_____________________________________________________________________________________________________

Monday, September 15, 2008

Constitutional Spam

Jeremy Jaynes walked out of prison yesterday.

Never heard of Jeremy Jaynes?

Chances are you've gotten email from him, especially if you have an AOL account.

Jaynes was the first convicted felony spammer. He was sent to prison for nine years by Virginia Circuit Court Judge Thomas Horne in 2004 for sending thousands of unsolicited, anonymous emails to America Online users. He claimed it was his right to do so under the 1st Amendment.

Yesterday, the Virginia Supreme Court agreed with him, and today he is a free man.

Yesterday, the Virginia's high court reversed itself and struck down a state anti-spam law, passed in 2003, declaring that the law violated Constitutional First Amendment rights to free and anonymous speech.

There is no doubt that Jaynes committed the act for which he was convicted - he sent over 10,000 emails from his home systems in a 24-hour period - in fact he did it at least times in a 30 day period - the emails were unsolicited with randomly generated blocked return addresses and fraudulent IP originators. When police raided his home, they discovered hundreds of compact disks containing over 176 million full e-mail addresses, 1.3 billion user names, and other private account information for mostly AOL subscribers. The information had been stolen from AOL by a former employer and bought by Jaynes. Jaynes was fully aware of the nature of the stolen information. Jaynes then used this information to send tens of thousands of unsolicited emails advertising a FedEx refund claims product, a Penny Stock Picker, and a Internet Browser History "Eraser" via disguised email and multiple Internet addresses.

Neither the possession of stolen information nor his subsequent use of the information is in question.

The question is whether or not Jaynes was protected under the Constitution when he choose to become a spammer.

While that Virginia Supreme Court agreed that Jaynes' actions were egregious, they ruled that he was indeed protected under the Constitution.

The problem with the Virginia law, according to the Virginia Supreme Court ruling, was that it was too broad in scope. Virginia's anti-spam law, the Virginia Computer Crimes Act Code 18 2-152.1 through 18 2-152.15, as currently written, outlaws all forms of unsolicited bulk email (providing the bulk email passes certain thresholds), not just commercial content. In other words, the act infringes on both anonymous political and religious free speech. From section [22] of the ruling,

"The IP address and domain name do not directly identify the sender, but if the IP address or domain name is acquired from a registering organization, a database search of the address or domain name can eventually lead to the contact information on file with the registration organizations. A sender’s IP address or domain name which is not registered will not prevent the transmission of the e-mail; however, the identity of the sender may not be discoverable through a database search and use of registration contact information.12

[12: In this case Jaynes used registered IP addresses, although the domain names were false.]

As shown by the record, because e-mail transmission protocol requires entry of an IP address and domain name for the sender, the only way such a speaker can publish an anonymous e-mail is to enter a false IP address or domain name. Therefore, like the registration record on file in the mayor’s office identifying persons who chose to canvass private neighborhoods in Watchtower Bible & Tract Society v. Village of Stratton, 536 U.S. 150 (2002), registered IP addresses and domain names discoverable through searchable data bases and registration documents “necessarily result in a surrender of [the speaker’s] anonymity.” 536 U.S. at 166. The right to engage in anonymous speech, particularly anonymous political or religious speech, is “an aspect of the freedom of speech protected by the First Amendment.” McIntyre v. Ohio Elections Comm’n, 514 U.S. 334, 342 (1995). By prohibiting false routing information in the dissemination of e-mails, Code § 18.2-152.3:1 infringes on that protected right. The Supreme Court has characterized regulations prohibiting such anonymous speech as “a direct regulation of the content of speech." [emphasis mine]

Frankly, I think this is a load of crap. I think anonymous statements, religious, political, or otherwise are the ultimate form of cowardice. Personally, I doubt that the founding fathers intended freedom of speech to be used as a mechanism to annoy the hell out of the citizenry with anonymous junk mail, electronic or otherwise - especially considering that they themselves risked freedom, liberty, and their own lives by making political statements inciting revolution against the Crown. However, the traditional interpretation of the Constitution guarantee's the people to be anonymous if they so choose, a while I don't agree with the mindset behind it, it is the law of the land and must be upheld.

My formal legal training is restricted to use of deadly force in civilian/military applications and while I am certainly no expert on either the law in general or Virginia law in particular, it is fairly apparent to me that despite widespread condemnation, the Virginia Supreme Court is, of course, correct in its ruling. SCOTUS has repeatedly upheld the right of the people to make anonymous political and religious statements, and the Virginia law clearly violates that right as written.

However, I don't think the spirit of the Constitution guarantees anybody the right to infringe on my privacy or deluge my inbox with unsolicited electronic scams - including religious and political crap that I'm not interested in. It may be your right to speak your mind, anonymously or otherwise, but it is also my right not to have to put up with it, and when you insert your garbage into my computer so that I have to deal with it that's exactly what you're doing.

This is going to be an difficult problem to fix, it's not enough to simply change the law's wording to address only commercial bulk mailings. Jaynes' case not only points out a flaw in the law, it is a call to arms for clever and persistent spammers. See, because this was not Jaynes' first appeal, and this appeal was a major long shot requiring the Virginia Supreme Court to reverse itself - something courts are loath to do - and as such it serves as an inspiration for other spammers.

Because of the complex, convoluted, rapidly evolving and highly technical nature of electronic communications, there will almost always be a loophole for a clever and tenacious spammer to exploit. I can think of a dozen off the top of my head - declare yourself a religious organization for example, or an independent political organization, and claim your spam is fund raising in support of your beliefs - no different from Girl Scouts selling cookies online. Forgive me if I don't outline my other suggestions here, I have no intention of helping the spammers.

Virginia's Attorney general is appealing the ruling to the US Supreme Court, but I expect that Jaynes will remain a free man.

At least until Federal law is changed - and considering the level of technical acumen in Congress, I doubt that will be anytime soon.

Here's what I don't understand though, why wasn't Jaynes indicted on state charges of receiving stolen goods? He knowingly and willingly accepted proprietary information stolen from AOL. In fact, unless every one of those billions of names on his CD's lived in the state of Virginia, he's guilty of interstate receipt of stolen goods, making this a felony. The evidence has been both verified and entered into the court and I'm curious as to why Virginia didn't pursue this course of prosecution. Additionally, why was Jaynes not indicted on federal charges of violating the Privacy Act? Hell, for that matter, why wasn't AOL?

Virginia needs to fix their law, but until the US Government brings the full power of federal law to bear, the spammers will remain free and little more than inconvenienced.

13 comments:

  1. "However, the traditional interpretation of the Constitution guarantee's the people to be anonymous if they so choose, a while I don't agree with the mindset behind it, it is the law of the land and must be upheld."

    I would point to the nom de plume "Publius" and say that the Founders made quite a use of the technique from time to time. :p

    However, there was a real threat of death for the men who wrote as Publius. Don't see that so much today.

    But the real legal principle for outlawing spam is that in some way the spammer expects the recipient to pay for receiving the speech. In both time and money (fraction of bandwidth that I pay for) - I wind up paying for speech I do not want. The4 First Amendment does not protect that. Want to reach people? Set up a website and Google bomb it.

    But still I wonder: Who TF clicks on this stupid shit?

    ReplyDelete
  2. But still I wonder: Who TF clicks on this stupid shit?

    People who are looking for pirated software (which the super cheap "download now" software is), knock-off watches, counterfeit designer goods, cheap drugs and prescription medicines, pornography and other adult material, etc.

    And Jim, I was gonna blog on this myself. Wish I was retired :-).

    ReplyDelete
  3. As John points out, the reason anonymous speech is protected is because someone might be afraid of retalitation. What I would add--and what John misses in his comment--is that retaliation doesn't have to be lethal to be legitimate. An anonymous person might reasonably fear loss of a job, blackballing, or loss of invested time (i.e. loss of benefits upon termination). And while I believe that civil disobedience calls for a person to accept the consequence of illegal activity, I'm not convinced that's the case when one talks about government whistleblowing: I think Mark Felt was entitled to his anonymity and did the nation a service in speaking to Woodward and Bernstein, regardless of his motives in doing so. Similarly, I think Daniel Ellsberg did the nation a service in leaking the Pentagon Papers, which he did anonymously until he eventually turned himself in.

    Just as a consequence of having a Second Amendment is that idiots will own guns, and a consequence of the Fifth and Sixth Amendments is that crooks will have lawyers, a consequence of the First Amendment is that assholes will have the right to send unsolicited junk mail. The sad truth is that most rights will be utilized by unsympathetic people--but the point of having those rights across the board is that we have no way of adequately distinguishing the anonymous asshole who clogs the internet from the anonymous hero who provides a reporter with documentation that shows cigarette companies consistently misrepresented the results of cancer studies and consciously tilted their advertising efforts to reach underage customers.

    Finally, I agree entirely with John (yes, I know, how often does this happen? :-) ) that the legal strategy against spam needs to take account of the fact the reciepient pays for the speech. The major problem with the Virginia statute (and the Virginia court's approach to it) is that it assumes e-mail is free, which technically isn't actually the case--the cost of spamming is shared or even mostly transferred to the person whose drive is filled and bandwidth capped by the spam.

    As a further matter, was Jaynes prosecuted for possession of stolen goods or any kind of wire fraud for having the stolen account information and using it? And if not, why not? It seems to me those would have been the stronger charges to begin with.

    ReplyDelete
  4. Yeah, Eric, when I wrote that I thought about why I'm anonymous - to protect me from employer and regulatory scrutiny in my exercise of free speech. However, I'm not selling anything either - once you are selling stuff, some of that cloak should come down in the name of accountability.

    ReplyDelete
  5. I believe you guys have a point.

    I don't have time at the moment to expound in detail - but the major difference between junk snail mail and junk email, is that junk email costs me money - admittedly not a lot at the moment, but it's my bandwidth and it does have an impact. Additionally, junk email often contains malicious links, fraudulent services or products, and/or pornography. Seems to me there are sufficient issues there to prosecute spammers under current laws regarding such things - and especially if they are crossing state lines and/or international boundaries.

    Eric, what's your take on that?

    And regarding anonymity, I concur. I don't particularly like anonymous political or religious statements, however I do understand why they are necessary. And fortunately for me, I've never been in a position where I needed to worry about retaliation - but that doesn't mean that it doesn't happen and isn't a real worry for a number of folks. John's comment here are particularly relevant I think.

    More on this later, but right now I've got a couple of pending issues that I have to take care of.

    ReplyDelete
  6. I don't know if the government agrees, but I consider my email account and my internet connection to be private property. Speechifiers are free to speechify to their hearts content...in the public square. They don't have that right in my living room. There should be some way to protect me from them invading my private space.

    ReplyDelete
  7. Well, that's how I see it too, Nathan. Personally, while I am a huge believer in Freedom of Speech, I don't see how your freedom of speech trumps my right to privacy.

    Eric is the lawyer here - and I'm interested in his opinion, as always.

    ReplyDelete
  8. What's the purpose of anonymous commercial "speech"? If the spammers are selling pirated software, uh, isn't that a crime? If they are selling Male Gigantism Boosters without a prescription, isn't that a crime?

    The university's spam filter log keeps showing me ad come-ons where the return address is... mine. Um, why don't I remember that great deal for Photoshop? If I sent it that is. If I didn't send it, then you're starting your commercial relationship me with lying -- and why should I believe one encoded bit in the rest of that unread e-mail?

    The real reason for anonymous commercial spam is so that the disgusted users can't find the spammer and hit him in the nuts with nail studded two-by-four. Which, unfortunately, would also be a crime.

    But wasting my time, money, bandwidth, etc., apparently is not.

    Sigh.

    Dr. Phil

    ReplyDelete
  9. Email is free? Spam doesn't cost anything much (except maybe pennies in bandwidth?)

    ::spluttering in indignation::

    Yeah, well, I'm with the carrier in this picture. I acquired, deployed and administered our first spam fitering system. And spam costs us a freaking fortune! That cost gets passed on to the consumer as a broad based increase in price across all our products.

    Hah - now I, too, have a post percolating on this subject too. It's substantively different though, and while I can't use my own employer's info because of my personal moratorium about posting about work, I can do it as a analysis & opinion piece. It'll be a few days though.

    ReplyDelete
  10. Dr. Phil - When I was in the USSR (1989-1991), there was a moratorium on sending certain kinds of computer equipment there due to worries about encryption technology, among other things.

    As a result, computer networks tended to operate in the gray economy, which was dominated by the Russian Mafia as a means of laundering money and keeping in communication with overseas contacts. I have no doubt that many moonlighting KGB officers were involved in this as well. As a result, to this day, computer networks in Russia are heavily invested in by the Mafia.

    So we come to this story. I was not surpised at the crime at all, given the parties involved, just as I was not surprised in the mid-90s when some uranium was confiscated from a karate dojo in Moscow (martial arts were illegal in the 80s and 90s, hence underground clubs were Mafia-owned - no comment on who I worked out with while I was over there).

    My solution to spam: sell AOL and a number of ISPs to the Gambino family and their associates.

    ReplyDelete
  11. sell AOL and a number of ISPs to the Gambino family and their associates

    We're gonna make yous a broadband offer yous can't refuse.


    Brilliant, John, that made me laugh before I finished my first cup of coffee. That's an impressive feat.

    ReplyDelete
  12. If the Russian or other Mafias could be trusted to just take it out on the spammers, that would be one thing. The problem is that collateral damages get pretty widespread.

    That said, my webhosting company is actually German... (grin)

    Dr. Phil

    ReplyDelete
  13. I started writing my spam post and after about an hour I started boring myself. I think I need mafia princesses, semi-automatic weapons, bodies buried in the end zone and probably Vin Diesel with a parachute to make it interesting.

    Another night.

    I am a huge believer in civil liberties - but I hate the way they are abused to protect the most obnoxious forms of advertising on the planet. Somewhere, somehow, there has to be a better balance point. Freedom of speech does not mean that every asshole on the web gets to send me email about V I A G R A.

    Sigh. Vin Diesel needs their address.

    ReplyDelete

Be sure to read the commenting rules before you start typing. Really.