Spam remains a tough problem for legislation

Net Results: The good news is that less and less of the spam you get in your inbox is trying to sell you Viagra, Rolex watches…

Net Results: The good news is that less and less of the spam you get in your inbox is trying to sell you Viagra, Rolex watches or low-cost mortgages.

The bad news is that, while it still appears as if these things are being offered to you, in reality the message is just a way of getting you to click and open your PC (or corporate network) to viruses, spyware, and crippling denial of service attacks. The harbinger of this news was UCC law professor Steve Hedley, who gave a fascinating talk at Trinity College, Dublin on Tuesday evening about what might be done, legally, to stem the proliferation of spam (unsolicited commercial email).

In his talk, sponsored by the Dublin Legal Workshop and the Systems Administrators Guild of Ireland, Prof Hedley noted how, almost as soon as it was possible to communicate by electronic messages sent over a network, this capability was exploited by a "spammer".

The man with that honour was Gary Thuerk, a US computer salesman who, on May 3rd, 1978, painstakingly typed in 590 addresses to bombard every person on the embryonic internet with a pitch for computers from Digital.

READ MORE

But it took a couple of lawyers to figure out that the internet was an ideal, free communications medium for blasting out thousands of commercial messages - in this case, for help with US immigration. On April 12th, 1994, Martha Siegel and Laurence Canter sent every Usenet group (the early internet bulletin discussion board network) such a message. "They annoyed a lot of people, and later on wrote a book saying how clever they were to have done it," says Prof Hedley.

Such vigilantism - approaching spam as a problem of netiquette - was the only early response to spam. A new approach then emerged as spam began to becomemore of a nuisance to individuals and internet service providers and businesses, whose networks were getting clogged with the stuff. People decided to tackle spammers with the law.

At first, people went after spammers as abusers of the rights of the individual - the idea being that victims could "make good their losses" against spammers.

Lawyers tried to show that spam was a breach of contract (for example, the abuse of one's usage contract with an ISP), or a breach of trademark (unauthorised use of the word Viagra or Rolex, for example), or a trespass on computer systems, or a data protection problem.

"Mostly, the arguments have failed," says Prof Hedley. "What the law is doing at the moment is treating spam as a source of petty crime," he says. But this is problematical. There are Irish regulations in the area, he says, but they don't ban all spam. The legal mechanisms, he says, "are slow and uncertain". He knows of no Irish prosecutions under the law, and none so far in the UK under general EU laws.

Irish regulations - which exempt political parties from spam laws - are"so timid", he says,because mainstream commercial firms would love to send carefully targeted emails to customers, and the regulations have to take into account the data protection act.

"Very little spam is genuinely trying to sell you something," says Prof Hedley. "Much is simply fraudulent, used to circulate viruses, or spyware." One study showed that slightly less than half of all Viagra spam messages actually sent real Viagra to purchasers, he says - and he's surprised the percentage was that high.

"My guess is that there are very few spammers left, but those who are left are remarkably good at what they do," he says. Now, they tend to be self-described "spam kings" - including one American mass-spammer who even had his own "Spam King" jeans line, until Spam luncheon meat manufacturer Hormel went after him for trademark abuse.

Much of today's spam is from American spammers, but sent through networks in Asia and Brazil, he says. As nations create laws against domestic spam, the mass spammers simply move abroad to send the junk mail from new jurisdictions.

How might the problem - which now costs billions to consumers, governments and businesses annually - be solved? Prof Hedley offers three possibilities, but all, he notes, are problematical.

If there were a way to absolutely verify the identification of the sender of emails, the problem could be solved - but this introduces serious civil liberties and privacy infringements that are unlikely to, and shouldn't be, overcome, he says.

Co-ordinated international action will help, but getting the whole world to act together seems like a pipe dream.

Greater state involvement in security will help too, as governments move towards requiring installation of patches, virus definitions and other protective measures for computer systems.

But Prof Hedley's final conclusion offers little comfort to those irritated by the constant junk-mail pile-up in their inbox: what can be done legally is pretty much being done at the moment, he says.

Sadly, "the wider problem may not be solvable at all".

Karlin Lillington

Karlin Lillington

Karlin Lillington, a contributor to The Irish Times, writes about technology