First Criminal Prosecutions Launched Under US CAN-SPAM Act

The US Federal Trade Commission (FTC) used a combination of high- and low-tech investigative techniques to collect evidence in support of the first criminal complaints under the new CAN-SPAM Act, which came into effect on January 1, 2004. The FTC filed the complaints against Phoenix Avatar, a company operating in the Detroit area, and Global Web Promotions, a company operating from Australia and New Zealand, for sending millions of allegedly deceptive messages. In both cases, the companies advertised and sold an allegedly fraudulent diet patch for weight loss purposes. The process of bringing the spammers to justice involved collaborative efforts using high- and low-tech methods. The FTC's investigation was aided by the Postal Inspection Service, the Australian Competition and Consumer Commission, the New Zealand Commerce Commission, and companies such as Microsoft and America Online. Private citizens assisted the investigation by making complaints to the FTC and forwarding copies of the questionable e-mails. The FTC received 490,000 messages that were linked to Phoenix Avatar, while 399,000 messages were linked to Global Web Promotions. A German security expert also assisted by running a "proxy pot", which is a system that simulates a mail proxy and looks vulnerable to spammers employing scanning software in search of open proxy servers. The proxy pot intercepted an estimated 5 million attempts from computer accounts linked to the American spammers. In stark contrast to the high tech methods used by the German security expert, investigators used the simple, yet effective, technique of purchasing the product and following the money trail. In addition to facing charges of mail fraud, the companies have been charged with multiple violations of the CAN-SPAM Act. They are alleged to have engaged in spoofing, a practice whereby the sender attempts to hide its identity by using innocent third party e-mail addresses in the "reply to" or "from" fields. In addition, both companies were charged with sending messages with materially false or materially misleading header information and failing to include the following: an opt-out feature to allow consumers to avoid future unwanted e-mails, clear and conspicuous identification that the e-mail is an advertisement or solicitation, and the valid postal address of the sender. For the FTC's press release, see: http://www.ftc.gov/opa/2004/04/040429canspam.htm. To view the FTC's complaints, see: http://www.ftc.gov/os/caselist/0423084/0423084.htm; and http://www.ftc.gov/os/caselist/0423086/0423086.htm. For more information, visit: http://makeashorterlink.com/?G2AE52448; http://www.usatoday.com/tech/news/2004-04-30-spam-sleuths_x.htm; http://www.freep.com/money/tech/spam29_20040429.htm; and http://www.cnn.com/2004/LAW/04/28/internet.spam.ap/. Summary by: Colin Adams