Tag Archive for CAN SPAM Act

Best Tactics for Dealing with Spam

Commercial email” is any email whose primary purpose is advertising or promoting a commercial product or service, including content on a Web site, an order confirmation, or a periodical subscription. “Spam” is “unwanted” or “unsolicited commercial email” (UCE).

The CAN SPAM Act outlined proper business practices for commercial email senders. Last week in my article, Spammers Get Canned, I listed these requirements, but today I would like to discuss them from a recipients viewpoint. To illustrate this point I will use an email message that I received just last week. You may have received the same message I did.

My Name is Shaye, and I am located in the State of New York.

I am an online Travel Agent, and would like to share my weekly news letters with you. Please feel free to check out my website and see all the different things we offer, other then just the basics of travel.

[web site address removed]

Somehow I received your email, and thought I would ask your permission to add you to my Email List. If you wish to be added to this List, just hit reply and tell me your name, and email address that you want it sent to.

If you don’t want to be added to this List, just hit reply and tell me no thanks. No hard feelings.

If you know of anyone who might be interested in this website and or this news letter, please email me and let me know.

My advertising is word of mouth, so the more the merrier.

If you have any questions, please feel free to drop me a line via email [address removed].


Regardless of whether or not I know Shaye or his company, this message is commercial because he is promoting his travel agency and web site, and he has violated several provisions of the CAN SPAM Act: he fails to fully identify himself or his company, and he doesn’t provide a postal address. All violations of the CAN SPAM Act. Additionally, most companies would state how they acquired my email address, but Shaye only says, “Somehow I received your email”.

Sorry, Shaye, not good enough. You’ve become eligible for an $11,000 fine from the FTC.

What Should I Do?

Should I delete Shaye’s message? Many people would just grumble and delete the email message, but that doesn’t mean Shaye won’t try to contact me or someone else again, and I don’t want to hear from Shaye again.

Shaye clearly violated the CAN SPAM Act, and there’s no telling how many others he has sent this message to. Some of those people might even be friends of mine. Shaye could get a fine of $250 for each email he sends out, but only if he is reported, charged, and convicted.

Where can I report Shay? There are a variety of places I could report Shaye to simply by clicking Forward on his message instead of delete:

  1. The Federal Trade Commission: The FTC keeps a database of unsolicited emails that can be used by law enforcement (State and Federal Agencies, etc.) to pursue action against spammers. To add Shaye’s email, I just click “Forward” on his message, and address it to spam@uce.gov.
  2. Shaye’s Internet Provider: Shaye had an email account, as his email ended with @aol.com. I can forward his message to abuse@aol.com, and let them know what one of their members is up to.
  3. My Internet Provider: I can also Forward a copy to abuse@ whoever my email provider may be. If I use Yahoo, it would be abuse@yahoo.com. If I use Optimum Online, it would be abuse@optonline.net. If I use Verizon, it would be abuse@verizon.net.

Should I take Shaye up on his offer to reply and say “No Thanks”? I could do that. According to the CAN SPAM Act, Shaye would then have 10 business days to remove me from his list. If my email reply comes back as undeliverable, then Shaye has violated CAN SPAM again. That’s another $11,000 fine from the FTC, Shaye. If my reply doesn’t come back, and after 3 business days I get another email from Shaye; that’s another $11,000 fine. (Note: The original law gave senders 10 business days to remove an email address from their mailing list, as of July 7, 2008, the law requires an address be removed within 3 business days.)

What I Did Do

I took another acceptable response toward Shaye’s message. I contacted the company Shaye claimed to represent. I wanted to see if the site he was promoting was legitimate, or if he was trying to send me to some other site instead. If the address in the address bar at the top of my browser differed from the one he sent me, there was another possible $11,000 fine for Shaye for misleading information.

I went to the web site he was promoting, and it appeared to be a legitimate travel web site, but there was no mention of anyone named “Shaye” on the site. Nor was there a mention of a “New York Agent” as Shaye claimed to be. In fact, the address on the site was for a company based in Illinois. They struck me as the type of company that would take a CAN SPAM violation seriously.

Perhaps Shaye wasn’t associated with this company at all? Maybe he didn’t know the CAN SPAM requirements? Maybe he did, but didn’t care?

Next I checked out the company’s “Privacy Policy” link at the bottom of the web page. (Thanks to a California law passed in 2004, commercial web sites are required to post a conspicuous privacy policy link.) The terms of the privacy policy can be legally enforced and challenged. Under their privacy policy I found some useful information:

  • The company does get email addresses from partner companies.
  • They will not sell or share my personal information with third parties, but only with their agents.
  • They provide unsubscribe links in their emails. (Shaye didn’t.)
  • “If you have received unwanted, unsolicited email sent via this system or purporting to be sent via this system, please forward a copy of that email with your comments to us for review”

Bingo! That last point included an “abuse” email address I could write to. I forwarded Shaye’s email to that address.

What Happened Next?

This Monday morning I received an email from the company that Shaye claimed to represent. It came from a representative of the “Legal Support and Compliance Department”. I checked the “From” part of the email message, it clearly showed the email address was from the same .com address as the travel web site I had seen. The email also showed that they had sent a copy “To:” the same aol.com email address Shaye had contacted me through. I could also see that they were courteous enough not to include my email address, so Shaye wouldn’t know who had reported him. They also included a copy of the email message Shaye had sent me.

Here’s what they had to say to Shaye. I have altered portions —enclosed in parentheses— to protect the innocent.


(Our company) has recently received allegations that you are sending Spam email to YTB agents and prospects (Please see email below). (Our company) takes Spam solicitation very seriously and we wanted to contact you to get this matter resolved.

Spam email can be subject to an $11,000 penalty per email according to the Federal Can Spam Act. You can find further information about these penalties by visiting the following site: http://www.ftc.gov/bcp/conline/pubs/buspubs/canspam.shtm

In order to send solicitations correctly you first need to review your contact list. This list should contain contact information for those to whom you know or who have requested information from you about (our) opportunities. Also, please included in each email you send an opt-out option so those who receive your email can opt-out at any time if they no longer wish to be contacted. (Our company) understands that this allegation could be a simple mistake on your part or the person you contacted did in fact give you their contact information but has forgotten. The opt-out option should satisfy those who receive your email but no longer wish to be solicited for the (our company’s) opportunity.

I was happy with the results. The company appeared reputable, and they were courteous enough to let me know that they took action, and that they try to keep their agents and representatives informed of proper business practices. It was also clear from their email that I wasn’t the only person who complained to them.

If You Receive Spam: “Don’t Just Delete It, Report It”

Your best response is to forward the message to the FTC at spam@uce.gov and to your Internet email provider at their abuse@ email address. (For Yahoo, it would be abuse@yahoo.com; for Verizon, it would be abuse@verizon.net; etc.)

Related Articles:

Please post a Comment/Question with the link below. You can also keep up-to-date with Skylarking by Subscribing by Email or by RSS Newsfeed. You can also respond by email at info@skylarknetworks.com. I’ll do my best to answer your question either here on Skylarking or by email.


Spammers Get Canned

Surprisingly, spammers getting jail time doesn’t get much press, but several major spammers have been put away this past year, and the latest one, a 27 year old Brooklynite, Adam Vitale, was sentenced to 30 months in prison yesterday. 24 to 30 months is the current limit of the Federal CAN SPAM Act of 2003. Yes, that’s the name, CAN SPAM. It stands for “Controlling the Assault of Non-Solicited Pornography and Marketing”.

What is the CAN SPAM Act of 2003?

According to the FTC, the CAN SPAM Act sets the following requirements for commercial (ie sales or promotional) email:

  1. It bans false or misleading header information. The email’s “From,” “To,” and routing information – including the originating domain name and email address – must be accurate and identify the person who initiated the email.
  2. It prohibits deceptive subject lines. The subject line cannot mislead the recipient about the contents or subject matter of the message.
  3. It requires that an email give recipients an opt-out method. The sender must provide a return email address or another Internet-based response mechanism, in the message, that allows a recipient to ask the sender not to send future email messages to that email address. (Recipients have 30 days to opt-out, and senders have 10 business days to comply). (Revision: A revision activated in July 2008 requires the sender complies within 3 business days.)
  4. It requires that commercial email be identified as an advertisement and include the sender’s valid physical postal address. Messages must contain clear and conspicuous notice that the message is an advertisement or solicitation and that the recipient can opt out of receiving more commercial email. It also must include a valid physical postal address.

Furthermore, the CAN SPAM Act allows:

  1. Each violation of the above is subject to fines of up to $11,000.
  2. Deceptive commercial email is subject to laws banning false or misleading advertising.
  3. Additional fines are provided for violators who:
    1. “harvest” email addresses from web sites or services that have published a notice prohibiting such activity
    2. generate random email addresses (a dictionary attack) with the intent of “stumbling” across a few genuine email addresses
    3. use software to register for multiple email accounts to send commercial email
    4. relay emails through a computer or network without permission
  4. The law allows the Dept. of Justice to seek criminal penalties, including imprisonment, for commercial emailers who do – or conspire to:
    1. Use another computer without authorization to send commercial email from or through it
    2. Use a computer to relay multiple commercial email messages to deceive or mislead recipients or an Internet service about the message’s origin
    3. Falsify header information (see no. 1 up top) in multiple email messages and initiate the transmission of such messages
    4. Register for multiple email accounts or domain names using information that falsifies the identity of the actual registrant
    5. Falsely represent themselves as owners of multiple Internet Protocol addresses that are used to send commercial email messages.

More about Yesterday’s Sentencing

Starting in 2005, the US Secret Service had a confidential informant communicate with Vitale and his partner, Todd Moeller, via instant messaging chats. One of the two young men had already been profiting from spamming stock market scams.

The informant hired the men to promote computer software through their spam activities. This resulted in around 250,000 email messages being sent to 1.2 million AOL subscribers. The emails contained falsified header information, and they were relayed through other computers and internet services without permission.

In June 2006, Vitale and Moeller pled guilty to charges of sending emails in a scheme to bypass spam filters. Moeller was sentenced in Dec. 2007, to 27 months in prison. Both also received 3 years of supervised release, and must each forfeit over $183,000 in illegal gains. Vitale was sentenced on July 15, 2008.

Other Recent Spammer Sentencings and Indictments

  • 3/18/2008: Daniel Mascia, 24, of West Haven, CT, pleaded guilty in Hartford to one count of conspiracy to commit fraud in connection with access devices and one count of fraud in connection with electronic mail. The charges relate to a “phishing” and “spamming” scheme that targeted AOL subscribers.
  • 3/14/2008: Robert Alan Soloway, 29, pleaded guilty in Seattle to Mail Fraud, Fraud in Connection with Electronic Mail, and Willful Failure to File a Tax Return. Soloway, indicted in May 2007, has been dubbed the “Spam King” by investigators. The most serious charge, mail fraud, is punishable by up to 25 years in prison.
  • 1/03/2008: Alan Ralsky, age 52, and ten others, indicted in international illegal spamming and stock fraud scheme.
  • 12/04/2007: Min Kim, 24, of Denver, CO was sentenced to 30 to 37 months, instead of 24 to 30, because he kept books tracking his $250,000 in profits. This is the first time that profits were a considerable factor in sentencing and it opens the way for longer sentences in the future.
  • 9/17/2007: Joshua Eveloff, 27, receives 6 months, 5 years supervised release, and $9,100 in penalties in San Diego for 3 months of spamming in 2004.

Related Links:

Post Comments or Questions with the link below. Keep up-to-date with Skylarking: By Email or RSS Newsfeed or on Twitter. You can also send questions with my email form. I’m looking forward to hearing from you.