Spam

[1]

F.A.Q.

What is spam?

There is no single definition of spam, but everyone agrees that spam is, at a minimum, unsolicited and unwanted e-mail. Whether e-mails must be transmitted in bulk or be commercial in nature in order to be considered "spam" is the subject of debate. So is the question of whether unsolicited e-mail sent to existing customers without prior consent constitutes spam.

Definitions of spam include:

Coalition Against Unsolicited Commercial Email [2] [CAUCE]
Information Technology Association of Canada [3] [ITAC]
bulk unsolicited mail, most of which is of a commercial nature, promoting products or services (Industry Canada [4])
unsolicited bulk electronic messages, usually electronic mail messages but increasingly SMS and MMS messages (text messages and graphics/videos delivered to mobile phones) (National Office for the Information Economy [5] (NOIE) in Australia).

Characteristics typical of spam include:

untargeted and indiscriminate distribution;
disguised identity and address of the originator;
no valid or functional address to which recipients can respond in order to opt out of receiving further unsolicited messages OR failure to respect recipients' requests to stop sending unsolicited messages; and
illegal or offensive content.

What is the problem with spam?

Spam is not just an inconvenience and annoyance to recipients. It shifts the costs of marketing from marketers to consumers, displaces legitimate e-mail, wastes resources, and reduces the productivity of those who have to deal with it.

In particular, spam:

increases the cost of internet service, as ISPs are forced to deal with increased transmission flows, filter e-mail messages and respond to customer complaints, as consumers are forced to spend more time online in order to download unsolicited messages;
causes slower Internet service when servers are overburdened by bulk transmissions;
causes consumers to miss legitimate e-mail messages because they are either lost in the flood of spam, mistaken for spam, or filtered out in the effort to manage spam;
reduces the ability of businesses to rely on e-mail as a communications tool given the likelihood of their messages being filtered out, mistaken for spam, or simply lost in the flood of spam;
costs businesses millions of dollars per year in lost productivity; and
frustrates e-mail users to the point that they give up on e-mail and use other means of communication instead.

The volume of spam has now reached the point at which it threatens the viability of e-mail as a reliable communications medium for businesses and consumers.

What can I do about spam?

Never respond to unsolicited e-mail messages from unknown sources, even to request that they stop sending you messages. That just tells them that you are a live address to which they can send more spam.
If there is a 1-800 number provided in the e-mail, call it and ask to be removed from the list.
Never buy anything in response to a spam advertisement.
Don't open e-mail messages that are obviously spam. They may contain programs that alert the sender to the fact that you have opened the message.
If your e-mail address is posted on the Internet, change the "@" to "at" (or otherwise disguise it) so that it is not automatically recognized as an e-mail address, and thus susceptible to "harvesting [6]" by spammers as they crawl the Internet looking for addresses.
Don't give out your e-mail address to commercial entities without first checking their privacy policies and satisfying yourself that they won't use or share it for marketing purposes.
Use different e-mail addresses for different purposes: e.g., one for communicating with friends and family, one for business, and one for transacting on the Internet.
Use your e-mail service's spam management system - most programs allow you to identify junk e-mail when it comes in, such that any future messages from that address are either blocked or labeled as spam.
Use a spam-blocking or filtering service either provided by your ISP or a third party service such as:
- Spam Filter Review 2004 [7]: List of Top Filtering Technologies
- Giant Company: Spam Inspector 4.0 Software [8]
- Mailshell [9]
- 0spam.net [10]
- Qurb [11]: Qurb 2.0 Anti-Spam Software
- Mailwasher [12]: Mailwasher Pro Software
- Brightmail [13]: Enterprise, Service Provider, Anti-Fraud & Anti-Virus Software Editions Network Associates Inc.
- SpamAssassin Software [14] Version 2.61
- Cloudmark [15]: Spamnet & Authority Software Versions
- Anthony Muttillo Inc. [16]: MailZapper
- McAfee Security [17]: SpamKiller & RedZone Suite Software
- Lyris Technologies: MailShield Software [18]
- Evolvian Software: Spamender Software [19]
- Network Abuse Clearinghouse [20]
- SpamPal [21]
- JunkBusters [22]
- UXN Spam Combat [23]
Report spam to ISPs, government agencies, or others collecting this information such as:
- The Federal Trade Commission in the USA collects spam complaints: uce@ftc.gov [24]
- The Securities & Exchange Commission's Office of Internet Enforcement Complaint Center [25]
- Internet Fraud Complaint Centre [26]
- Spamcop.net [27]
- FlimFlam Dot Com [28]
- National Fraud Information Centre [29], Internet Fraud Watch Email
- The National Consumer Complaint Centre [30]
- Spam Rejection [31]
- Spam Con Foundation Law Center [32]
- Report 4-1-9 Nigerian Advance Fee Fraud Spam [33]
- Report Pyramid Schemes & Chain Letters [34]
- Report e-mails promoting illegal medical products at webcomplaints@ora.fda.gov [35]
- Report emails promoting child pornography & exploitation at CyberSmuggling Center C3@customs.treas.gov [36]
- FBI's Internet Fraud Complaint Center [37] (IFCC)
- Google at spamreport@google.com [38]
- E-Consumers International [39]
If spam is connected to a company located in one of the following countries, you have a case for reporting it to the relevant address.
- Hong Kong: webmaster@ofta.gov.hk [40]
- Germany: mailbox@datenschutz-berlin.de [41]
- Finland: vihje.internet@krp.poliisi.fi [42]
- Australia [43]
- Belgium: spam@privacy.fgov.be [44]
- United Kingdom: data@dataprotection.gov.uk [45]
- Korea: spamcop@kisa.or.kr [46]
- China: spam@ccert.edu.cn [47]
You can also complain about specific spam messages to certain government agencies:
- The Competition Act [48] prohibits misleading advertising. The Competition Bureau accepts online complaints [49] about deceptive spam.
- The Privacy Commissioner [50] also accepts complaints about personal information collected, used and disclosed through commercial spamming activities without your consent. E-mail addresses that can be linked to you constitute "personal information" under the Personal Information Protection and Electronic Documents Act [51]. You can complain [52] about such activities to the Privacy Commissioner.
- The CRTC continues to have jurisdiction over telecommunications and broadcasting, and could initiate proceedings at any time to consider regulation of spam. Complaints can be made to the CRTC [53].
Get involved in, or support, spam-fighting organizations such as CAUCE Canada [54].

What are Internet Service Providers doing about spam?

The Canadian Association of Internet Providers [55] (CAIP) requires that its members abide by a "Fair Practices Document [56]" that includes the following rule:

"CAIP Members will not knowingly allow their services to be used for the transmission of unsolicited bulk e-mail especially unsolicited commercial bulk email between parties that have had no previous commercial relationship."

Like CAIP members, most ISPs have Acceptable Use Policies for their customers, which typically place limits on the volume and type of outgoing e-mail permitted. See, for example, AOLs policy on unsolicited bulk e-mail [57].

In the effort to contain spam and respond to customer demand, most ISPs offer filtering services of one type or another. No filter is 100% effective however, and ISPs must be cautious not to filter out legitimate e-mail messages. For an example, see Bell Sympatico's explanation of its filtering service [58].

CAIP also provides a "tip sheet [56]" for consumers on dealing with spam.

What are others in the industry doing about spam?

The Canadian Marketing Association "CMA" requires its members (who represent about 80% of direct marketers in Canada) to abide by a Code of Ethics [59] that includes a rule against sending unsolicited email other than to existing customers. The CMA has also launched a website for consumers [60] that includes information and tips on spam [61].

A working group of Canadian businesses, consumer organizations and government representatives has developed a voluntary Code of Practice for Consumer Protection in Electronic Commerce [62] that includes the following rule on Unsolicited E-mail:

7. 1 Vendors shall not transmit marketing e-mail to consumers without their consent, except when vendors have an existing relationship with them. An existing relationship is not established by consumers simply visiting, browsing or searching vendors' Web sites.

7. 2 Any marketing e-mail messages vendors send shall prominently display a return e-mail address and shall provide in plain language a simple procedure by which consumers can notify vendors that they do not wish to receive such messages.

The Anti-spam Research Group [63] (ASRG), under the umbrella of the Internet Research Task Force [64], is investigating large-scale technical solutions to the spam problem. The self-regulatory online privacy trustmark Truste [65] offers a certification program [66] that allows eligible websites to display a "We don't spam' seal if they agree to practices such as obtaining consent from consumers before sending commercial e-mail and offering an "unsubscribe" option that is easy to use and responsive.

Does Canada have anti-spam laws?

No. The distribution of unsolicited promotional and product information over electronic networks per se is neither illegal nor regulated in Canada. However, fraudulent practices and misleading representations are illegal, and privacy laws require an individual's consent to the collection and use of their e-mail address where it can be traced to them.

The Personal Information Protection and Electronic Documents Act [51] (PIPEDA) requires that organizations obtain the knowledge and consent of individuals to the collection, use or disclosure of their personal information, except in specified situations. E-mail addresses are generally considered "personal information" since they can be associated with an identifiable individual. The federal Privacy Commissioner has found unsolicited marketing e-mail to violate PIPEDA in two reported cases [67]. However, these findings are not legally binding, and there is no penalty associated with them. See CIPPIC's Privacy [68] FAQs and Resources for more information on PIPEDA and related provincial laws.

In addition, the Criminal Code [69] prohibits fraud, and the Competition Act [70] prohibits misleading advertising. To the extent that spam is either misleading or fraudulent, it can be captured under these laws.

In 2003, two Private Member's Bills: C-460 [71] (which would make spamming a criminal offence), and S-23 [72] (which would set up a "do not spam" list, among other things) were introduced in Parliament, but later died on the order paper when Parliament was prorogued. Bill S-23 was re-introduced in 2004 as Bill S-15 [73], "An Act to Prevent Unsolicited Messages on the Internet". Senator Donald Oliver is the sponsor of this bill.

What is the Canadian government doing about spam?

On May 11, 2004, Industry Canada announced a six-point action plan [74] to address spam. The plan calls for:

more effective use of existing laws to reduce spam;
review of existing laws to identify any regulatory or legislative gaps;
improving network management practices and industry codes of practice;
using technology to validate legitimate commercial communications;
enhancing consumer education and awareness; and
promoting an international framework to fight spam.

A multi-stakeholder Task Force [75] was established to oversee implementation of the action plan. It rendered its report [76] in May 2005, calling for targeted anti-spam legislation, more rigorous enforcement measures, more effective industry self-regulation, and a focal point within government to coordinate actions against spam and other threats to the Internet such as spyware. A consumer education campaign, under the banner "Stop Spam Here [1]" was launched by the Task Force, and a set of best practices for industry was put forward.

It is expected that the federal government, though Industry Canada, will act on the Task Force's recommendations in 2005/2006.

The previous policy articulated by the Canadian government on spam was set out in a July 1999 document [4] in which Industry Canada (IC) noted that spam can be tackled by educating consumers, encouraging industry stakeholders to develop good business practice, and enforcing provisions of current legislation. This approach has been criticized [77] as ineffectual.

In January 2003, IC released a discussion paper [78] acknowledging that the problem had become serious, and invited comment on issues including the definition of spam, the efficiency of filtering technologies, and appropriate solutions to the spam problem. A number of interested parties commented, including:

CAUCE Canada [79]
Public Interest Advocacy Centre [79]
The Canadian Association of Internet Providers [79]
Information Technology Association of Canada [3]

Doesn't the CRTC regulate spam?

No. In 1998/99, the Canadian Radio-Television and Telecommunications Commission (CRTC) held a public proceeding to consider how, if at all, it should regulate the Internet. In the resulting decision [80], the Commission did not address the problem of spam and chose to leave the Internet largely unregulated. The CRTC does, however, regulate telemarketing [81].

How can I have input into Canadian policy-making on spam?

Industry Canada, through its Electronic Commerce Directorate [82], is taking the lead on spam policy at the federal level. The Anti-Spam Task Force is developing an action plan, and invites your input [83]. You can also write to the Minister of Industry (Minister.Industry@ic.gc.ca [84]) urging him to act on the issue.

The Competition Act [48] prohibits misleading advertising. The Competition Bureau accepts online complaints [49] about deceptive spam.

The Privacy Commissioner [50] also accepts complaints about personal information collected, used and disclosed through commercial spamming activities without your consent. E-mail addresses that can be linked to you constitute "personal information" under the Personal Information Protection and Electronic Documents Act [51]. You can complain [52] about such activities to the Privacy Commissioner.

The CRTC continues to have jurisdiction over telecommunications and broadcasting, and could initiate proceedings at any time to consider regulation of spam. Complaints can be made to the CRTC [53].

You can lobby your M.P. [85]to support legislation designed to minimize the problem of spam.

You can also join anti-spam groups such as CAUCE Canada [54].

What are other governments doing about spam?

In late 2003, the USA enacted nation-wide anti-spam legislation, entitled Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 or the "CAN-SPAM Act of 2003 [86]". This new law took effect on January 1st, 2004. This federal legislation pre-empts state laws on spam. Some elements of the CAN-SPAM Act 2003 include:

prohibition of deceptive subject headings and misleading information
prohibition of falsified routing information
requirement for an operational opt-out mechanism with identity and physical address of sender, and
a study on the potential of a do-not-email registry in the near future.

The US Federal Trade Commission "FTC" has engaged in law enforcement actions [87] against deceptive commercial email and spammers who don't honor their "remove me" claims, and has engaged stakeholders [88] in an effort to identify effective ways of dealing with spam.

States that have Anti-Spam Law [89]
Alabama Alaska [90] Arizona [91] Arkansas [92] California [93] Colorado [94] Connecticut [95] Delaware [96] Florida [97] Georgia [98] Hawaii Idaho [99] Illinois [100]	Indiana [101] Iowa [102] Kansas [103] Kentucky Louisiana [104] Maine [105] Maryland [106] Massachusetts Michigan [107] Minnesota [108] Mississippi Missouri [109] Montana	Nebraska Nevada [110] New Hampshire New Jersey New Mexico [111] New York North Carolina [112] North Dakota [113] Ohio [114] Oklahoma [115] Oregon [116] Pennsylvania [117]	Rhode Island [118] South Carolina South Dakota [119] Tennessee [120] Texas [121] Utah [122] Vermont [123] Virginia [124] Washington [125] West Virginia [126] Wisconsin [127] Wyoming [128]

Australia has enacted two federal laws on spam: Spam Act 2003 [129] and Spam (Consequential Amendments) Act 2003 [130]. In addition, the National Office for the Information Economy of Australia issued a detailed report on spam [131].

A European Union Directive [132] requires all EU members to adopt strong anti-spam legislation that, among other things, prohibits the sending of commercial e-mail without the recipient's prior consent (i.e., takes an "opt-in" approach to consent). As of December 2003, most EU countries, including the UK, had taken steps to adopt legislation compliant with the Directive, and others were being pressured to do so expeditiously.

The Organization for Economic Cooperation and Development "OECD" has developed Guidelines for Consumer Protection in the Context of Electronic Commerce [133] and is working on guidelines specific to spam.

Resources

Governmental Initiatives re: Spam

Canada

Industry Canada [75] (IC) web page on spam
Canadian Code of Practice for Consumer Protection in Electronic Commerce [134]
Spam Task Force [75] (Industry Canada)
CRTC Decision not to regulate internet/spam (1999)

USA

United States CAN-SPAM Act [86]
Spamlinks.net: Links to US spam legislation [135]
Federal Trade Commission (FTC) Spam page [87] (USA)
FTC Consumer Alert on E-mail Harvesting [6]
SpamCon Foundation Law Center [136]

Australia

Australia's Spam Act 2003 [129]
Australia's Spam (Consequential Amendments) Act 2003 [130]
Coalition Against Unsolicited Bulk Email (CAUBE) [137]
Australian Spam Law Compliance [138]

European Union

European Union Laws on Spam [139]
European Union Directive [132]
Spam Laws in EU Member States [140]
France's New Digital Economy Bill [141] (highly controversial digital bill)

International/Other

Other Countries' Laws on Spam [142] - links to governments of other nations with anti-spam laws
Organization for Economic Cooperation and Development's (OECD) Guidelines for Consumer Protection in the Context of Electronic Commerce [133]

Anti-Spam Organizations

CAUCE [54] Canada - includes links to other CAUCE sites
Junkbusters [22] - Tips on handling Spam
The Spamhaus Project [143] - UK web page containing spam info. & Top 150 known spammers (ROKSO)
UXN Spam Combat [23] - part of Spamhaus Project
Anti-Spam Research Group [144] - Taxonomy of the problem and solutions of spam
Center for Democracy and Technology spam page [145] (USA)
Electronic Privacy Information Center spam page [146] (USA)
Telecommunications and Research Action Center [147] - Ban the Spam webpage (USA)

Private Anti-Spam websites

Stop Spam Here [1] - Canadian initiative
Be Web Aware spam page [148]
Spam.org [149] - Useful Information on Reducing Spam
Get Net Wise [150] - Using Tools and Action against Spam
Fight Spam on the Internet [151]
Death to Spam [152]: Guide to Dealing with Unwanted email
Self-Help Remedies on Spam [153]
Self Proclaimed Spam Fighter's web page [154]
Spam Awareness [155] Spam information web page with links and resources
Promoting Responsible Net Commerce [156]
Managing Spam [157]: A Call to Action
SpamPal [21]: E-mail Classification Program
Spam Prevention Early Warning System [158]
SpamArchive [159] - Testing, Developing and Benchmarking Anti-spam Tools
SpamNEWS [160] - information relevant to professionals in the anti-spam sector
Open Relay Database [161] - Industry organizations and initiatives re: spam
The Canadian Association of Internet Providers [55] (CAIP)
Canadian Marketing Association [59] - Code of Ethics

Anti-Spam Laws, Bills, Directives and Cases

United States Federal Law on Spam [86]
Other Countries' Laws on Spam [142]
European Union Laws on Spam [139]
European Union Directive [132]
Australia's Spam Act 2003 [129]
Australia's Spam (Consequential Amendments) Act 2003 [130]
France's New Digital Economy Bill [162]
CRTC Decision on Internet Regulation [80]
John Marshall Law School Cases on Spam [163]

Spam Reports

Phrack Magazine [164]: A description from Phrack Magazine of how IP spoofing works and how it can be prevented, "IP-Spoofing Demystified"
CAUBE.AU [165], "Spam Volume Statistics"
Federal Trade Commission's Division of Marketing Practices 2003, "False Claims in Spam [166]"
Federal Trade Commission's "You've got Spam: How to 'Can' Unwanted E-mail? [167]"
Center for Democracy & Technology, "Why Am I Getting All This Spam? Unsolicited Commercial E-mail Research: Six Month Report [168]"
Paul Hoffman & Dave Crocker, "Unsolicited Bulk Email: Mechanisms for Control [169]"
Paul Hoffman & Dave Crocker, "Unsolicited Bulk Email: Definitions and Problems [170]"
Lilian Edwards, "Canning the Spam: Is There a Case for Legal Control of Junk Electronic Mail? [171]"
Jonathan Byrne, "Squeezing Spam Off the Net: Federal Regulation of Unsolicited Commercial Email [172]" (1998) 2 W.Va. JL and Tech 4
Anti-Spam Research Group, "Internet Service Providers' Consortium Position Paper [173]"
National Office for the Information Economy (NOIE), "The Spam Final Report [174]"

This page last updated: June 2, 2007

Researched and compiled by Sukesh Kamra, LL.M.

Spam

Spam

Contents

Resources

Governmental Initiatives re: Spam