New Law Means That Spamming AOL Members May Result in Criminal Penalties For Spammers

DULLES, VA - Tuesday, April 29, 2003 - In an important new chapter in the fight against spam, America Online joined with Virginia lawmakers and Internet industry leaders to unveil a much-needed, timely new weapon in the war against spammers: a strengthened state law that allows for the criminal prosecution of spammers with penalties that include jail time, asset forfeiture, and fines.

The unveiling of the new state law comes on the eve of the first-ever Federal Trade Commission (FTC) forum on spam, to be held in Washington, D.C. April 30-May 2.

The new anti-spam statute (SB 1139/HB 2290) now gives law enforcement the ability to bring felony-level prosecutions against spammers who use AOL's Virginia-based email servers to send spam to AOL members in violation of Virginia?s Computer Crimes Act. Other companies whose email servers are located or based in Virginia - such as Verizon, RoadRunner, and UUnet - will be able to benefit from the tough anti-spam provisions of the new law and also refer cases for criminal prosecution.

This new law means that those responsible for sending the worst, most egregious and fraudulent kinds of spam can now face tougher penalties than ever before. The kinds of actions that can now trigger such penalties, according to the new law, include: forging email header and routing information; sending huge volumes of bulk emails; generating substantial monetary proceeds from spamming; and employing a minor to be an affiliate in the spamming process.

The new statute also reinforces and strengthens pre-existing civil and monetary penalties for spamming. AOL has successfully used existing Virginia law to file numerous spam-related lawsuits against over 100 individuals and corporations, resulting in civil penalties, millions of dollars in monetary damages, and court injunctions to stop spam. Just recently, on April 15th, AOL announced a continuation of its anti-spam litigation strategy by filing five separate lawsuits against spammers in Federal court.

Violations under the new Virginia law involving prohibited spamming activity could result in the following: a Class 6 felony in Virginia that carries a prison term of between one and five years; monetary fines; and authorization for law enforcement to seize all profits, computer equipment and property connected with the spamming crime.

Virginia's Governor, Mark R. Warner, led the bill-signing event at America Online's corporate headquarters in Dulles, VA - surrounded by hundreds of AOL employees and industry representatives. Also attending in support of the new law were Virginia Attorney General Jerry Kilgore, who has enforcement authority for the new spam law; State Representative and House sponsor Jeannemarie Devolites; Robert W. Woltz, Jr., President, Verizon Virginia; and Bobbie Kilberg, President of the Northern Virginia Technology Council.

AOL worked hand-in-hand since last year with industry leaders, Virginia's state leadership, and supportive Internet organizations to collaborate on the anti-spam bill's inception and its eventual adoption by the Virginia Legislature on April 2nd. With the Governor's signature, this will become state law on July 1st. AOL has also provided critical leadership on earlier landmark Virginia anti-spam laws, such as the Virginia Computer Crimes Act (Va. Code Ann. §18.2-152.2 et seq.) as well as those in other states.

The tough, new anti-spam provisions of the Virginia Computer Crimes Act are a timely and necessary deterrent to those responsible for sending the ever-increasing torrent of unwanted junk mail. AOL supports the strong penalties provided for under Virginia's law as a model for other state and federal legislation that can provide real "teeth" in the effort to combat the fraudulent and evasive email transmission techniques used by the most egregious spammers.

For AOL members, the new Virginia spam law is significant because it will further help AOL and law enforcement work cooperatively to hold accountable those spammers who attempt every day to circumvent AOL email filters to get unwanted, offensive junk email through to members.

"AOL continues to lead the way in the fight against spam by collaborating with its members, its industry colleagues, and with key state leaders to make critical advances against spammers," said Ted Leonsis, Vice Chair and President, AOL Core Service, America Online. "We laid out a comprehensive spam-fighting agenda to our members in February - and, more than 60 days later - we're hitting hard on all cylinders to make a positive difference for our members against spam. We salute Virginia for continued leadership on tough anti-spam laws that benefit our members and the entire online industry here."

"This law will help us do more than just "can the spam"; it will allow law enforcement to hammer the spammers with the toughest criminal penalties of any state. It's high-noon for junk mailers, and its time to let law enforcement take them from behind their computer screens and put them behind bars," Leonsis said.

This is one of those laws, that yes I like, but I also know is unconstitutional. Under the U.S. constitution, article 1, section 8, Congress shall have the power to "regulate commerce with foreign nations, and among the several states and with the indian tribes". Spam, like it or hate it, is a part of commerce, most of it is out of state or in many cases out of the country. This is where congress should step in (as opposed to them stepping in where ever they don't belong like they usually do).

Spammers go out of their way to deliver their spam to people who go out of their way not to receive it.

Why?

Where's the profit in targeting advertising to people who by their actions make quite clear they have no positive interest in it?

Where's the profit in targeting advertising to people who by their actions make quite clear they have no positive interest in it?

Given how cheap it is to spam millions of e-mail addresses, even if a miniscule proportion of the recipients bite the bait, they probably get enough return on their investment to warrant it. IMHO.

Given how cheap it is to spam millions of e-mail addresses, even if a miniscule proportion of the recipients bite the bait, they probably get enough return on their investment to warrant it. IMHO.

It's easy to spam millions of people who don't go through any effort to avoid being spammed. Going after those who try to avoid spam is more difficult. Why make the extra effort to spam such people, when by their actions they've shown that they're not the target audience?

There are only two explanations I can figure:

The spam business is a bubble, and the only people getting any value from it are those who sell spam-related tools or services. Eventually the market for such tools and services will try up and the bubble will burst on its own.
The spam business is supported by one or more people or group who want to increase government restriction of the Internet.

Would you care to offer another explanation?

Your explanations are possible. Your second one is particularly intriguing.

If I had to hypothesize, I'd say it's entirely possible that the difference in cost between spamming those who don't go to the effort of avoiding spam, and spamming those who do, is so little that it makes no real difference to the spammers.

Just a thought.

The cost to find a spam-resistant email address is non-trivial. Even if someone who's only making $6/hour can find two a minute, that's still $0.05 each. Even if they do ten a minute, that's $0.01 each.

How is anybody who is engaged in such a practice going to come anywhere near breaking even? To be sure, spammers exchange lists a lot, so a person who's gif-cloaked email address gets found out once will receive spam from all over, but how does that benefit the person who found it first?

As noted, the only thing I can figure is either that the person who's going through the trouble of listing such addresses expects to make money selling lists of "Addresses not found on any other list!!!!!!!!" or else views the annoyance of the addressee as being a meaningful objective in and of itself.

Good hypotheses.

As an AOLer, I would LOVE if those who spammed faced SOME kind of penalty.

What I hate is that I will block an address, then have to block all email from the junk mail domain name because they've changed the user portion of the return address. Then you find they route spam through other domains, and that the address you blocked isn't the real originating address.

I just don't like that they don't get the message when they are first blocked. ANd that the 'unsubscribe" message at the bottom will just get you more junk mail.

You probably already know this, but e-mail harvesting software is how people "find" e-mail addresses. From newsgroups, or even by just looking for patterns in intercepted HTTP traffic. The only cost is that of writing the software, once that's set up you just let it run and it harvests for you.

And then when you want to send spam, all you need is a list of addresses and an smtp server.

Or is there more to it and I just don't realize it?

spamming has gotton way out of hand. I opened my email the other day and had almost 50 in a 24 hour period. I suggest that a federal law be passed establishing a rate equal to postal rate for sending advertising to people via email. That would put the brakes on this scam real quick like. And the penaltys for violations should be severe.

It's fine to be against this particular law, but to compare the maximum penalty under one law with a single instance of a plea-bargained sentence under another law doesn't provide for very insightful analysis. But that is just my opinion.

You probably already know this, but e-mail harvesting software is how people "find" e-mail addresses.

Many of them, but sometimes they manage to get email addresses which are protected by various contrivances (e.g. in a web page, having the webmaster's address appear as a .gif). I guess they could be using an smtp intercept, though that would be sorta evil.

Still, I have a strong suspicion much more money is being made in the spam business than is being made in any other business by spamming.

The problem is out of hand. The political system with its deals, compromises, endless debates and constitutional handwringing is incapable of dealing with it, but it will anyway in wholly laughable ways, just watch!

The internet access providers should deal with it aggressively, and probably will. Some ideas:

-- Block the links to the spammers' customers.

-- Create shiite blacklists of spammers' paying customers and encourage own customers to boycott them and, well, to spam them.

In all, I'm a little surprised that the focus of these campaigns has been on the spammers and not on their paying customers. The spammers have been very effective in beating various spam filters (Yahoo's filters, for example, have been rendered useless in the past few months,) and will continue to beat them, I suspect. There is simply no defense against "Viagra" presented as "V*I&A^G)R@A", and so on.

There is simply no defense against "Viagra" presented as "V*I&A^G)R@A", and so on.

The law should treat this exactly as it treats any other attempt to crack security in order to gain unauthorized access to someone else's computer.

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.