for distributing spyware, AOL wants to dig up some turf. e360 Insight wins its case against The Spamhaus Project. Australia wins against Wayne Mansfield.

2007
Scott Richter made the news again in 2007, MySpace sued him for phishing and spamming their members. The U.S. Securities and Exchange Commission became active in shutting down pump & dump spamming organizations. Several major companies, including the Bank of America and Pfizer were found to be hosting zombie computers. Physician, heal thyself. New Zealand, Hong Kong and Singapore adopted anti-spam legislation. Robert Soloway was arrested for spamming and a raft of other crimes. Mark Mumma lost his case against Cruise.com and the defendant is awarded $2,500,000 in damages. Jeremy Jaynes appealed his conviction. Xavier Ratelle was the first person charged under the U.S. Safe Web Act.

2008
Alan Ralsky was arrested and charged. His co-conspirators begin testifying against one another. Robert Soloway & Newport Marketing Corporation plead guilty. Jeremy Jaynes' conviction wass overturned on constitutional grounds. Walt Rines and Sanford Wallace are found guilty of spamming MySpace. Eddie Davidson is sentenced to 21 months in a minimum-security prison, escapes, and tragically kills his wife and daughter, before taking his own life. Scott Richter loses a CAN-SPAM case to MySpace. Adam Vitale is found guilty under CAN-SPAM, rounding off his various convictions to 22. Lance Anderson and his gang were charged with spamming under American, Australian, and New Zealand law. American ISPs McColo and Atrivo are shut down, taking down botnets, temporarily. Former Neo-Nazi and 'bum fighting' video empresario Adam Guebuez of Montreal Canada is found guilty under a CAN-SPAM action launched by Facebook. They win a quarter of a billion dollars.

2009
In 2009, Sanford Wallace was sued under CAN-SPAM by Facebook. The BBC controlled a botnet. Canada introduced serious anti-spam legislation, which didn't make it through the legislative process. Alan Ralsky pled guilty and went to prison with his co-conspirators. ISP Pricewert was taken down by the FTC for hosting botnet controllers, MEGA-D takes a hit as a result. Fireye took down the remnants later in the year. Habitat UK spammed Twitter using Iranian election hash tags. James Gordon lost his case against Virtumundo. Herbal King spammers Lance and Shane Atkinson are fined under New Zealand, Australian and American anti-spam law. Vodafone was fined for spamming for Coca-cola. ASIS lost its CAN-SPAM case against AzoogleAds.

#C27 - ECPA, C-27 Finished Second Senate Reading, Referred to Committee

Debates of the Senate (Hansard)

2nd Session, 40th Parliament,
Volume 146, Issue 83

Tuesday, December 15, 2009

Electronic Commerce Protection Bill

Second Reading—Debate Continued

On the Order:

Resuming debate on the motion of the Honourable Senator Oliver, seconded by the Honourable Senator Di Nino, for the second reading of Bill C-27, An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities, and to amend the Canadian Radio-television and Telecommunications Commission Act, the Competition Act, the Personal Information Protection and Electronic Documents Act and the Telecommunications Act.

Hon. Tommy Banks: Honourable senators, even though I have never been in their position, I think I understand the frustration that is sometimes experienced by police officers and other officers of the Crown in enforcing legislation. I know that they intend to do good when they are performing their duties, but it is a question of how we go about it. There is no doubt that this legislation is urgently needed in order to do exactly what it says it will, and I will vote for this bill in principle.

However, as with Bill C-6, there is a question in my mind about how we go about it. Senator Andreychuk referred to this earlier when she was talking about finding that magic balance between the interests of the state and the interests of individuals. Where the fulcrum is placed on that seesaw determines in what kind of country we live. There are countries in which the weight is way over on the side of the interests of the state, which override and sometimes trample on the interests of individuals, and we know of those places. I presume that there must be some place in the world where the interests of individuals trample the interests of the state, although I do not know where that is.

We in this country have always prided ourselves on finding the right place to put that fulcrum and the basis of that fulcrum is the Constitution and the Charter of Rights. We work very hard to ensure that it is placed where there is a reasonable balance, given the circumstances, between the interests of the state, that is, all of us, and the interests of individuals.

I will vote in favour of this bill at second reading because the principle is right and I want it to be sent to committee. However, I again want to point out, as I did with Bill C-6 at second reading, that the committee that studies it, which I presume will be the Transport Committee, should address. I commend senators' attention to page 21 of Bill C-27, which deals with spam.

On page 21, clause 19(1) says:

On an ex parte application, a justice of the peace may issue a warrant authorizing a person who is designated for the purpose of this section . . .

I presume that is designated by the minister.

We expect that police officers can get warrants to go into people's houses, and under Bill C-6, we now expect inspectors to be able to do that also. We know that Fisheries officers, game wardens and certain other people can as well. Those are people who we presume, by virtue of their title and appellation, have some knowledge, experience and training with respect to exercising constabulary powers. This is a constabulary power, but the bill just says a "person who is designated for the purpose of this section" can be authorized to get a warrant to go into anyone's house. This does not refer to a police officer, a peace officer, a game warden, a Fisheries officer or anyone with experience, but just a person — a telephone operator, a plumber or any person without designation.

It goes on to say that that person can ask to obtain from a justice a warrant, "to enter a place if the justice is satisfied by information on oath that," — and then we see the conditions for the issuance of a warrant to go into a house.

I draw to your attention that there is nothing in this clause that talks about a reasonable suspicion that something wrong is being done in that house. There is no suggestion that this person has to satisfy the justice that he or she thinks that there is something in that house that is in contravention of this act or some act, or that breaks some law or that violates something. It is just for the purpose of entry into a place that is necessary to verify compliance with this act. The person says to the justice, "I want to go into that house to see whether there is compliance with this act." He or she need not think there is not; he or she needs simply to want to have a look to determine whether any of sections 6 to 9 have been contravened. They need not think that any of sections 6 to 9 may have been contravened and reveal why they think so. They need only to want to go into that house and check whether those sections have been contravened, regardless of what else they might find. This is fishing. This is a legalized fishing expedition.

For that reason, as I said with respect to Bill C-6, which was the same except that this is more egregious, if we were to pass this bill, which is urgently necessary, without amending this clause of the bill, it will find its way to a court, and a court will say that this is contrary to the charter and the Constitution.

I call that to the attention of senators who will serve on the committee to which this bill will be sent. I hope they will pay particular attention to that clause.

The Hon. the Speaker: Are honourable senators ready for the question?

An Hon. Senator: Question.

The Hon. the Speaker: It was moved by the Honourable Senator Oliver, seconded by the Honourable Senator Di Nino, that Bill C-27 be read the second time.

Is it your pleasure, honourable senators, to adopt the motion?

(Motion agreed to and bill read second time.)

Referred to Committee

The Hon. the Speaker: Honourable senators, when shall this bill be read the third time?

(On motion of Senator Comeau, bill referred to the Standing Senate Committee on Transport and Communications.)

#C27 - ECPA, C-27 Given Second Reading & Debate continues December 11

Electronic Commerce Protection Bill

Second Reading—Debate Continued

On the Order:

Resuming debate on the motion of the Honourable Senator Oliver, seconded by the Honourable Senator Di Nino, for the second reading of Bill C-27, An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities, and to amend the Canadian Radio-television and Telecommunications Commission Act, the Competition Act, the Personal Information Protection and Electronic Documents Act and the Telecommunications Act.

Hon. Grant Mitchell: Honourable senators, I rise to speak on Bill C-27, the spam bill. I will say before I start that I listened with great interest to the HST debate, and I am sure that I reflect broadly the sentiment in this house that the quality of debate distinguishes the Senate. I congratulate each of the members who debated.

Not by way of criticism but simply by way of correcting the record, I point out that the debate not once addressed the HST in Alberta, and I should say, on behalf of Albertans and Alberta, that the harmonization of the tax in Alberta caused absolutely no problem whatsoever. It was done without a ripple; if only all the other provinces could follow that example.

With respect to the spam bill, before anyone begins to yell at me, I want to say that I agree with the bill in principle. I look forward to having it discussed in committee. The spam bill is a good bill in principle, absolutely and fundamentally. We all know about spam. We have all heard of spam. There are many kinds of spam. We know that it is a tremendous waste of productivity. We know that it is a hindrance to effective business. We know that it is fundamentally a nuisance, a problem for us as individuals, and we know it must be dealt with.

It is interesting to note that Canada is one of the few industrialized nations that is without anti-spam legislation and it is interesting to note, unfortunately, that we have gained a reputation somewhat as being a haven for spammers. This legislation is past due. This bill needs to be dealt with and we have to fix the problems.

I point out that there is a good deal of bipartisan, all-party collaboration on this issue. Of course, it has been passed in the house after intense but positive debate — learned debate, I believe — and it has been championed in this house both by Senator Donald Oliver of the Conservative caucus and by our former colleague, Senator Goldstein, both of whom had presented private members' bills.

I will put one small partisan plug in to say that the process of reform for bringing in legislation was started with a task force established by the Liberal government in 2004. Again, in the spirit of cooperation and collaboration in this environment that is sometimes maligned, the government has picked up on much of that work and has brought in a piece of legislation that is an important step.

Let me list briefly what the bill will do, but first let me point out that there are a couple of forms of spam, at least, which were clarified for me. Most of us see spam as those unwanted emails that we receive over and over again, and that the classic view of spam and that was my view.

However, it turns out of course that there can be spammed programs — software — that can be downloaded without consent and that can be extremely dangerous. Often, we refer to those programs as viruses. We have them all the way from inconvenient and a nuisance, to extremely dangerous and damaging, with huge consequences both to personal files and to commercial enterprise.

What does the bill accomplish? As was suggested by the definition of the problem, the bill prevents the downloading of software without consent but it wisely, because an amendment was made, excludes automatic updates to software that one has chosen to download already to their computer. Often that is the case: The software is updated and users want the update. These updates will be excluded.

The bill also prohibits electronic commercial messages, commercial emails and that kind of thing that one can receive at this point without consent; without direct consent or implied consent. Clearly, it is important that we differentiate, that we allow for implied consent in the way that businesses operate. We do not want to impede the ability of businesses to deal with their clients or their prospective clients.

Interestingly, it also prohibits companies from taking personal information without consent. It is important from a privacy point of view and, as we work our way through this area of communications on the Internet, on the web, privacy remains an important issue. Step by step, we have to plug the holes and fix the problems.

This bill is distinguished by the fact that it uses a regulatory approach for implementation rather than some kind of criminal approach. I suppose it can become criminal in certain areas, but basically the approach is a regulatory approach that is coordinated through the Canadian Radio-television and Telecommunications Commission, CRTC, the Office of the Privacy Commissioner and the Competition Bureau; all three are good choices for having responsibility and application to the supervision of this process.

This bill is also serious about dealing with infractions. First, it provides for fines of up to $1 million for any individual who spams, and it also provides for up to $10 million in fines for any company that spams.

I can see Senator Mockler wondering, if he receives a Liberal email, is that spam? I do not know, but I can answer the other way: It is continuing education. If I receive an email from the Conservatives, it might not be spam, but it would be wrong.

Sorry, I am trying to rise above that. Merry Christmas.

The other thing the bill includes is a private right of action provision that will allow consumers, businesses and Internet service providers to take civil actions against violators. I think that provision is all good. It hits the highlights of the problem. It has a structure for administration. It has a structure for penalties to make people focus on the seriousness of these potential problems. It is a 21st century bill and it is good.

Now, right to that point; there is one slight problem. I should not say the problem is slight. It is significant and I know it has been debated, and Senator Oliver has given me assurance that it is being considered.

The problem is this: The bill is sweeping. As you might imagine, it is difficult to structure a spam bill in the environment we are in. That is to say, things are emerging and changing. The Internet, the web, is expanding so dramatically and so quickly and communications are shifting from what we have seen as traditional ways of advertising and communicating, often on paper or on TV, to this remarkable place that many of us have yet to understand: the Internet, the web, the ether.

It is understandable that we would have a broad approach to this bill as a first crack at it. However, there is a single problem that I think we have to address in particular. That problem was raised with me and others by Research in Montion, the BlackBerry people, because it inhibits a company like RIM from responding quickly to a spam virus attack — an attack that could crush their system or parts of their system.

Normally, when immediately faced with a threat, the menace of a virus, a viral attack on their system, RIM has been able to go out into that structure, into that process, and seek out the location, the origination of that attack. The privacy requirements in this bill and the privacy provisions make it difficult for them to react quickly. The company might be able to react, but I think they would have to have certain kinds of provisions to react. It is difficult to find the balance. We are having the same debate on Bill C-6. However, that problem must be looked at and we must discover a way that a company like RIM is not vulnerable to attacks that can be devastating. To this point, they have been able to defend themselves because they have had mechanisms but those mechanisms might be threatened by this particular piece of legislation.

Honourable senators, I do not know exactly what steps will be taken in a concrete way to fix the problem, but of course committee debate and discussion will be a place where the problem can be considered, and I am sure it will be.

The second point is that a couple of questions arise out of this legislation. I am sure government has thought about the questions and perhaps there are specific answers. If not, I expect we will see some of them in future budgets, et cetera. There is the question, of course, of resources for enforcing the provisions of this bill. It is not as though the CRTC has extra money, the Competition Bureau has too much money or the Privacy Commissioner has extra money, and yet they will be given this tremendous responsibility.

To point out an example of this kind of problem, we need only look to the Do Not Call Registry, which receives about 20,000 complaints a month to the CRTC. However, since the inception of that program, the CRTC, faced with 20,000 complaints a month, has issued only about 70 warning letters. Those numbers underline the magnitude of these issues, and they raise the question of what the resources will be and how we can implement this legislation effectively.

The second matter similar in its implications is that the legislation provides for creating a national coordinating body that, according to the Industry Canada website "will synchronize public education and awareness,, track and analyze statistics and trends, and lead policy oversight and coordination."

That sounds like something we need in climate change, it dawns on me — but not to distract. Of course, we can see why that might be the case. There are implications for both levels, provincial and federal, I am sure, in the application of this kind of legislation; policing forces, information-gathering systems, et cetera. There needs to be coordination.

Again, how will this be structured? Where will it be placed? What kind of money will it have? What kind of resources?

Finally, this is a question of the evolution of the administration of this act; there will be huge implications also for international communication and coordination. Often spam comes from other countries. Therefore, it is necessary to coordinate with those other countries in what they are doing to help us and vice versa in any given case or any given policy development matter. The CRTC, the Office of the Privacy Commissioner and the Competition Bureau will need to have the resources and personnel to focus on that relationship and make that relationship work.

I look forward to the next step, discussing the bill in committee and making it perfect.

Hon. Percy E. Downe: I appreciate the honourable senator's comments on the proposed bill and his comments about the Do Not Call List. He highlighted but skimmed over some of the problems the CRTC is having with the Do Not Call List. My information is that the CRTC, to date, has received over 700 complaints, they have filed nine fines, and the companies are refusing to pay the fines. There is, in effect, no enforcement.

Despite having registered on the Do Not Call List, many people are receiving more calls. Some people who registered their cell phones and were getting no calls before are now getting calls. The CRTC recently issued a request for proposal to hire a contractor to carry out investigations of the Do Not Call List. It then abandoned the request. Why would we have any confidence in the ability of the CRTC to monitor this spam bill if they cannot do it with the Do Not Call List?

Senator Mitchell: I am glad the honourable senator did not call me about that. Senator Downe is emphasizing the point that I was trying to make. While I want to remain optimistic, the question arises: Will there be the resources for this policy to be implemented properly? Clearly the CRTC example to this point with the Do Not Call List is an issue.

The second issue is how you go about — once you go through the process of getting a fine allocated or penalty levied on an individual or company — determining who will take responsibility for that next step? I am not a lawyer, but I expect there is some legal process to go through to follow up and collect it.

I agree with the honourable senator. That is a problem.

Senator Downe: I have a further question. I constantly receive emails from very kind people in Nigeria who want to assist me financially if I would only send them my banking and other personal information. Senator Mitchell indicated his concern about resources. I am more concerned about enforcement.

How will the government prevent foreign countries, and companies operating in those countries, from continuing to send spam to Canadians? Will we enforce the law on providers and servers in Canada? Will they be fined? Does the honourable senator have any information on that?

Senator Mitchell: No. There are probably experts with ideas about that, and we should call some of them to the committee. I will tell honourable senators that my impression is that, of course, there will be spam coming from an infinite number of places, many of which one could not find in time to fix it.

One of the responsibilities for the national coordinating body is it would coordinate public education and awareness efforts. To some extent, those kinds of issues that Senator Downe raises — and we all have received unsolicited mail — beg the question of how one responds and understanding what it means and what its consequences are. The best way to do that is to arm citizens, and public education and awareness would be one step towards that.

Senator Downe: I hope the committee members would be very careful, given the donnybrook we have with the CRTC and the Do Not Call List.

The CRTC, for example, holds hearings in secret. Canadians are not aware of which companies are under investigation. The CRTC will only release that information if, after the company is fined, they refuse to pay. There is no transparency, no openness, and no protection for Canadians. There is no sense of duplicating our problems with the Do Not Call List with the spam bill and I hope, as a member of the committee, the honourable senator will keep that in mind.

Senator Mitchell: Will do. Thanks.

Hon. Jane Cordy: I thank the honourable senator for the excellent speech. I agree with the comments that the committee must look carefully at this bill. Sometimes what looks very simple can have negative consequences that the drafters of the bill had never intended. It is very important that the members of the committee look extremely closely to ensure that, whatever happens to it, it is the best bill that it can be for Canadians.

At many NATO meetings I have attended, the country of Estonia was concerned about the cyberterrorism that happened to them. They believe that this terrorism came from Russia in an effort to make them a little more subservient. When this happened, the whole banking and economic systems within the country of Estonia were brought to a standstill because none of the computers in the country would work due to the spam that they believed came from Russia.

Will this bill address those kinds of things? Will Canada be safe from that type of thing? Hopefully it would never happen, but certainly the possibility is always there. Is that something the bill would look at?

Senator Mitchell: I think we see, from the nature of these questions, the breadth of the interest amongst us. I think that is probably reflective of Canadians generally.

The bill would facilitate dealing with spam, but it comes back to the question of resources. In relation to Senator Cordy's point about cyberterrorism and its implications, is the CRTC equipped to combat such actions? Is the Privacy Commissioner equipped to do that? Who is equipped to do that? There may need to be more brought into this process.

It is important to raise that kind of question before the committee as well. One would hope that there are agencies right now working on that kind of thing, and we need to find out if this bill would facilitate or hamper them.

Hon. Donald H. Oliver: I had a point of clarification. When the honourable senator made his presentation and was talking about the Do Not Call List, as I heard him, he said that there were 20,000 complaints a month. He said there were only seven letters that came from it.

Is the honourable senator saying, therefore, that the only reason for the seven letters is that they did not have enough resources? Was that the point? Is there any evidence to that effect?

Senator Mitchell: It was 70 letters. It is not a big difference, I know. My point is that it certainly raises the question of whether they have resources. I do not know that they do not. Maybe there were only 70 that they had to act on, but it seems to me that there probably is a resource issue. I am just asking the question.

Senator Oliver: It may not be a resource issue.

Senator Mitchell: It may not be, but I think the question needs to be asked. I would bet it is. Do you want to bet?

(On motion of Senator Tardif, debate adjourned.)

#C27 - ECPA, C-27 Given Second Reading in the Canadian Senate

Electronic Commerce Protection Bill

Second Reading—Debate Adjourned

Hon. Donald H. Oliver moved second reading of Bill C-27, An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities, and to amend the Canadian Radio-television and Telecommunications Commission Act, the Competition Act, the Personal Information Protection and Electronic Documents Act and the Telecommunications Act.

He said: Honourable senators, I am pleased to rise in my place today to begin second reading debate on Bill C-27, the electronic commerce protection act. I have actively supported a stand-alone piece of legislation to combat spam for some six years. I have introduced, on separate occasions, two private member's bills in this place in pursuit of my goal to prevent unsolicited messages on the Internet, so I take much personal satisfaction in seeing this bill come from the other place where its principles enjoyed widespread support.

Some honourable senators may recall that in February 2005, when I spoke in this chamber on Bill S-15, I quoted Bill Gates. He had pointed out that spam had become more than an annoyance; it exposed families and children to pornography and fraudulent content, and it cost businesses millions of dollars a year.

I also reminded this chamber of what was then a new phenomenon called "phishing;" emails in which someone falsely claimed to be a legitimate enterprise in an attempt to scam the user into providing private information that could be used for identity theft.

Today, the problems associated with spam have become even worse. Some of the most malicious forms of spam include "Trojan horses" and other "malware" that gives others control over one's computer, turning it into what has been called a "zombie computer." By remotely controlling these zombies, spammers spread further emails.

It is little wonder, then, that the volume of spam continues to grow. Unsolicited emails represent between 80 per cent and 90 per cent of email traffic around the world. It is estimated that last year, a total of 62 trillion spam emails were sent.

A poll in 2007 found that Canadians received an average of 130 spam messages each week. That number was up 51 per cent from the previous year. I am sure that we can provide our own anecdotal evidence that the amount of spam continues to grow. In April 2008, an EKOS survey showed that 72 per cent of Canadians considered spam to be a major problem.

Honourable senators, when spam is used in these ways, it undermines the trust that businesses and consumers have in the digital world. As I have pointed out in this chamber before, spam is a serious threat to the great promise of the Internet for individuals, for businesses, for governments and for society at large.

The last time I brought forward an anti-spam bill, some industry stakeholders argued that Canada did not need a piece of stand-alone legislation. Some thought that all Canada required was more public awareness so that consumers could stop buying from spammers.

Honourable senators, this was a weak argument then. It is even weaker now, at a time when we want to encourage trust and confidence in the digital economy. We want consumers to know that the Government of Canada is on guard against those who would use email for malicious and fraudulent purposes.

In fact, the bill before us represents part of the Government of Canada's broad-based efforts to foster more electronic commerce in Canada and put us at the forefront of the digital economy. The Government of Canada has begun consultations on ways to modernize the Copyright Act. It also intends to table amendments to the Personal Information Protection and Electronic Documents Act, PIPEDA.

In the years that have passed since I introduced my first piece of anti-spam legislation, the government has marshalled the forces necessary to win the war against spam. We have the findings, for example, of the 2005 report of the Task Force on Spam that called for strong legislation against spam. Honourable senators, I had an opportunity to appear on two occasions before that task force. On each occasion, I was asked to bring forward arguments to try to persuade them that we did need a stand-alone piece of legislation. I was successful in that.

We continue to learn from the experience of other countries in constructing and applying their anti-spam regimes. For example, we saw how the legislation in Australia was very effective in cutting down the amount of spam-based pornography and the impact that the private right of action had in curtailing phishing and other forms of spam in the United States.

Honourable senators, I believe that the bill before us has benefited from study by the Standing Committee on Industry, Science and Technology in the other place and will capture the intent of both Senator Goldstein's and my efforts with our private members' bills. It is a long awaited measure that will put in place many of the recommendations of the Task Force on Spam. We will finally have legislation that will put an end to Canada's reputation as a place where spammers can flourish.

Bill C-27 prohibits the sending of unsolicited commercial electronic messages; the use of false and misleading representations online, including websites and addresses; the use of computer systems to collect electronic addresses without consent; the unauthorized altering of transmission data; the installation of computer programs without consent; and the unauthorized access to a computer system to collect personal information without consent.

Much of the strength of the bill before us comes from the enforcement regime. Honourable senators may recall that I pointed to the enforcement challenges when speaking on my original bill. I was pleased to see that the bill before us not only outlines the various responsibilities of the CRTC, the Competition Bureau and the Privacy Commissioner, but it enables these bodies to work together and with their international counterparts.

For example, the CRTC will enforce the provisions against sending unsolicited commercial messages and will have responsibility for the provisions that prohibit the altering of transmission data without authorization. It will further prohibit the surreptitious installation of programs on computer systems and networks by requiring consent for the installation of all computer programs. In this way, we can help stem the flow of malicious computer programs such as spyware and keyloggers.

Bill C-27 gives the Competition Bureau a mandate to address false and misleading representations online and deceptive marketplace practices such as false headers and website content.

The Office of the Privacy Commissioner has responsibilities to protect personal information in Canada. Bill C-27 prohibits the collection of personal information without consent through unauthorized access to computer systems and the unauthorized compiling or supplying of lists of electronic addresses.

Honourable senators, the bill provides the CRTC with administrative monetary penalties, AMPS, of up to $1 million per violation for individuals and up to $10 million for businesses. The Competition Bureau will also administer AMPS under the current AMPS regime in the Competition Act of up to $750,000 for individuals with $1 million for subsequent violations and up to $10 million for businesses with $15 million per subsequent violation.

Bill C-27 also provides a private right of action in which individuals and businesses may pursue actions against spammers in the civil courts. For example, it would permit an online retailer that was a victim of a denial of service attack to pursue both the persons who conducted the attack and the persons who paid for and directed the attack to recoup the actual business losses incurred and, in appropriate circumstances, obtain statutory damages.

As we introduce these provisions to protect the interests of consumers against spam, we must also take care not to restrict the legitimate use of emails for commerce. I will speak to some of those specifics of the bill later.

Clause 6 of Bill C-27 prohibits the sending of unsolicited commercial electronic messages, commonly referred to as spam. The consent regime to allow for the sending of commercial electronic messages is based on an "opt-in" regime that stipulates no electronic message can be spent without the individual opting in by way of express consent or at least implied consent.

Implied consent arises where there is an existing business relationship or an existing non-business relationship. Implied consent covers situations where intended use or disclosure is obvious from the context and the organizations can assume, with little or no risk, that the individual is aware of and consents to the reception of the commercial electronic message. This implied consent can be used within a 24-month period unless, of course, the individual has opted out of receiving messages.

There is a time-limited exemption for those existing businesses and non-business relationships that are in effect prior to the act coming into force. These are covered in what is called the transitional or grandfather clauses found in clause 63.1 of the bill. They extend the implied consent regime for a period of 36 months — which I think is a long time — to allow commercial entities time to contact existing clients and obtain their express consent for future communications.

The act also permits implied consent to be used in the case where there has been conspicuous publication of an electronic address, such as on a website or in a print advertisement. In these circumstances, the sender's message must be relevant to the person's business, role, functions or duties in a business or official capacity.

Honourable senators, there is a clause that clarifies that in the instance of the sale of a business, the purchaser is deemed to have an existing business relationship with the seller's clientele.

In these ways, we cut down unsolicited email, but we leave the electronic avenues open for legitimate commerce.

Honourable senators, transmission data relates to the telecommunications functions of dialling, routing, addressing or signalling a message. Clause 7 of Bill C-27 prohibits the unauthorized alteration of transmission data. This forbids any person from changing the transmission data of any message that would cause the message to be delivered to a destination other than or in addition to that requested by the sender, unless the alteration is made with the express consent of the sender or in accordance with a court order.

This clause prohibits persons from accessing networks in order to alter transmission data. This addresses, among other things, the issue of "pharming" whereby violators intentionally alter the transmission data to redirect unsuspecting Internet users to false websites or caller ID spoofing, where individuals alter the caller ID in an attempt to identify themselves as a trusted source, such as a financial institution.

(1600)

Clause 8 of the bill prohibits the unauthorized installation of a computer program on another person's computer system which causes an electronic message to be sent from the computer system, unless the express consent of the owner or authorized user of the computer system has already been acquired.

This clause is designed to address the installation of malicious computer programs, which include malicious software, viruses and spyware, as these programs are often a precursor to more malicious online activity. The clause also prohibits the further use of the computer program installed to send out electronic messages without consent, as a computer infected with a virus can be remotely controlled. It should be noted, honourable senators, that the majority of spam is currently sent through virus-infected computers.

Another issue addressed by this provision is something called a denial of service attack, which is also conducted through remotely controlled computers. Denial of service attacks are attempts to keep a server, a network or a website down by flooding it with a whole series of unwanted traffic.

Express consent is always required in order to install a new computer program, with certain exceptions allowing for automatic updates or upgrades. This bill contains provisions to ensure, for example, that automatic upgrades to antivirus software will not be treated as spam under the law. This means that running some applets such as JavaScript and Flash programs will not require express consent every time these programs are run. Other limited exceptions are also defined.

The Competition Act amendments add violations respecting misleading and deceptive representation in online commercial messaging, including false headers, subject lines, websites and electronic addresses. These new prohibitions are designed to allow the Competition Bureau to better address aspects that relate to unfair and deceptive market practices.

The amendments to PIPEDA contained in clause 78 of the bill address the unauthorized collection of electronic addresses, commonly referred to as address harvesting, and the collection of personal information without consent by way of unauthorized access to a computer system. Address harvesting is the collection of bulk lists of email addresses by automated means.

The second amendment is meant to protect personal information stored on commercial or corporate computer systems from unauthorized collection. While clause 8 of the bill addresses unauthorized installation of computer programs, this clause addresses the subsequent use of such software to collect personal information about the computer users themselves.

Honourable senators, I believe this bill strikes the balance required to encourage the digital economy to flourish based on innovation on the part of legitimate businesses and confidence on the part of consumers.

I have said in this chamber many times that Canada has been one of the few industrialized countries that did not have a regulatory regime to control spam. Today, I am pleased, excited and proud to see that this lack of protection for businesses and consumers will soon be at an end. I urge all honourable senators to join me in supporting the principle of this significant piece of legislation.

(On motion of Senator Tardif, debate adjourned.)