UK: Getting Tough on Spam?

Article prepared for the Journal of Database Marketing & Consumer Strategy Management

Recent estimates suggest that spam now accounts for as much as 60% of all global email traffic¹, a statistic all too evident to most email users. The content of such emails ranges from unwanted business advertisements to attempts at downright fraud. A recent example at the latter end of the scale purported to be from the lawyers of the late Sir Dennis Thatcher, and sought to dupe recipients into thinking they would receive just shy of a million pounds on providing identification information needed under UK inheritance law². This is an example of so-called ‘phishing’, a technique used to lure naive respondents into providing contact or banking details which are then used to extract money from their bank accounts or to create stolen identities.

In December 2003, the UK Regulations³ implementing the Directive on Privacy and Electronic Communications (2002/58/EC), the centrepiece of the EU’s armoury of recent anti-spam legislation, came into effect4. The Directive has also been implemented in many of the other Member States of the EU, although the means of its incorporation into the national laws of individual countries has varied. The Unites States’ CAN-SPAM Act followed shortly afterwards, taking effect in January 2004, and other countries around the world have also introduced recent anti-spam legislation⁵

This means that it is now over a decade since spam emails first started arriving in our inboxes⁶, and the new legislative regimes in Europe and the US are now just over a year old. This article takes a look at the present state of the global problem of spam, and assesses the extent to which the new laws are succeeding. Some of the other non-statutory initiatives being taken around the world are also considered.

Email spamming is a global problem. It has arisen principally because email, in contrast to other more traditional means of relaying information, is (once appropriate systems are in place) virtually free to send and capable of reaching a huge target audience, across all corners of the globe. This means that the spammers’ activities can be commercially viable even though the take up rate from spam emails is relatively small⁷.

Although email users worldwide feel the effects of spam, the vast majority of it is thought to originate from a small number of discrete sources. Indeed, it has been suggested that 80% of the spam received by Internet users in North America and Europe is sent by a mere 200 spamming outfits comprising 500-600 professional spammers⁸; and recently, a single individual was arrested in the US, accused of sending a staggering 1.5 million spam emails⁹. The spam sources’ geographical distribution is also far from uniform – a recent study suggests that over three quarters of the world’s spam comes from a mere 5 countries, with over 40% of it originating from the US¹⁰.

This background makes the legislators’ objectives of reducing spam intrinsically difficult, because in most cases it will originate from outside their jurisdictions, and from a small number of dedicated spammers who are unlike to pay heed to any new laws. It also provides a difficult environment for respectable marketing companies which have to deal with the regulations imposed to curb spam and to differentiate themselves from the spammers and their overly intrusive practices.

The UK Government implemented Directive 2002/58/EC (via the Regulations) with effect from the end of 2003, and although the majority of the other EU Member States have now done so, there are still some exceptions¹¹. The Commission has started legal proceedings against some of those Member States, and it is still in the process of examining the new laws enacted to check their conformity with the Directive.

Indeed, there are differences in the ways in which the Directive has been implemented in the Member States which have adopted it, some of which at least stem from the different options for implementation available under the Directive itself. One notable example concerns whether or not ‘legal’ persons such as companies (as opposed to ‘natural’ persons such as individuals) have to ‘opt-in’ before they can be sent legitimate unsolicited direct marketing communications. Commentators have suggested that the UK’s Regulations take a soft approach. The UK, like France¹² which is thought to be Europe’s leading source of spam¹³, has adopted an opt-out model for legal persons, meaning that they can be sent unsolicited emails without their prior consent having been obtained¹⁴. It has also been suggested that the penalties for non-compliance are too lenient in the UK, and that enforcement is ineffective¹⁵. This contrasts with other Member States such as Italy, which has implemented legislation that adopts the opt-in regime for legal persons (as well as for natural ones)¹⁶ and imposes significant fines and even jail terms for persistent spammers¹⁷

Given the difficulties identified above, it is hardly surprising that the Council of the EU has recently invited the Commission to evaluate whether the differences in national laws on privacy and electronic communications, including those which have arisen from implementing the Directive, could represent an obstacle to effective cross-boarder enforcement. Similarly, these problems may also explain why it is seeking to encourage other anti-spamming initiatives such as co-operation on enforcement and exchange of information within the EU and the investigation of other solutions aimed at combating spam¹⁸.

In the US, which as noted above is thought to be top of the league when it comes to sources of spam, the CAN-SPAM Act¹⁹ has been in force since 1 January 2004. This federal US legislation followed a number of earlier anti-spam Bills considered by the US legislature over several years²⁰, and is specifically aimed at curbing the problem. However, the regime it introduced was completely opt-out, meaning that unsolicited emails could be sent without consent to natural persons as well as legal ones (in contrast to the Directive which provides an opt-in regime for natural persons)²¹. This and other aspects of the legislation have led to vocal US anti-spam activists deriding the new legislation, which some now refer to as the ‘You-Can-Spam’ Act²². Some have even suggested that the Act compounds the problems of spam, by encouraging unsuspecting recipients to click on opt-out or unsubscribe links in unwanted emails, which, for spam at the lower end of the reputability scale, could be dangerous²³.

That said, there have been some successes. For example, a case has been recently settled between the US Federal Trade Commission (FTC) and a company accused of sending millions of illegal e-mail messages to market bogus diet patches. The FTC claimed that the company had breached a number of federal US laws including the CAN-SPAM Act. According to the FTC, the settlement bars the defendants from violating CAN-SPAM, from making false or misleading claims about their products or services, and from making unsubstantiated health, efficacy or safety claims²⁴. There have also been a number of other high profile US anti-spam cases²⁵.

In addition to the legislative changes, several other anti-spam initiatives are being taken around the world. On the technical side, methods of filtering emails are becoming more sophisticated, and individual companies are, through use of appropriate IT systems and internal procedures, taking steps which seek to minimise the volumes of spam that get through. Techniques include:

Blacklisting – This involves rejecting emails from particular blacklisted sources; e.g. through subscribing to a particular lists of spam sources set up for that purpose. It does of course require confidence in the compilers/maintainers of the lists, and there is always the danger that a legitimate email may be prevented from getting through.

Whitelists and Approved Channels – These work in the opposite way by only permitting emails that are from know sources or sent via approved channels. They rely on businesses maintaining the approved lists and on their contacts having been informed of and using the correct channels. For many businesses they may be unduly restrictive.

Email address concealment – Many companies are seeking to minimise the exposure of their email addresses and those of their employees; e.g. by swapping or inserting words such as "remove-this" within email addresses posted on their websites to ensure they are not read correctly by parsing software, or by not posting email addresses on their websites at all.

Filtering – Filtering systems are becoming more sophisticated, by for example singling out near identical messages sent to many recipients, as well as by simply picking out emails containing particular keywords unlikely to appear in legitimate communications.

The costs to business of some these systems and practices can be prohibitive however, and because they are seeking to treat the problem rather than prevent it, technical methods are unlikely to ever provide a complete solution.

Other new initiatives are being taken however which do seek to stop spam at its source, and many of these involve international cooperation. Within the EU, 13 countries have reached an agreement to share information and pursue complaints across their borders in a pan-EU drive to combat spam, and the remaining EU Member States are being encouraged to follow suit²⁶. Since most of world’s spam originates from outside the EU, it is to be welcomed that the EU has also united with Asia in its recent anti-spam drive. A joint statement of international cooperation on spam followed the Asia-Europe conference on e-Commerce held in London on 21/22 February 2005 which involved China and South Korea, two countries in the world’s five spam sources which account for around 22% of the world’s spam combined²⁷. The US too has been taking international non-legislative initiatives, with the FTC announcing an Action Plan on Spam Enforcement in which it joined forces with 19 enforcement agencies from 15 countries around the world in October last year²⁸.

Email spamming is still a growing, global problem that faces both email users and legitimate marketing businesses. The new laws operating in the EU and US are unlikely, as they stand, to rein in the small band of dedicated spammers who generate the majority of unwanted email traffic. Likewise, the ever more sophisticated technical solutions to spam, whilst they may ease the effects of the problem, they will probably never provide a complete solution. However, it is hoped that these measures, combined with the trend of growing international cooperation between countries that include the world’s principal sources of spam, will finally start to tackle the problem, and that the steps taken will start to have more of an effect on the spammers than on legitimate marketing companies.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.