US wants to let spammees sue spammers

US Senator Chuck Shumer wants to let victims of spam sue the spammers in his proposed anti-spam bill (Stop Pornography and Abusive Marketing Act), which joins around half a dozen others in the US Congress.

Shumer, the New York Senator who isn't Hilary Clinton, is regarded as left wing but has allied with the Christian Coalition to get his SPAM Act through. A key provision is that unsolicited commercial email include 'ADV', for advertisement, in the subject line.

But the bill has been criticised because some industry groups, such as the Direct Marketing Association, could qualify for a loophole that would permit them to send bulk emails without the 'ADV'.

It has also been criticized because it could endanger legitimate Internet services such as "anonymous remailers" and would give marketers access to the complete do-not-spam list.

At a press conference on Capitol Hill on Thursday, Schumer stressed that pornographic spam was piling up in email in-boxes so quickly that prompt action by Congress was necessary.

"The avalanche of pornography being sent to kids by spammers makes checking email on par with watching an X-rated movie," Schumer said in a statement. "America's children have been under attack for a long time, from violent TV shows, racy music videos and now pornographic spam. The V-chip gave parents control of the TV. My SPAM Act will give them control over the computer."

Schumer's efforts come as Congress is facing a deluge of anti-spam bills. In April, Montana Senator Conrad Burns introduced his anti-spam bill, and key House Republicans are backing a bill that promises to slap the worst bulk emailers with prison terms and millions of dollars in fines.

Representative Zoe Lofgren of California has a bill that pushes ADV tags, but without a do-not-spam registry. On Wednesday, the Federal Trade Commission announced its own plan to turn its investigators into spam cops. Ohio Senator Mark Dayton has also proposed a do-not-spam list.

Schumer's bill, however, is the only proposal so far in Congress that would let any "recipient adversely affected by a violation of this act" bring a lawsuit in state court that would recover statutory damages of up to $1,000 per email message. Internet service providers would be immune from such lawsuits, and class action suits would not be permitted.

For Schumer, the fight against spam has become personal. He told a conference in Washington recently that his 14-year-old daughter was inundated with spam promoting pornographic Web sites

Ray Everett-Church, a privacy consultant at ePrivacyGroup.com and a board member of the Coalition Against Unsolicited Commercial Email, said Schumer's bill is probably the most promising so far but added that a successful do-not-spam list will be tricky. According to the SPAM Act, the FTC is required to create the registry and hand copies of it "to marketers for the purpose of complying."

"How do you give marketers access to the list without the list falling into the wrong hands?" Everett-Church said. "That's going to require enormous resources and security requirements. If that list falls into the wrong hands, it would be an extremely valuable list... There are a lot of practical management and security issues that would have to be addressed before people would trust a do-not-spam list."

The SPAM Act says that the FTC has six months to "issue regulations for establishing and maintaining the registry, providing secure distribution of the registry to marketers for the purpose of complying with this section, protecting the registry from unauthorized use, and enforcing the provisions of this section."

A second problem, Everett-Church said, is that the bill would regulate specific technologies, and underlying protocols or standards may change. "Laws should focus on what is the harmful thing that's being done," Everett-Church said. "In the case of spam, it's a really a question of cost-shifting from the sender to the recipient. If there were a law against shifting the cost of advertising onto the recipients, then you could go after junk faxes, spam and (wireless) spam."

For instance, Schumer's bill only regulates spam sent to email addresses with "domain names" after the @ sign. But the Internet standard for email (RFC 822) permits numeric Internet addresses--also called domain-literals--to be used in messages. That means an email sent to recipient@example.com would be regulated, but one sent to the same address at recipient@[192.0.34.166] would not be.

Roger Dingledine, a cryptographer and founder of Moria Research Labs, said the wording of Schumer's bill is so broad that it could imperil "anonymous remailers."

An anonymous remailer is typically a free Internet service that strips off information identifying the sender of an email message and forwards it to the recipient anonymously.

Remailers have been harshly criticized by governments in the past, but their supporters point out that anonymity can be of use to whistle-blowers, human rights activists and people living under repressive regimes.

The SPAM Act would also permit parents to register their child's address for a special do-not-spam list, restrict spambots that crawl Web sites looking for addresses and require the FTC to let certain industry "self-regulatory organizations" permit their members to send bulk email without ADV tags.

Like every other antispam bill in Congress, it does not apply to spam sent by nonprofit groups, charities or politicians. Declan McCullagh writes for news.com