CANNING SPAM: CONSUMER PROTECTION OR A LID ON FREE SPEECH?

Abstract

The United States Congress recently passed the first federal legislation to curb the influx of spam. However, the Controlling the Assault of Non-Solicited Pornography and Marketing Act ("CAN-SPAM Act") left some measures to be enacted by the Federal Trade Commission ("FTC"), and some consumers are calling for the Act to have a broader reach and for the creation of a Do-Not-E-Mail registry. Conversely, the FTC decided to delay the creation of a registry and opted to assist in the development of a new technological authentication system. This iBrief looks at the current state of spam and explains that it is too early to tell whether the effects of the CAN-SPAM Act warrant new anti-spam measures. In addition, it points out that it is questionable whether the FTC's current authentication approach will be effective, and, thus, considers the possible First Amendment challenges to a Do-Not-Call registry as well as other possible anti-spam solutions. In the end, this iBrief postulates that the most effective option might be for the FTC to implement both a Do-Not-Email registry and an authentication system.

Introduction

¶          E-mail has become an integral part of life on the Internet, but like many great communication media it has been tainted by unsolicited commercial communications; unsolicited commercial e-mail is commonly referred to as "spam." Spammers recognize the convenience and efficiency of e-mail, and make significant profits while interfering with consumer usage. The economics of spam are fairly simple. A retailer's goal is to maximize profits by minimizing costs,² and advertising is a cost.³ To maximize the effective use of advertising, the retailer casts as wide a net as possible in a direct marketing scheme.⁴ Since the cost of spam is almost negligible, it often makes sense to use e-mail as the primary advertising medium.⁵ 

¶          However, society bears a great cost as a result of spam. Recipients of spam suffer because they, or their employers, must shoulder the substantial cost of setting up complex mail servers, maintaining hard drives to store the e-mail, and implementing spam filters.⁶ In addition, in the workplace, spam can result in a significant loss of productivity.⁷ For example, because spam is already estimated to constitute over half of all e-mail traffic,⁸ there is a concern that if spam increases at its expected exponential rate, companies will not be able to support the increased costs of bandwidth and hard drive space.⁹ One study estimates that spam costs a business $847 per employee per year in lost productivity alone.¹⁰ Furthermore, society will bear the cost of spam if e-mail becomes a less useful form of communication.¹¹ 

¶          This iBrief looks at the effects of current and proposed federal anti-spam legislation. In particular, it considers the possible implementation of a Do-Not-Email registry or a new technological authentication process, including possible constitutional and logistical challenges. In the end, this iBrief postulates, the most effective option might be for the federal government to implement both a Do-Not-Email registry and an authentication system.

I. The Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003

¶          Though many states had already enacted anti-spam laws, the United States Congress' first anti-spam action did not come until 2003, when it passed the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 ("CAN-SPAM Act");¹² the CAN-SPAM Act was signed into law by President Bush on December 16, 2003 and went into effect on January 1, 2004.¹³ The CAN-SPAM Act largely delineates certain requirements for sending commercial e-mail and proscribes ancillary methods used by fraudulent spammers to harass consumers.¹⁴ Specifically, it prohibits the use of false-header information¹⁵ and deceptive subject headings,¹⁶ while requiring that the e-mail contain certain content, such as a mechanism to opt-out of receiving future commercial e-mail from that sender,¹⁷ a warning label if the commercial e-mail contains sexually oriented material,¹⁸ and the sender's physical postal address.¹⁹ The CAN-SPAM Act also prohibits many other fraudulent activities associated with spam, such as utilizing open relays,²⁰ hacking into computers to facilitate the transmission of spam,²¹ registering for false e-mails or domain names,²² address-harvesting, and dictionary attacks.²³

¶          The CAN-SPAM Act was one of many proposed federal legislations, and has been highly criticized for not being harsh enough in its requirements and limitations.²⁴ For example, California State Senator Bowen (D-Redondo Beach) criticized the CAN-SPAM Act's adoption of an opt-out mechanism, which she found to be weaker than her opt-in proposal.²⁵ The CAN-SPAM Act has also been criticized for not recognizing a private cause of action.²⁶ Rather, actions must be brought by state Attorneys General,²⁷ Internet Service Providers,²⁸ or primarily, the Federal Trade Commission ("FTC").²⁹ Despite these criticisms, it is too early to tell whether additional measures must be taken by either the FTC or by Congress.

¶          The FTC has some flexibility to enact and administer additional spam regulations,³⁰ such as creating a Do-Not-E-Mail registry³¹ or requiring additional labeling.³² Such additional regulations may be warranted, as the success of the CAN-SPAM Act in its first year has been much-debated. Already, AOL cites a 27% decline in spam and an almost 50% decrease in daily spam-related complaints from customers over a period from February 20 to March 17 of 2004.³³ On the other hand, some reports have indicated that spam volume has risen since 2002.³⁴ It may take some time to accurately measure the effect that the CAN-SPAM Act will have on the quantity of spam. Furthermore, there are mixed reviews from the industry regarding whether the CAN-SPAM Act will ever be effective.³⁵ 

II. Do-Not-E-Mail Registry

¶          One potential expansion of the CAN-SPAM Act, which may implicate First Amendment issues, is to implement a Do-Not-E-Mail registry. The CAN-SPAM Act gave the FTC six months from its date of enactment to study the feasibility and effectiveness of establishing a Do-Not-E-Mail registry.³⁶ In June 2004, the FTC released a report delineating its findings, and advised against implementing a Do-Not-E-Mail registry at that time.³⁷ The FTC considered three potential types of Do-Not-E-Mail registries: "a registry of individual email addresses, a registry of domains, and a registry combined with a certified third-party email forwarding service."³⁸ The first two types of registries are intuitive: that is, a user can register an e-mail address or a domain name and spammers would not be allowed to send to those addresses or domain names.³⁹ The third type of registry considered allows a spammer to submit his distribution list to an FTC-approved third party forwarding service, which then matches the e-mails on the distribution list with those on the Do-Not-E-Mail registry and forwards the spam to those users not on the registry.⁴⁰ After considering all three registry types, the FTC determined that there were significant security and privacy concerns,⁴¹ general technical concerns,⁴² and obstacles to enforcement.⁴³

¶          The proposal of a Do-Not-E-Mail registry has received popular support from the general public.⁴⁴ Some have even said that the registry is integral to the CAN-SPAM Act's success.⁴⁵ Many spam opponents feel that spam legislation should employ an opt-in mechanism,⁴⁶ and the registry would make the CAN-SPAM Act a de facto opt-in law.⁴⁷ Meanwhile, others, like FTC Chairman Tim Muris, have expressed serious doubt about the registry's effectiveness.⁴⁸ In addition, some opponents are concerned that it would just give spammers millions of valid e-mail addresses to spam.⁴⁹ 

¶          Most importantly, an effective registry must be robust in order to counteract the weaknesses mentioned in the report. For example, use of third-party intermediaries would provide the most security; however, the FTC found that doing so would "deprive legitimate bulk e-mailers of key marketing data."⁵⁰ The FTC further argued that the use of such a system would increase the cost to legitimate marketers and take away "key components to any marketing strategy - measuring the success of the campaign and understanding the customer."⁵¹ Thus, although a registry would further protect consumer privacy, it also has the potential to impinge on legitimate marketers' First Amendment rights. To determine whether an expanded Do-Not-E-Mail registry could withstand constitutional scrutiny, it is helpful to examine the legal precedent provided by the recent judicial challenge to the Do-Not-Call registry.

¶          The Do-Not-Call registry is "a list containing the personal telephone numbers of telephone subscribers who have voluntarily indicated that they do not wish to receive unsolicited calls from commercial telemarketers."⁵² The Do-Not-Call registry, originally established under the Telephone Consumer Protection Act of 1991,⁵³ is a joint effort between the FTC and the Federal Communications Commission ("FCC") under the Do-Not-Call Implementation Act,⁵⁴ and both agencies have promulgated the rules governing the Do-Not-Call registry.⁵⁵ Under the Do-Not-Call registry regulations, telemarketers have up to three months to remove phone numbers listed on the registry from their call lists; however, only personal phone numbers may be listed⁵⁶ and the list does not apply to non-telemarketers, such as political organizations, charities, telephone surveyors, or companies with which consumers have an existing relationship.⁵⁷ 

¶          In Mainstream Marketing Services Inc. v. FTC,⁵⁸ the Court of Appeals for the Tenth Circuit recently upheld the constitutionality of the Do-Not-Call registry, holding that it did not violate the limited First Amendment protection provided to commercial speech.⁵⁹ The Supreme Court uses a form of intermediate scrutiny in evaluating commercial speech.⁶⁰ In Central Hudson Gas v. Public Service Commission,⁶¹ the Supreme Court articulated a four-part intermediate scrutiny analysis used to determine whether a government regulation violates commercial expression under the First Amendment: (1) the speech must concern lawful activity and not be misleading; (2) the government interest must be substantial; (3) the regulation must directly advance that government interest; and (4) the regulation must not be more extensive than necessary to serve that interest.⁶² The Tenth Circuit applied the Central Hudson test and provided four reasons why the Do-Not-Call registry is consistent with the First Amendment's requirements.⁶³ The court's reasoning readily applies to a potential Do-Not-E-Mail implementation.

¶          First, the Mainstream Marketing court emphasized that only core commercial speech is restricted by the Do-Not-Call registry.⁶⁴ The law clearly defined the scope of content to include only commercial speech, and as such, it fell within the constitutional purview of the Central Hudson test. Similarly, the CAN-SPAM Act only targets commercial speech.⁶⁵ However, the FTC could make this analysis more difficult if it pushes the limit of its discretion concerning the implementation of a Do-Not-E-Mail registry.⁶⁶ For example, if the FTC expanded the registry to reach non-commercial political speech, the registry would not be protected by the Mainstream Marketing precedent.⁶⁷

¶          Second, the court acknowledged that the government had two justifiable interests, thus passing the second prong of the Central Hudson test. The Do-Not-Call registry was meant to protect individual privacy in the home and protect consumers against "fraudulent and abusive solicitation."⁶⁸ The court stated that the home is a "personal sanctuary that enjoys a unique status in our constitutional jurisprudence."⁶⁹ These interests would also apply to consumers using personal e-mail. However, while the Do-Not-Call registry only applies to personal phone numbers,⁷⁰ an effective Do-Not-E-Mail registry would also need to include business e-mail addresses. Many of the costs of spam are incurred by businesses through lost productivity and technology costs, and businesses generally invest more in costly anti-spam programs than individuals do.⁷¹ Thus, under a potentially expanded Do-Not-E-Mail registry, a court would have to also determine whether decreasing the burden on businesses is a justifiable government interest.

¶          Third, the Mainstream Marketing court addressed the issue of choice, as the Do-Not-Call registry acts as an opt-in program that leaves choice in the hands of the consumers.⁷² It found that the Do-Not-Call registry materially furthers the government's interests of combating the danger of abusive telemarketing and preventing the invasion of consumer privacy, thus fulfilling the third prong of the Central Hudson test.⁷³ In this same manner, a Do-Not-E-Mail registry would put the power to receive or prevent spam in the hands of consumers. The CAN-SPAM Act states that it forwards a substantial government interest in that it protects consumers from the fraudulent aspect of spam and provides them the right to decline commercial e-mails.⁷⁴ Thus, a Do-Not-E-Mail registry would further the government interest of protecting consumers by putting the power in the hands of the consumer to determine whether or not to receive unsolicited commercial e-mails.

¶          Fourth, the Do-Not-Call registry was challenged under the last factor of the Central Hudson test which requires that the commercial speech regulation be "narrowly tailored," but not necessarily the least restrictive means.⁷⁵ The Tenth Circuit found that the Do-Not-Call regulation is narrowly tailored because it is a proportional response to the government interest.⁷⁶ The appellees in Mainstream Marketing, who were telemarketing companies, contended that there were alternative approaches that could be taken to fulfill the government's interests; however, the court struck each of them down. For example, telemarketers suggested that consumers could make company-specific opt-out requests,⁷⁷ but the court found that only having a company-specific approach is "seriously inadequate to protect consumers' privacy from an abusive pattern of calls."⁷⁸ Telemarketers also argued that the government could employ less restrictive technological alternatives to stop unsolicited phone calls; however, the court recognized that such alternatives would not only place the cost of unwanted calls on recipients, but would also be ineffective as technological advances have been made to circumvent blocking techniques.⁷⁹

¶          In the same manner, spam advertisers may argue that there are ample alternatives to implementing a Do-Not-E-Mail registry; however, because spam and telemarketing have many of the same characteristics and alternatives, the Mainstream Marketing arguments may also apply to a Do-Not-E-Mail challenge.⁸⁰ Under the current CAN-SPAM Act scheme a consumer only has a company-specific opt-out option.⁸¹ It is questionable how effective this option will be in stopping spammers, and it shifts the burden to the consumer to opt-out of each company's mailing list. This is in contrast to the Do-Not-Call registry, by which telemarketers are charged with removal of the phone numbers listed on the registry from their call lists; however, only personal phone numbers may be listed⁸² and the list does not apply to non-telemarketers, such as political organizations, charities, telephone surveyors, or companies with which consumers have an existing relationship.⁸³ 

¶          An effective Do-Not-E-mail registry would not only be narrowly tailored, but welcomed by consumers because it would allow them to opt-out only once, similar to the Do-Not-Call registry.⁸⁴ As with telemarketing, there are many spam blocking technologies; however, they have proven to be both costly and ineffective.⁸⁵ The Tenth Circuit found a registry to be the most efficient for consumers, and unlike the current scheme of the CAN-SPAM Act, where an e-mail user can only opt-out from each individual solicitation, a registry provides one easy means to "erect a wall . . . that no advertiser may penetrate without [the registered party's] acquiescence."⁸⁶ 

¶          The Tenth Circuit correctly found that the Do-Not-Call registry was constitutional, and a constitutional challenge against a Do-Not-E-Mail registry would face many of the same issues. However, a successful Do-Not-E-Mail registry would inevitably need to be a more encompassing registry than a Do-Not-Call registry, given that a large amount of spam is sent to both consumers and businesses⁸⁷ and also because the general nature of e-mail is such that users can check their personal or business e-mail wherever they are. If only personal e-mails could be registered, the nuisance aspect of spam could still occur in the home because the nature of e-mail allows many users to frequently check their business e-mail from home and vice versa.

¶          While the Direct Marketing Association ("DMA"), one of the appellees in Mainstream Marketing, decided not to appeal the Tenth Circuit's decision, the American Teleservices Association announced that it would appeal the case to the Supreme Court⁸⁸ and did so in May 2004.⁸⁹ However, the Supreme Court recently denied certiorari.⁹⁰ The Tenth Circuit's holding thus stands, and is not only instrumental in protecting consumers but also serves as significant precedent for the Do-Not-E-Mail registry.⁹¹ 

¶          If created, a Do-Not-E-Mail registry would be more difficult to administer than a Do-Not-Call registry,⁹² and it is possible that the FTC may be "emboldened enough to create a do-not-email registry broader than the telephone registry [and] . . . go for noncommercial e-mail."⁹³ If the FTC created a registry outside the bounds of the Tenth Circuit's holding, such as one allowing the registration of business e-mails or the restriction of non-commercial e-mail, this could possibly incite marketing trade groups to make First Amendment challenges. However, the costs of spam and telemarketing are different and there are other significant justifications, such as the nuisance of pornographic spam,⁹⁴ which could justify farther reaching provisions of a Do-Not-E-Mail registry.

III. Other Solutions Subject to Challenge

¶          Given the time necessary to study the effects of the CAN-SPAM Act and the potential First Amendment challenges, Congress is not likely to amend the Act to give it any more force. Therefore, the FTC is left to either implement a registry or look to alternative non-statutory solutions, most of which are not susceptible to attack under the First Amendment. For example, an e-mail tax would severely hinder the cost-efficiency of spam, and though it would have to pass intermediate scrutiny,⁹⁵ such a measure would likely pass a First Amendment challenge because it would apply to all e-mail.⁹⁶ In addition, various Internet Service Providers (ISPs) have proposed technical solutions to verify the validity of an e-mail and its origin.⁹⁷ 

¶          Many of the suggested technical solutions require some type of key, authentication, or identification process.⁹⁸ In fact, in its June 2004 report, the FTC suggested that it will convene a Federal Advisory Committee to consider an authentication process⁹⁹ in lieu of a Do-Not-E-Mail registry.¹⁰⁰ Marc Rotenberg, Executive Director of the Electronic Privacy Information Center (EPIC), cautions that while digital certificates requiring identification of a sender are allowable for commercial speech, they would most likely violate First Amendment protections of political or religious speech.¹⁰¹ However, while the Supreme Court has held that laws that ban anonymity on political literature are unconstitutional, there would be a question if this requirement of anonymity could be applied to technological standards implemented by private ISPs, particularly when the implementations are completely content-neutral.¹⁰² Most likely, unless ISPs are regarded as state actors,¹⁰³ those who send unsolicited e-mails would be unable to make First Amendment challenges against ISPs,¹⁰⁴ as the First Amendment only protects against speech regulated by the government.¹⁰⁵ Thus, if private ISPs and other technology companies take the initiative on their own to create an e-mail standard, they would be able to defend against First Amendment challenges.

¶          However, it is problematic to implement these technical solutions.¹⁰⁶ Furthermore, getting the major e-mail providers to agree on a single protocol will be extremely difficult.¹⁰⁷ The FTC, anticipating these hurdles, is considering mandating an authentication protocol.¹⁰⁸ A government-imposed technological standard may not be advisable, but it is beyond the scope of this paper to discuss those issues. Authentication may even work best with a registry, rather than in lieu of a registry.¹⁰⁹ Currently, spammers can exploit the e-mail system because the identity of the e-mailer is unverifiable.¹¹⁰ In the same way, a major problem with the Do-Not-E-Mail registry is the fear that spammers may illegally use the registry e-mails to continue spamming while avoiding detection because of their inability to be traced.¹¹¹ If the FTC implements a Do-Not-E-Mail registry with an authentication system in place, this may very well be more effective than only implementing a registry.

Conclusion

¶          Although many spam scholars are calling for the expansion of the current CAN-SPAM legislation, there is still time to determine whether the current legislation will make an impact on spam. The Spamhaus Project's Register of Known Spam Operations has found that 90% of all spam comes from 200 spam groups.¹¹² Some on the list, such as Bernard "Merlin" Balan, who Canada.com News dubbed the "King of Spam," have since retired.¹¹³ However, the CAN-SPAM Act provides a Damoclean sword for those spammers who wish to take Balan's place among the spamming elite, and has caused many to be wary of sending spam.¹¹⁴ 

¶          Hopefully, an authentication implementation will be able to stem the increasing flow of spam. However, if the amount of spam does not decrease, the statutory requirements of the CAN-SPAM Act will need to be expanded and further expansion will undoubtedly test the limits of free speech. Since the Supreme Court denied certiorari, the Tenth Circuit's decision stands as a significant precedent. An emboldened FTC may consider creating an expansive Do-Not-E-Mail registry alongside an effective authentication system, which together would add to the growing arsenal in the war on spam. In fact, this may be necessary to appease the various anti-spam organizations and corporations that are tired of fighting an ever-increasing amount of spam.

Footnotes