CAUCE

Virginia Court Overturns anti-spam law

On Friday the Virginia Supreme Court threw out the state's anti-spam law, and with it the 2004 conviction of large-scale spammer Jeremy Jaynes, on the grounds of First Amendment overbreadth. While not disagreeing that Jaynes was guilty as charged and convicted, they found that the law could place too great a burden on non-commercial speech. CAUCE president John Levine commented in this blog entry.

While CAUCE is dismayed at this outcome, we see little practical effect beyond this single case. This case predates the Federal CAN SPAM law, which does not have the First Amendment issues of the Virginia law, which would clearly apply if Jaynes were to do the same things today he did in 2003. Nor do the other state anti-spam laws have similar overbreadth issues. CAUCE believes that it is possible to create more effective anti-spam laws than the weak CAN SPAM without running afoul of First Amendment issues and will continue to work to help pass them.

ACLU, Anti-Spam Laws, and the First Amendment

by J.D. Falk

In an article published by the Technology Liberation Front, Cato Institute adjunct scholar Tim Lee dissects a recent argument by the American Civil Liberties Union regarding free speech & anti-spam laws.

It's been interesting to watch the ACLU wrestle with anti-spam legislation. Their entire purpose is to work through the legal system to protect our civil rights, as defined in the First Amendment -- which is why I've been a card-carrying member since before I was old enough to vote -- so of course they're going to push back against any perceived abridgment of the right to free speech, including anonymous speech.

Yet as Tim Lee argues, the amount of speech afforded to spammers before they run afoul of the Virginia statue is enormous: "someone may (a) send out an unlimited number of emails using a real email address, (b) send out 9999 emails per day (99,999 per month, 999,999 per year) while falsifying email headers, or (c) send out an unlimited number of emails with falsified addresses to people who have previously consented to receive them." In order to violate this Virginia statute, you have to be very bad. In order to violate CAN-SPAM & get even more federal attention, you have to be even worse.

Anyone with a real need for free, anonymous speech will have a myriad of other, simpler, and very likely cheaper avenues available to them -- including, unfortunately, sending 9999 forged, unsolicited emails each & every day.

US Senate Approves Bill to Dramatically Improve Cyber-Crime Laws

The Washington Post reports that the U.S. Senate has passed legislation that would allow law enforcement to go after a much larger percentage of modern online crime. Specifically, it will:

• remove the requirement that each affected individual must have suffered at least $5,000 in damages
• "make it a felony to install spyware or keystroke-monitoring programs on 10 or more computers regardless of the amount of damage caused"
• give identity theft victims the ability to seek restitution
• criminalize attempts to extort companies by threatening to publish stolen information

These provisions were added to an unrelated bill, the Former Vice President Protection Act, which must next be voted on by the House of Representatives before it becomes law. CAUCE is very pleased that the Senate has taken this action to protect people living within the United States, and particularly support the provisions adding a private right of action against the criminals who prey upon all of us daily.

Eddie Davidson

When doing a job that you love it is natural enough to immerse oneself, to become somewhat myopic, about the relative importance and meaning of one's work, but every once in a while context is thrust forward, rending fantasy and reverie aside, leaving one faced with a reality of what really matters.

Such are the sad events surrounding the murder-suicide that ended convicted spammer Eddie Davidson's life today. For further details on the situation, please follow this link.

CAUCE extends our sympathies to the friends and families of the victims of this needless tragedy.

Changes to the CAUCE North America Leadership

It is with regret that we note that CAUCE founder Scott Hazen Mueller has resigned his position as President of CAUCE North America. We are happy to note Scott will maintain his position on the iCAUCE (international CAUCE) board, as well as the CAUCE North America board in the position of Founder and Director, emeritus.

As well, while John Levine plans to move to England in the early fall, he has agreed to remain on the executive board and he will become President effective immediately.

Lastly, Dennis Dayman has graciously accepted the position of Secretary-Treasurer and was confirmed as such by unanimous vote. Congratulations, Dennis, and thank you Scott for your years of service.

FBI and Romanian police break two phishing rings

In a press release today, the FBI said that in cooperation with the Romanian Prosecutor General they'd arrested 38 people who'd been running phishing rings. According to the FBI, the people arrested had sent out millions of phishing spam messages which tricked recipients into providing personal financial details.

Romania has for many years been a major source of criminal spam, and it is encouraging to hear that the Romanian authorities are cracking down on it.

CAUCE joins in anti-spyware amicus brief

In a friend-of-the-court brief filed today, CAUCE joins the Center for Democracy and Technology to argue that anti-spyware vendors should be protected by the liability protections afforded other filtering companies under the Communications Decency Act. CAUCE joined a broad spectrum of Internet and technology industry groups, public interest organizations, civil liberties groups and individual companies that are all committed to the proposition that users should be empowered to control their own Internet experiences. The brief urges the court to protect anti-spyware vendors from liability in cases brought to intimidate anti-spyware vendors into ignoring spyware.

Amicus Brief [PDF].

Colorado has a new spam law

CAUCE director John Levine notes:
The governor of Colorado recently signed a new anti-spam law into effect. Since CAN SPAM draws a tight line around what states can do, this law is mostly interesting for the way that it pushes as firmly against that line as it can.

Read the rest of his comments on his blog.

If it spams like a duck...

by J.D. Falk

"Plaintiff e360Insight, LLC is a marketer. It refers to itself as an Internet marketing company. Some, perhaps even a majority of people in this country, would call it a spammer. e360 sends e-mail solicitations and advertisements, for a fee, to millions of e-mail users. More than a few of those users are subscribers to Comcast, an Internet service provider. Many e-mail users do not want to see (or delete unread) the messages sent by e360. Even if every user wanted these e-mails, Comcast might well have its network overloaded by the mailings."

-- Judge James B. Zagel, e360Insight, LLC vs. Comcast Corporation,
Memorandum Opinion and Order filed April 10, 2008

We've been wondering what e360 hoped to gain with their recent lawsuits against Spamhaus and others. If they were trying to clarify the right of ISPs to protect their users from spam, then they've certainly done a good job -- especially in this particular case.

If it wasn't clear before, Judge Zagel's explanation should satisfy even the most pedantic of filtering opponents:

1. ISPs acting in good faith to protect their customers are not liable for blocking messages that some spammer claims are not spam
2. "...compliance with CAN-SPAM...does not evict the right of the provider to make its own good faith judgement to block mailings."
3. an ISP rejecting messages, during the SMTP session, that a spammer knowingly sent to them, does not constitute a "denial of service" attack against the spammer
4. saying "hey, you let those other spams through, why not me?" is just dumb (that's my interpretation, of course; the judge used more polite language)

It's statement #2 above -- the one about CAN-SPAM -- which will have the most direct and immediate effect on companies who try to walk the edge between spam and legitimacy. Complying with CAN-SPAM is the bare minimum required by law; as the courts have stated before any sender has to do a lot more to get their mail delivered into other peoples' inboxes.

Unfortunately, this case won't affect most spam. The near-unbelievable volume of messages sent every day are sent by individuals who don't even pretend to comply with any law, and who know that if they ever tried to file suit against Spamhaus or Comcast or anyone else they'd be laughed out of court -- and most likely arrested.

Even so, CAUCE thanks e360, Comcast, and Judge Zagel for providing us with a good laugh and a small ray of hope in the fight against spam.

Stay tuned for the results of Comcast's counter-suit against e360.

CAUCE in the News

John Levine is quoted in this recient article in the Seattle Post-Intelligencer, discussing recient spikes in fake drug spam being sent from hijacked computers.  

Read the full story here: Two major spam cases end up in Seattle.