Spam Oozes Past Border Patrol

U.S. politicians are promising to shield e-mail inboxes from spam, and Congress appears poised to vote on a bill this year. But is there anything legislators can do about spam from overseas? Declan McCullagh reports from Washington.

WASHINGTON -- It's the start of a new session of Congress, which means that legislators are again pledging to save us from the dreaded scourge of spam.

Last week, Reps. Heather Wilson (R-N.M.) and Gene Green (D-Texas) reintroduced a bill they claimed "empowers consumers and their ISP with the ability to protect both their privacy and their resources" by restricting unsolicited commercial e-mail.

Legislators have offered similar measures before, of course, with zero results.

As far back as 1997, Sen. Frank Murkowski (R-Ala.) and Rep. Chris Smith (R-N.J.) were busy talking up their own proposals that purported to eliminate clogged connections and cluttered inboxes.

This time, anti-spam proponents in Congress may have more luck. Last year, the Senate and the House approved different bills. Both stalled and neither became law, but the effort shows that federal legislators are willing to act.

But will a U.S. law even work?

If there's one thing certain about spam, it's that an increasing amount of the stuff is originating from overseas sites and flowing through non-U.S. servers -- all outside the reach of the law.

A newsadmin.com list of the most prolific 100 Usenet spam hosts, for instance, reveals that 52 of them are now offshore. Sites in Russia, France, Greece and the Netherlands are among the worst foreign offenders.

The same appears to be true of e-mail spam: Most of it is still domestic, but a growing proportion lies outside of U.S. jurisdiction.

Statistics compiled by SpamCop, an anti-spam service, show that of the five Internet providers receiving the most spam complaints, three are in the United States and two are not.

Offshore companies also appear to be more tolerant of spammers. According to SpamCop's database of network administrators who are the most sluggish in replying to complaints and whose sites have sent spam in the last week, 25 of the 50 worst offenders are overseas. Topping the list: China, Korea, Thailand and Japan.

Jason Catlett, president of Junkbusters, says: "I've noticed an increase in foreign spam."

If nothing else, it's been a long time since 1994, when the so-called green-card spammers -- Laurence Canter and Martha Siegel -- flooded then-virgin inboxes with unsolicited advertisements, then wrote a book gloating about their efforts.

"The largest proportion of the spam I receive, and most of the complaints that come in, come from relay sources abroad," says Ray Everett-Church of the Coalition Against Unsolicited Commercial Email. "If you could stop spam that's relayed through China, you'd probably stop at least half of the spam in my own inbox."

That hasn't stopped Everett-Church from asking Congress to intervene. CAUCE backs legislation that allows Internet providers to sue spammers, and which allows operators of mail servers to post bulk-mail policies that the public would be obliged to follow.

To be sure, Congress is not entirely hamstrung. It could ban American firms from hiring spammers to advertise products. It could boost criminal penalties so much that spamming from inside the United States no longer is worth the risk.

But determined spammers will move offshore, and foreign spammers will likely broaden their reach: Since the cost of sending bulk e-mail is so low, targeting certain recipients isn't really necessary. (One multilevel marketing spam sent Wednesday to a Wired News address originated in Poland and lists only European mailing addresses.)

"An anti-spam law would be unenforceable for the same reason that anti-gambling laws are unenforceable," says Sonia Arrison, an analyst at the Pacific Research Institute.

"Eventually, if this becomes a huge problem, the market could take care of it by charging spammers to send mail," Arrison says. "Someone could easily write a software program where, for every piece of e-mail I get from someone I don't know, I'd charge them five cents."

There's another risk of Congress acting on spam: CAUCE and other advocacy groups fear that if what they believe is the wrong bill becomes law, it would exacerbate the current situation by explicitly permitting some kinds of bulk e-mail.

Take a bill introduced in the last Congress by Murkowski, which would require Internet providers to maintain public lists of users who don't mind being spammed. Cautions CAUCE: "If an ISP offers a 'spam-free' service and has strong anti-spam policy, it should not be required to make 'holes' in that policy or in its mail filters to accomodate a handful of customers who want unfettered floods of (unsolicited commercial e-mail)."

Some of the bills have even emboldened spammers. The result of a flurry of congressional hearings and press releases has been that spammers have kept on spamming, having added a note to the bottom of each message saying "this e-mail message is being sent in accordance with proposed U.S. Federal regulations for commercial e-mail." It's become such a standing joke that even the Spam Mimic steganography tool mentions it.

As for the Wilson-Green bill that was reintroduced last week, H.R. 95, it seems to be meeting with a mixed response from industry groups.

"We have some problems with certain technical aspects of the bill," says Jerry Cerasale, vice president for government affairs at the Direct Marketing Association. "But the general thrust of the bill we support."

The group's reservations, Cerasale says, lie in the details. The DMA supports ideas such as outlawing phony return addresses and forbidding companies to keep sending mail to individuals who have asked to be removed from lists -- but it says it worries about creating too restrictive an environment for marketers.

Cerasale said one of the problems with the legislation is "it doesn't account for prior relationships. ... They don't define permission-based marketing in there. There needs to be some point of defining what unsolicited commercial e-mail is. We don't think that their definition fully covers when someone opts-in."

The DMA, Cerasale said, is "working with House staff, including Rep. Wilson's staff, to try to see a version of the bill that we can fully get behind."

In a statement accompanying the bill's reintroduction, Wilson said: "As consumers, we should have the power to stop getting junk e-mail on our computers or on the computers of our children. Some estimates are that over one-third of junk e-mail is pornographic, and currently parents are helpless to stop this from entering their home."

Ryan Sager contributed to this report.