Politics and Law

Two Senators are attempting to curb unsolicited text messages with a bill to strengthen government oversight of commercial texts.

Senators Olympia Snowe (R-Maine) and Bill Nelson (D-Fla.) on Thursday introduced the m-SPAM Act, which would strictly prohibit commercial text messages to wireless numbers listed on the Do Not Call registry. The bill would also give the Federal Communications Commission and Federal Trade Commission more authority to regulate unwanted text messages.

"Mobile spam invades both a consumer's cell phone and monthly bill," Snowe said in a statement. "There is also increasing concern that mobile spam will become more than just an annoyance--the viruses and malicious spyware that are often attached to traditional spam will most likely be more prevalent on wireless devices through m-spam. This significant and looming threat must be addressed in order to protect consumers and vital wireless services."

In 2007, U.S. consumers received approximately 1.1 billion text messages that they identified as "spam," according to Ferris Research. That number increased from previous years, but still represents a small portion of the text messages consumers receive. In the month of June 2007 alone, 28.8 billion text messages were reported, according to the CTIA.

As a result of the 2003 CAN-SPAM Act, the FCC adopted rules to prohibit sending unsolicited commercial e-mail messages to wireless devices without permission, but the ban does not cover SMS messages. Mobile spam has been reported as a means for phishing attacks, in which scammers try to prompt cell phone users into revealing their personal data over the phone.

The Supreme Court on Monday said it is refusing to consider reinstating the Commonwealth of Virginia's junk e-mail law.

The court's inaction upholds an earlier ruling of the Virginia Supreme Court that Virginia's Computer Crimes Act violates First Amendment rights. The broad law prohibits the anonymous transmission of all unsolicited bulk e-mails, including those containing political, religious, or other speech protected by the U.S. Constitution.

Virginia State Attorney General Bill Mims, according to other reports, is planning to draft a new antispam law in the next General Assembly session to address constitutional concerns.

The Virginia Supreme Court's September ruling overturned the conviction of Jeremy Jaynes, the first person to be convicted of a felony under the state law. In 2005, Jaynes was sentenced to nine years in prison for sending more than 10 million junk e-mails a day.

Considered one of the most prolific spammers ever, Jaynes, according to prosecutors, made up to $24 million by selling fake goods and services via spam. He is currently serving 42 months in federal prison on an unrelated fraud conviction.

Most schools encourage students to become active in campus politics. Not Michigan State University, which has filed disciplinary charges against a student leader who sent e-mail criticizing an abbreviated fall semester.

Kara Spencer's encounter with MSU's disciplinary apparatus started in September, when the student government member began discussing the shortened fall 2009 schedule with a small group of faculty members and administrators. She followed up by contacting 391 faculty members by e-mail, saying that professors should be aware of the "burden for class schedules and syllabi" the change would involve.

Plant biology professor Katherine Gross, reportedly the lone faculty member irked by the e-mail message about 2009 schedules

(Credit: MSU.edu)

The e-mail irked a single faculty member, Katherine Gross, who teaches plant biology. Gross complained to the university administrators, who summoned Spencer to a mandatory meeting and informed her that she would face disciplinary charges.

A formal letter listing Gross as a "possible witness" to the offense said that the e-mail violated university policies saying that students can use the network only for "authorized purposes."

"Students on campus have been supportive," Spencer told CNET News. So has the Foundation for Individual Rights in Education, or FIRE, a nonpartisan group in Philadelphia that urged MSU President Lou Anna Simon to halt the disciplinary process in advance of a hearing that was scheduled to take place on Tuesday.

It didn't work: The president rebuffed FIRE and the hearing took place as scheduled. A decision is expected soon.

"To date I have not received any notification from the judicial board regarding the case," Spencer said on Thursday. "The board may take up to seven days to render a ruling, so at this point I am just waiting for their notification."

Gross, the biology professor who complained, did not respond to multiple requests for comment.

MSU's bulk e-mail rules say that e-mailing more than a "small set of recipients"--with the maximum number set at 30 people--is verboten. In a statement on Friday, MSU said: "It is clear that this policy is content neutral and is a set of procedural requirements that apply to all bulk use of the e-mail system, as opposed to a policy that makes distinctions based on the content of particular e-mails. It is our belief that such a policy does not impose unlawful restrictions on free speech." MSU declined to comment on specifics, citing privacy laws.

MSU President Lou Anna Simon, who rebuffed a request from a civil liberties group to throw out the case against the student leader.

(Credit: MSU.edu)

If MSU were a private school, such strict limits would be a matter of its contract with students and faculty: objectionable and inconsistent with academic freedom, perhaps, but not necessarily illegal. But because MSU is a public school, it is legally obligated to provide students with due process rights and it must protect their free speech rights.

And that's what FIRE thinks has gone wrong with MSU's disciplinary prosecution of Spencer.

Adam Kissel, director of FIRE's individual rights defense program, believes this is the first time he's heard of antispam rules being applied this broadly on campus. "The rule should be: if it's not disruptive, then you can do it," he said.

"The question is: does bulk unsolicited e-mail count as inherently disruptive to the campus?" he said. "I would say no, it doesn't, especially when the message is something that's directly relevant to everything on campus."

FIRE's letter to MSU on November 26 calls on President Simon to halt the "erroneous prosecution of Kara Spencer, who has been under investigation for more than two months for her clearly protected expression. If e-mailing faculty members about common concerns is outside the parameters of acceptable speech at MSU, surely no member of the MSU community can feel safe contacting another about any relevant matter of concern. Is this truly the lesson that MSU wishes to teach to students who will soon be entering into civil society at large?"

If MSU does not back down, FIRE has the option to file a First Amendment lawsuit in federal court. Federal law allows private parties to recover attorneys' fees in a successful free speech case against a government or public university.

Facebook has been awarded $873 million in damages against a Canadian man accused of sending spam messages to its members.

The default judgment was issued in federal court in San Jose, Calif., on Friday against Adam Guerbuez, of Montreal, and his company, Atlantis Blue Capital. The ruling also forbids Guerbuez from using Facebook or interacting with its members ever again.

Facebook doesn't expect to necessarily collect the money because "it's unlikely that Geurbez and Atlantis Blue Capital could ever honor the judgment rendered against them," Max Kelly, Facebook's director of security, wrote in a blog posting on Monday. "We are confident that this award represents a powerful deterrent to anyone and everyone who would seek to abuse Facebook and its users."

Neither Guerbuez, who has made money selling videos showing people attacking the homeless in Montreal, nor Atlantis Blue Capital could be reached for comment.

Facebook noticed an uptick in spam beginning in the spring, with Facebook members receiving messages from friends and other members offering things like herbal marijuana and male enhancement pills for sale, a spokesman said. The messages were coming from Facebook accounts that had been compromised.

Facebook sued under the Can-Spam (Controlling the Assault of Non-Solicited Pornography and Marketing) Act, which bans "false and misleading" marketing e-mails. Although the law was written for e-mails, a judgment in favor of MySpace in May set the precedent for extending the law to messages sent within social networks. In that case, MySpace was awarded $234 million to be paid by so-called Spam King Sanford Wallace and another man.

The Facebook award is the largest judgment in history for a case brought under the Can-Spam Act, according to Kelly.

Facebook has beefed up its antispam technology since the spring, creating tools that can delete spam messages from accounts and block URLs that direct people to spam Web sites.

Sen. Barack Obama and Gov. Sarah Palin are both winners when it comes to spam.

Does her name inspire you to download spyware?

(Credit: State of Alaska)

The amount of spam that mentioned Obama beat out that of his rival, Sen. John McCain, by a ratio of 6 to 1 during the month of September, according to a study released by Secure Computing. Likewise, Palin outranked her opponent, Sen. Joe Biden, by a ratio of 6 to 1. The results were published Friday in a PC Magazine report.

The numbers don't mean much in terms of who actually wins the election, but they do show that spammers are staying on top of what names are hot among Internet users. A "surge" of Obama spam apparently occurred around September 3, about the time of the Republican National Convention, according to PC Magazine.

"Though the spam message content itself is nonsensical, the basic themes of the Obama e-mail content does tend to revolve around the shallow factors that are espoused in the mainstream media as central campaign issues: race, disputes with Clinton, messianic oratory, and Fox news smears," Secure Computing said in its study. "The McCain spam subjects are equally driven by shallow media propaganda, revolving around age and wealth."

Also last month, security firm Sophos warned that a malicious e-mail was making the rounds which claimed to have a link to a sex video of Obama but which was instead spyware. Clicking on the link downloaded an executable file that played an amateur porn video, but Obama obviously wasn't in it.

The Virginia Supreme Court on Friday overturned the conviction of a notorious AOL spammer, the first spamming defendant to be convicted of a felony, saying the state junk e-mail law is too broad and violates the First Amendment.

This is a remarkable decision (PDF). But a close reading of the Virginia statute shows that it is the right one.

The law in question is kind of the state equivalent of the Can-Spam Act, though with exclusively criminal penalties. It says:

A. Any person who: 1. Uses a computer or computer network with the intent to falsify or forge electronic mail transmission information or other routing information in any manner in connection with the transmission of unsolicited bulk electronic mail through or into the computer network of an electronic mail service provider or its subscribers...is guilty of a Class 1 misdemeanor.

If someone violates section (A) by transmitting unsolicited bulk e-mail to 10,000 attempted recipients in a 24-hour period, 100,000 attempted recipients in a 30-day period, or 1 million attempted recipients over one year--well, then the criminal penalties jump from a misdemeanor to a felony.

What's notable about this law, and what made it vulnerable to First Amendment challenge, are two characteristics. The first is that it applies to the falsification of e-mail information, which could sweep in both spammers and, say, someone using a pen name or pseudonym. And we know, despite efforts under way at a United Nations agency, that the First Amendment clearly protects anonymous speech.

The second characteristic is that the law regulates both commercial and noncommercial e-mail, meaning that political speech would be covered as well. (Now, it's not clear that commercial speech deserves to be treated as a second-class citizen, but courts have generally said it's OK to slap more regulations on it.)

Let me stipulate at this point that, especially as someone who runs his own mail server, I have no love for spammers. The defendant here, Jeremy Jaynes, has been estimated to be the world's 8th most prolific spammer, believed to have received up to $750,000 a month from his efforts. Horsewhipping is too good for these knaves.

But when tech-impaired politicos devise measures to imprison spammers (a worthy goal, that), those laws must not go too far and sweep in legitimate activities too. Virginia's did, as the state Supreme Court concluded, with some help from the ACLU's Virginia affiliate. Excerpts:

Jaynes does not contest the Commonwealth's interest in controlling unsolicited commercial bulk e-mail, as well as fraudulent or otherwise illegal e-mail. Nevertheless, Code § 18.2-152.3:1 is not limited to instances of commercial or fraudulent transmission of e-mail, nor is it restricted to transmission of illegal or otherwise unprotected speech, such as pornography or defamation speech.

Therefore, viewed under the strict scrutiny standard, Code § 18.2-152.3:1 is not narrowly tailored to protect the compelling interests advanced by the Commonwealth.

Code § 18.2-152.3:1 would prohibit all bulk e-mail containing anonymous political, religious, or other expressive speech. For example, were the Federalist Papers just being published today via e-mail, that transmission by Publius would violate the statute.

Such an expansive scope of unconstitutional coverage is not what the Court in Williams referenced "as the tendency of our overbreadth doctrine to summon forth an endless stream of fanciful hypotheticals."

We thus reject the Commonwealth's argument that Jaynes' facial challenge to Code § 18.2-152.3:1 must fail because the statute is not "substantially overbroad."

That statute is unconstitutionally overbroad on its face because it prohibits the anonymous transmission of all unsolicited bulk e-mails, including those containing political, religious, or other speech protected by the First Amendment to the United States Constitution. Accordingly, we will reverse the judgment of the Court of Appeals and vacate Jaynes' convictions of violations of Code § 18.2-152.3:1.

Jaynes, at the time a North Carolina resident using the pseudonym "Gaven Stubberfield," was indicted in Virginia in December 2003. In 2005, he was sentenced to nine years in prison; our coverage at the time said prosecutors estimated that he raked in up to $24 million in sales, some of which he invested in a restaurant and a chain of gyms. When police originally searched his home, they found CDs more than 176 million full e-mail addresses and 1.3 billion e-mail usernames.

It's not clear what happens next. Virginia could appeal. Companies that had their servers clogged, such as AOL, could sue. Other state prosecutors may be interested in targeting Jaynes. But action under the Can-Spam Act may be unlikely; it wasn't signed until December 2003, when Jaynes was already being arrested.

So what's the moral of this story? If you're a state legislator writing an antispam law, be very careful. Target only commercial e-mail, and be careful about wording that might make courts think you're trying to ban perfectly innocuous use of e-mail pseudonyms. If you do it right, the next Jaynes may actually stay in prison.