Cleaning the Net

Can Washington's anti-spam law find a way to work?

THE STATE OF Washington is supposed to have the toughest law in the country against unsolicited commercial e-mail. Why, then, when local computer users open their in boxes, are the messages from business associates and nearest and dearest often lost in a sea of electronic ads for porn sites, herbal liposuction, and Viagra alternatives?

Lots of reasons: the newness of the law (it went into effect in June 1998), the sheer technical challenge of tracing the origin of messages through the exhilarating anarchy of cyberspace, concerns about throwing out the protein of free speech along with the cartilaginous gristle of “spam.”

But relief at last may be on the way. On Wednesday, the state attorney general filed suit in King County Superior Court against one Sam Khuri of Atlanta, Georgia, sole proprietor of Benchmark Print Supply and widely considered one of the most egregious abusers of the electrosphere in all America, if not the world.

Compared with some of his fellows in the field, Sam the Spam is a straight-arrow legitimate businessman, offering customers mail-order price breaks on laser-printer supplies like toner cartridges. But the AG found grounds to allege no less than six separate violations of Washington law in Khuri’s transmissions. And when you consider that each offense, if proven, entails a $2,000 fine plus court costs, and that Khuri is believed to be responsible for sending millions of messages, you can see that the suit might give Khuri and others in his trade cause to reconsider their way of doing business.

For spam victims, the suit provides a primer on how Washington’s anti-spam law works, what it does and does not forbid.

To start with, Chapter 19.190 of the Revised Code of Washington doesn’t forbid commercial e-mail, even unsolicited commercial e-mail (though a ban on the latter, modeled on the federal “junk fax” statute, may yet come to pass). What it forbids are attempts to take advantage of the built-in anonymity of e-mail to avoid the consequences of behavior that would be illegal in other modes of communication—pyramid schemes, for example, or abetting the theft of satellite service through forged access cards.

The first problem facing a spammer is getting you to read his (yes, “his”—spamming is almost entirely a guy thing) message in the first place. Some do it by including misleading information in the “subject line”—the first thing you see when you open your e-mail program. One favorite from my own spam collection reads, “Sorry it took so long to get back to you,” before trying to sell me the spammer’s credit-card-processing service. According to the suit, Khuri specializes in totally enigmatic subjects like “w37” or “bg08,” perhaps to avoid charges of misidentifying his mail. No matter, says the AG: The practice is likely to mislead the recipient into opening an unwanted message, which “constitutes a per se violation of the Consumer Protection Act.”

A judge might well raise an eyebrow at the idea that “m01-02” is a per se violation of anything, but count two of the AG’s suit, having to do with Khuri’s practice of making his e-mail anonymous and untraceable, is more serious.

For an e-mail to get across the Internet at all, it has to have a “header”: a block of strictly formatted information that records the message’s route across the Web from sender to recipient, machine by machine. Unfortunately, it never occurred to the Netheads who devised the system that anyone would ever want to prevent the recipient from knowing who sent the e-mail or what route it followed. But the last thing a spammer wants is to find his own mailbox full of e-mails from angry victims, so he fakes the name of the sending server on his message’s “Received From:” line, and also the accompanying “Reply To:” address. This ensures that return mail bounces right back to the victim’s machine as “Undeliverable,” thereby adding insult to injury and further cluttering up the Internet pipe-lines with information-free data. So Washington law forbids fiddling with headers and requires every sender to include a legitimate electronic return address. Khuri does neither. Two more counts against him for every e-mail he sends.

THE REASON THE state is spending so much effort to go after what strikes many as a minor inconvenience is simple: Spam costs businesses lots of money, as is detailed in the fifth count in State of Washington v. Sam Khuri. “Defendant routinely uses false identifying information to obtain Internet electronic mail accounts,” reads the state’s complaint. “Upon opening an [account] based on the false identification and credit information, defendant immediately sends unsolicited bulk commercial electronic mail to thousands of recipients . . . before [the account provider] can verify the identification and credit information. Although the [provider] may promptly terminate the electronic mail account, the [mail] has already been sent nationwide at the [providers’] and recipients’ expenses.”

We are not talking small numbers here. Some of the things spammers sell via spam are spamming programs and CD-ROMs filled with millions of (supposedly valid) e-mail addresses. For a couple of hundred dollars, anyone with a get-rich-quick scheme can produce hundreds of millions of bytes of digital waste products—all of it, whether it reaches an end user or just bounces around the Net in circles, wasting bandwidth and storage capacity as well as people’s time.

Jim Kendall, who runs Kitsap County’s Telebyte service provider, estimates that he received, via his business account, hundreds of more or less identical sales pitches from Khuri alone, relayed from unsuspecting service providers all over the world. Junk e-mailings that are an expense and inconvenience to big outfits like AOL.com and ATT’s Worldnet can bring a small outfit like Kendall’s to its knees.

The AG’s office has high hopes for its suit. Washington’s law, drafted in consultation with information-industry insiders and free-speech advocates, seems likely to avoid the legal pitfalls that engulfed some earlier ordinances. Washington’s law has already served as the model for similar statutes in Oregon and California. It can’t stop spam—Telebyte’s Kendall, president of the Washington Internet Service Providers association, doubts that anything short of a flat ban on unsolicited e-mail can do that—but it likely will make it harder for Sam the Spam and his like to pursue their maddening version of the American dream at everyone else’s expense.