« The Impatience Factor | Main | (In)Security »

December 19, 2004

Here's my proposal to the Federal Trade Commission: Triple penalties for claiming CAN-SPAM compliance when you don't even come close.

A very strange (to me, anyway) message arrived into my server's Suspects bin, and it really got my dander up. The subject is:

Microsoft net frame download

The From: line displayed a name "Net Frame" with an email address at the pop.net domain. Here is the full body text (stupidly included template verbiage removed; spamvertised URL and removal address munged):

Microsoft Net Frame downloads, click here <http://www.some_long_domain_name.com>
Critically important downloads for all Windows computer users running non-Windows applications to insure interoperability.
2004 Can Spam Compliant
For removal from the net frame mailing list, please click on the following mail link, type 'remove' in the subject line and send. something_with_remove@popular_ISP.net

The domain name in the spamvertised URL was made up of several words, including things like "alarm," "phone," "security," and the like.

Anytime a spam message comes along promoting some kind of system software update, the last thing you want to do is download anything from that site. In this case, a lot of recipients may be quite perplexed as to what kind of downloads are involved. Perhaps he meant .Net frameworks. I'm not a .Net programmer, so perhaps "net frame" is in the regular lingo. That phrase, however, doesn't show up when searching Microsoft Developer Network.

At this point, the message really reeks to my nose. I wouldn't touch this Web site with a securely firewalled Macintosh, much less a Windows machine. As much as I promote the notion of ZERO RESPONSE to spam, the proclamation of CAN-SPAM compliance in this otherwise non-commercial spam lured me to get to the bottom of it. I logged onto a remote Unix system and used the text-based Lynx browser to see what's at the end of the URL.

The top part of the page has numerous links claiming to lead to a variety of Windows-related downloads. Those links are actually to Microsoft's download pages (the real ones). So this guy is not offering bogus system upgrades. Yet why is he spamming me to tell me about Microsoft system upgrades?

Lower in the page comes his commercial spiel for security gizmos. In other words, this guy is selling security gear via spam, should you fall for his rather cryptic download ploy.

I imagine his CAN-SPAM defense is that his spamvertised URL delivers exactly what the spam message says it would. And because CAN-SPAM allows him to spam me without my consent, it's OK to offer an opt-out link to "the net frame mailing list" to which I never subscribed.

Instead, I see the message (and its From: and Subject: lines) to be purely misleading as to the intent of the sender. Something tells me that he really doesn't care all that much whether recipients upgrade their Windows computers.

But he's in the clear, right? After all, he says the message is "Can Spam Compliant." Well, no. Even if the message were deemed in court to not be misleading, the message fails to provide a postal mailing address for removal. Oops.

Most recipients, however, don't know enough about the CAN-SPAM law to evaluate a message in that light. Spammers like to use false claims of compliance to shove their spew down our throats, under the assumption that if it's The Law, then we have to take it. Well, we don't have to take it. And if they incorrectly use that claim as a weapon, then they should pay a stiff penalty for that betrayal of trust. I mean, it's almost like impersonating an enforcement official.

As I say in Spam Wars, "[T]he more strident the claim, the less likely the sender cares one whit about the law." To me, a false compliance claim is an intentional, mean-spirited deception that deserves commensurate punishment.