Can spam be canned?

ISPs spend millions annually fighting spam; a federal law headed for the House promises scant relief.

By Damien Cave

Apr 19, 2000 | Spam is the bane of Carmela Anderson's existence. Every week she must study the contents of hundreds of spams, looking for clues that might lead her to the senders. Every day the systems administrator of the Internet service provider she works for permanently blocks 15 to 20 addresses from sending more e-mail to its clients.

A 1999 California law designed to squelch spam encourages ISPs to sue every time spammers route e-mail through their networks, clogging servers and harassing ISP customers who rarely want "The Internet Spy Guide" and other unsolicited offerings. The law also offers rewards: $50 per message, up to $25,000 per day from each spammer. That kind of money could help reimburse ISPs, which spend about $1 of every user's monthly fee to fight spam, according to a 1999 Gartner Group study.

But Anderson and the owners of Redshift, the small Monterey, Calif., ISP where she works, have never taken spammers to court and have never seen much use for the state laws designed to protect them. "For us, the laws haven't really helped at all," Anderson says. "There's just too much spam, and it would cost too much to track spammers down and sue them. It's not worth the effort."

Apparently that message hasn't trickled up to Congress, which is trying to enact a similar law on a federal level. After months of haggling, the sponsors of three anti-spam bills -- Heather Wilson, R-N.M., Gary Miller, R-Calif., and Gene Green, D-Texas -- have fused their ideas into House Bill 3113, which aims to eradicate spam by encouraging litigation. Called "Unsolicited Commercial Electronic Mail Act of 2000," the bill has picked up a total of 42 cosponsors and is expected to reach the House floor for a vote in early May, soon after the two-week Easter break.

In its present form, 3113 closely resembles the California law, which is made up of three separate pieces of legislation that collectively give ISPs the right to sue spammers who use their networks in violation of posted anti-spam policies or who fail to announce their purpose with "ADV:" in the subject line.

By offering a sweeter payoff, the federal law creates a greater incentive to sue. It carries penalties of $500 per message up to $50,000 per day per spammer found guilty. And it offers this financial carrot not just to the ISPs but to you, me and anyone else who receives spam. It also promises to eliminate a common defense spammers invoke against state laws: Spammers who live outside the state that they're being sued in often argue that the state spam laws limit interstate commerce in violation of the Constitution's commerce clause that gives only Congress that power.

Ultimately, the bill "creates a large disincentive for spammers" -- one that could severely diminish the amount of spam in people's in boxes, says John Mozena, co-founder of CAUCE, the all-volunteer Coalition Against Unsolicited Commercial E-mail, and other proponents of the bill.

"It's going to curtail spam from a broad base of opposition," says Miller, who as a state legislator sponsored California's law that lets ISPs sue.

But the people at Redshift and other ISPs say that a federal law can remove some hurdles to litigation, but not all. Spam will not disappear, they insist. A law "won't make a whole lot of difference," says David Sorkin, a spam expert and professor of law at John Marshall University in Chicago. Simply put, spam is too easy to make, say ISPs, and its creators are too hard to find and collect from. No matter the benefits, the cost of litigation remains too high.

"It's still easier to ban these spammers than to sue them," says Dennis Dayman, director of policy and legal and external affairs for SBC Communications, the parent company of Ameritech, Southwestern Bell, Cellular One and other regional telcos. It operates Pacific Bell in California, where Dayman says the company is looking into a handful of spam suits, but has not filed a single complaint. "These cases are very hard to prosecute," he says.

"As a practical matter, I'm not so sure a federal law would do us any good," says Kris Rallapalli, owner of Kepnet, a small ISP in San Jose. "Litigation would drag on for years and it would be too expensive."

Of course, when anti-spam laws were proposed back in the mid-1990s, and as 15 states succeeded in passing them, few proponents of legislation imagined that the laws wouldn't be used. Indeed, an article in the San Jose Mercury News on Dec. 31, 1998, the day before the law took effect, reported that ISPs welcomed the measure, "and the opportunity to finally rid their systems of a costly problem." It went on to predict "swift enforcement" on the part of ISPs.

At the time, few disagreed. "I was really psyched when the law first came out," says Nick Nicholas, former head of the e-mail abuse department of Pacific Bell Internet and the present director of policy and communications for Mail Abuse Prevention Systems LLC, a provider of spam-filtering technologies. "I thought, here's the legal tool that gives ISPs what they need to deal with the abuse of their property."

But having a tool is one thing; finding an efficient way to use it is another. So far, few have bothered wielding California's legal weapons. More than a year has passed since the laws took effect and lawyers say only about seven spam-related suits have been brought: One was settled in small-claims court; two others were brought and settled by Yahoo, whose "Yahoo Mail" network was used by spammers; and four are pending.

Next Page: How do you distinguish the pro spammers from the amateurs?

• View blog reactions