FBI talks big, does little with spammers

It's been nearly six months since President Bush signed the first federal spam law with criminal sanctions - and not one bulk e-mailer has been criminally charged under it so far.

But the FBI told Congress on Thursday that it has "identified over 100 significant spammers" so far and is targeting 50 of the most noxious for potential prosecution later this year.

Jana Monroe, the FBI's assistant director of the cyber division, told the Senate Commerce Committee: "Such cases may be investigated and prosecuted as computer intrusion matters, or as online cyberfrauds which may lend themselves to a variety of existing state or federal statutes, including the recently passed Can-Spam Act."

She didn't offer much in the way of details, except to say that an "initiative is being projected for later this year in which it is anticipated that criminal and civil actions under the Can-Spam Act of 2003 will be included."

Monroe was among a handful of witnesses to appear before the Senate Commerce Committee in its first look at how the Can-Spam Act has worked since it took effect 1 January.

Committee Chairman John McCain said: "Since our review of this issue last May, the volume of spam received by American consumers has risen unabatedly. Spam now accounts for anywhere from 64 per cent to 83 per cent of all email traffic on the internet."

So far, the impact of Can-Spam is unclear, but most witnesses suggested taking a long-term view and cautioned that it takes time to gather evidence in both civil and criminal cases.

Instead of banning spam outright, Can-Spam requires that spammers follow certain guidelines and honor unsubscribe requests. It does outlaw the use of so-called "zombies" - computers running Windows that have been taken over and used as spam-bots - and punishes such an act with up to three to five years in prison. Such behaviour could also be illegal under the Computer Fraud and Abuse Act, which has long been on the books.

One bulk emailer, Ronald Scelson, testified that he is being discriminated against for abiding by Can-Spam.

Scelson said that even though his torrent of outgoing email complies with the Can-Spam Act, Internet providers are continuing to block him. "When we mail under the new law, the major ISPs focus on our From: addresses, Subject: lines, our company information, and our disclaimers on the bottom of the e-mail as well as our IP address. They use this information to block our emails," Scelson said. A law designed "to curtail fraud, is in fact curtailing our ability to engage in free enterprise."

Singling out AOL as having some of the most annoying email filtering policies, Scelson said: "They don't care what your [Congress'] law is. We cannot send bulk mail... Destroying people's private email is wrong."

"He's misinformed," AOL Vice Chairman Ted Leonsis said in response, adding that Scelson would not abide by AOL's rules for "white listing," which would mean his outgoing email would not be filtered as spam.

Declan McCullagh writes for CNET News.com