[Senate Report 108-170]
[From the U.S. Government Publishing Office]
Calendar No. 288
108th Congress Report
SENATE
1st Session 108-170
======================================================================
THE CRIMINAL SPAM ACT OF 2003
_______
October 22, 2003.--Ordered to be printed
_______
Mr. Hatch, from the Committee on the Judiciary, submitted the following
R E P O R T
[To accompany S. 1293]
The Committee on the Judiciary, to which was referred the
bill (S. 1293) to criminalize the sending of predatory and
abusive e-mail, having considered the same, reports favorably
thereon, with an amendment in the nature of a substitute, and
recommends that the bill, as amended, do pass.
CONTENTS
Page
I. Purpose and Summary..............................................1
II. Background and Need for the Legislation..........................2
III. Discussion.......................................................2
IV. Legislative History..............................................5
V. Votes of the Committee...........................................5
VI. Section-by-Section Analysis......................................5
VII. Cost Estimate....................................................6
VIII.Regulatory Impact Statement......................................7
IX. Changes in Existing Law..........................................7
I. Purpose and Summary
The purpose of S. 1293, the ``Criminal Spam Act of 2003,''
is to criminalize the sending of bulk commercial e-mail
(commonly known as ``spam'') through fraudulent and deceptive
means. The bill amends title 18, United States Code, to
prohibit five principal techniques that spammers use to evade
filtering software and hide their trails. Penalties for
violations of the new criminal prohibitions include
imprisonment, fines, and forfeiture of proceeds. Offenders may
also be subject to civil enforcement actions brought by either
the Department of Justice or by an Internet Service Provider
(``ISP'').
II. Background and Need for the Legislation
Sophisticated spammers send millions of e-mail messages
quickly, at an extremely low cost, with no repercussions. The
sheer volume of spam, which is growing at an exponential rate,
is overwhelming entire network systems, as well as consumers'
in-boxes. By the end of the year 2003, it is estimated that
fifty percent of all e-mail traffic will be spam.
The rapid increase in the volume of spam has imposed
enormous costs on our economy. A recent study by Ferris
Research estimates that spam will cost U.S. businesses more
than $10 billion in 2003 as a result of lost productivity and
the need to purchase more powerful servers and additional
bandwidth, configure and run spam filters, and provide help-
desk support for spam recipients. The costs of spam are
significant to individuals as well, including time spent
identifying and deleting spam, inadvertently opening spam,
installing and maintaining anti-spam filters, tracking down
legitimate messages mistakenly deleted by spam filters, and
paying for the ISPs' blocking efforts.
And there are other prominent and equally important costs
of spam. It may introduce viruses, worms, and Trojan horses
into personal and business computer systems, including those
that support our national infrastructure. It has become the
tool of choice for those who distribute pornography and indulge
in fraud schemes. Rarely a minute passes without American
consumers and their children being bombarded with e-mail
messages promoting pornographic web sites, illegally pirated
software, bogus charities, pyramid schemes and other ``get rich
quick'' or ``make money fast'' scams.
Spam also offers fertile ground for deceptive trade
practices. The Federal Trade Commission estimates that nearly
66 percent of spam contains some kind of deception, either in
the content, the ``subject'' line, or the ``from'' line. And an
astonishing 90 percent of spam involving investment and
business opportunities contains indicia of false claims. This
rampant deception has the potential to undermine Americans'
trust of valid information on the Internet and threaten the
future viability of all e-commerce.
ISPs are doing their best to shield customers from spam,
blocking billions of unwanted e-mails each day, but the
spammers are winning the battle. Among the barriers ISPs face
when attempting to stop spam is that spammers use false and
fraudulent means to avoid detection and identification. The
Criminal Spam Act takes initial steps to address this problem.
III. Discussion
The Criminal Spam Act prohibits five deceptive techniques
that spammers use to evade filtering software and get their
unwanted e-mails into America's inboxes.
First, the bill prohibits hacking into another person's
computer system and sending bulk spam from or through that
system. This would criminalize the common spammer technique of
obtaining access to other people's e-mail accounts on an ISP's
e-mail network, for example by password theft or by inserting a
``Trojan horse'' program--that is, a program that unsuspecting
users download onto their computers and that then takes control
of those computers--to send bulk spam.
Second, the bill prohibits using a computer system that the
owner makes available for other purposes as a relay or
retransmission point for bulk spam, with the intent of
deceiving recipients as to the origins of the spam. This
prohibition would criminalize another common spammer
technique--the abuse of third parties' ``open'' servers, such
as e-mail servers that have the capability to relay mail, or
proxy servers that have the ability to generate or retransmit
e-mail, such as ``form'' e-mail utilities on Web servers.
Spammers commandeer these servers to send bulk commercial e-
mail without the server owner's knowledge, either by
``relaying'' their e-mail through an ``open'' e-mail server, or
by abusing an ``open'' proxy server's capability to generate or
retransmit e-mails as a means to originate spam. In some
instances the hijacked servers are even completely shut down as
a result of tens of thousands of undeliverable messages
generated from the spammer's e-mail list.
Third, the bill prohibits falsifying the header information
that accompanies e-mail, and sending bulk spam accompanied by
or containing that false header information. More specifically,
the bill prohibits forging information regarding the origin of
an e-mail message, the route through which the message
penetrated, or attempted to penetrate, ISP filters, or
information authenticating the user for network management or
network security purposes--for example, as a ``trusted sender''
who abides by appropriate consumer protection rules. The last
type of forgery will be particularly important in the future,
as ISPs and legitimate marketers develop ``white list'' and
similar rules and technologies whereby e-mailers who abide by
self-regulatory codes of good practices will be allowed to send
e-mail to users without being subject to anti-spamming filters.
There is currently substantial interest among marketers and e-
mail service providers in ``white list'' technology solutions
to spam. However, such ``white list'' systems would be useless
if outlaw spammers are allowed to counterfeit the
authentication mechanisms used by legitimate e-mailers.
Fourth, the bill prohibits registering for multiple e-mail
accounts or Internet domain names using information that
falsifies the identity of the actual registrant, and sending
bulk e-mail from those accounts or domains. This provision
targets deceptive ``account churning,'' a common outlaw spammer
technique that works as follows: The spammer registers (usually
by means of an automatic computer program, or by means of
individuals located in other countries) for large numbers of e-
mail accounts or domain names, using false registration
information, then sends bulk spam from one account or domain
after another. This technique stays ahead of ISP filters by
hiding the source, size, and scope of the sender's mailings,
and prevents the e-mail account provider or domain name
registrar from identifying the registrant as a spammer and
denying his registration request. Falsifying registration
information for domain names also violates a basic contractual
requirement for domain name registrations.
Fifth, the bill addresses another significant hacker
spammer technique for hiding identity that is a common and
pernicious alternative to domain name registration--hijacking
unused Internet Protocol (``IP'') addresses and using them as
launch pads for spam. Hijacking large blocks of IP address
space is not difficult: Spammers simply falsely assert that
they have the right to use that space, and obtain an Internet
connection for the addresses. Hiding behind those addresses,
they can then send vast amounts of spam that is extremely
difficult to trace.
Penalties for violations of these prohibitions are
graduated. Recidivist offenders under federal or state anti-
hacking or spam laws and those who send spam in furtherance of
another felony may be imprisoned for up to five years. Large-
volume spammers, those who hack into another person's computer
system to send bulk spam, those involved in offenses involving
20 or more falsified e-mail accounts or 10 or more falsified
domain names or any combination thereof, those who cause more
than $5,000 in ``loss'' as defined in 18 U.S.C. Sec. 1030
during a one-year period, those who, as a result of the
offense, obtain anything of value aggregating $5,000 or more
during a one-year period, and spam ``kingpins'' who use others
to operate their spamming operations may be imprisoned for up
to three years. Other offenders may be fined and imprisoned for
no more than one year.
Convicted offenders are also subject to forfeiture of
proceeds and instrumentalities of the offense, and the U.S.
Sentencing Commission is directed to consider sentencing
enhancements for offenders who obtained e-mail addresses
through improper means, such as harvesting and randomly
generating e-mail addresses (in what is known colloquially as a
``dictionary attack''), or who know that commercial e-mail
addresses contain or advertise an Internet domain for which the
registrant has provided false registration information.
In addition, as a supplement to criminal enforcement, the
bill provides for civil enforcement by the Department of
Justice and aggrieved ISPs against spammers who engage in
conduct that the bill prohibits, as well as anyone who
conspires with them.
Finally, because an effective solution to the spam problem
requires the cooperation and assistance of our Nation's
international partners, the Criminal Spam Act directs the
Department of Justice and Department of State to report to
Congress within 18 months regarding the status of their efforts
to achieve international cooperation from other countries in
investigating and prosecuting spammers worldwide.
In approving the Criminal Spam Act, the Committee
determined that it does not raise concerns under the First
Amendment. First, rather than targeting speech, the bill
instead targets e-mailing techniques used to steal computer
services and trespass on private computers and computer
networks. Second, to the extent that the bill implicates any
First Amendment interest, it addresses only commercial e-mail
messages (because the overwhelming majority of predatory and
abusive e-mail is commercial), and only when such messages are
misleading by virtue of falsifying their point of origin. It
therefore fails the first prong of the test set forth in the
Central Hudson Gas & Elec. Corp. v. Public Service Comm'n, 447
U.S. 557, 566 (1980) (in commercial speech cases, court must
first determine that the expression concerns lawful activity
and is not misleading).
IV. Legislative History
During the past several Congresses, committees in both the
House and the Senate have examined various issues raised by the
proliferation of junk commercial e-mail. Additionally,
government agencies, industry representatives, and other
interested parties have participated in numerous public forums
on spam, including a three-day ``Public Spam Workshop'' hosted
by the FTC earlier this year.
On June 19, 2003, after extensive consultation with experts
in this area, Senators Hatch, Leahy Schumer, Grassley,
Feinstein, DeWine, and Edwards introduced S. 1293, the Criminal
Spam Act of 2003.
V. Votes of the Committee
On September 25, 2003, the Committee on the Judiciary, with
a quorum present, met in open session and ordered favorably
reported the bill, S. 1293, by unanimous consent, with an
amendment in the nature of a substitute sponsored by Senators
Hatch and Leahy.
The substitute amendment made four changes to the bill: (1)
Added proposed 18 U.S.C. Sec. 1037(a)(5), which targets
spammers who falsely represents the right to use five or more
IP addresses, and intentionally initiate the transmission of
spam from such addresses; (2) amended proposed 18 U.S.C.
Sec. 1037(a)(4), to clarify that the Government may prove its
case by showing that the requisite number of e-mails went
through ``any combination of'' falsely registered e-mail
accounts or domain names; (3) narrowed the definition of
``header information'' in proposed 18 U.S.C. Sec. 1037(e)(4),
to address concerns that it was overbroad; and (4) made
technical changes to the criminal forfeiture provisions,
rendering them more consistent with existing laws. The
substitute amendment was accepted by unanimous consent.
VI. Section-by-Section Analysis
Section 1. Short title
This bill may be cited as the ``Criminal Spam Act of
2003''.
Section 2. Prohibition against predatory and abusive commercial e-mail
This section targets the five principal techniques that
spammers use to evade filtering software and hide their trails.
It creates a new federal crime that prohibits hacking into a
computer, or using a computer system that the owner has made
available for other purposes, to send bulk commercial e-mail.
It also prohibits sending bulk commercial e-mail that either
conceals the true source, destination, routing or
authentication information of the e-mail, or is generated from
multiple e-mail accounts or domain names that falsify the
identity of the actual registrant, or from Internet Protocol
(IP) addresses that have been hijacked from their true
assignees.
Penalties range from up to 5 years' imprisonment where the
offense was committed in furtherance of any felony, or where
the defendant was previously convicted of a similar federal or
state offense, to up to 3 years' imprisonment where other
aggravating factors exist, to up to 1 year of imprisonment
where no aggravating factors exist, plus criminal forfeiture.
The U.S. Sentencing Commission is directed to consider
sentencing enhancements for offenders who obtained e-mail
addresses through improper means, such as harvesting.
In addition, this section provides for civil enforcement by
the Department of Justice and aggrieved Internet service
providers against spammers who engage in the conduct described
above. In appropriate cases, courts may grant injunctive
relief, impose civil penalties, and award damages.
Section 3. Report and sense of Congress regarding international spam
Recognizing that an effective solution to the spam problem
requires the cooperation and assistance of our international
partners, this section asks the Administration to work through
international fora to gain the cooperation of other countries
in investigating and prosecuting spammers worldwide, and to
report to Congress about its efforts.
VII. Cost Estimate
U.S. Congress,
Congressional Budget Office,
Washington, DC, October 1, 2003.
Hon. Orrin G. Hatch,
Chairman, Committee on the Judiciary,
U.S. Senate, Washington, DC.
Dear Mr. Chairman: The Congressional Budget Office has
prepared the enclosed cost estimate for S. 1293, the Criminal
Spam Act of 2003.
If you wish further details on this estimate, we will be
pleased to provide them. The CBO staff contact is Mark
Grabowicz.
Sincerely,
Elizabeth M. Robinson
(For Douglas Holtz-Eakin, Director).
Enclosure.
S. 1293--Criminal Spam Act of 2003
CBO estimates that implementing S. 1293 would have no
significant cost to the federal government. Enacting the bill
could affect direct spending and revenues, but CBO estimates
that any such effects would not be significant. S. 1293
contains no intergovernmental or private-sector mandates as
defined in the Unfunded Mandates Reform Act and would impose no
costs on state, local, or tribal governments.
S. 1293 would make it illegal to use electronic mail to
send deceptive or unauthorized messages regarding commercial
products or services. Because the bill would establish a new
federal crime, the government would be able to pursue cases
that it otherwise would not be able to prosecute. However, we
expect that S. 1293 would apply to a relatively small number of
offenders, so any increase in costs for law enforcement, court
proceedings, or prison operations would not be significant. Any
such costs would be subject to the availability of appropriated
funds.
Because those prosecuted and convicted under S. 1293 could
be subject to civil and criminal fines, the federal government
might collect additional fines if the legislation is enacted.
Collections of civil fines are recorded in the budget as
revenues. Criminal fines are recorded as revenues, then
deposited in the Crime Victims Fund and later spent. CBO
expects that any additional revenues and direct spending would
not be significant because of the small number of cases
involved.
In addition, persons prosecuted and convicted under the
bill also could be subject to the seizure of certain assets by
the federal government. Proceeds from the sale of such assets
would be deposited in the Assets Forfeiture Fund and spent from
that fund, mostly in the same year. Thus, enacting S. 1293
could increase both revenues deposited into the fund and direct
spending from the fund. However, CBO estimates that any
increased revenues or spending would not be significant.
The CBO staff contact for this estimate is Mark Grabowicz.
This estimate was approved by Peter H. Fontaine, Deputy
Assistant Director for Budget Analysis.
VIII. Regulatory Impact Statement
In compliance with paragraph 11(b)(1), rule XXVI of the
Standing Rules of the Senate, the Committee, after due
consideration, concludes that S. 1293 will not have significant
regulatory impact.
IX. Changes in Existing Law
In compliance with paragraph 12 of rule XXVI of the
Standing Rules of the Senate, changes in existing law made by
S. 1293, as reported, are shown as follows (existing law
proposed to be omitted is enclosed in black brackets, new
matter is printed in italic, and existing law in which no
change is proposed is shown in roman):
UNITED STATES CODE
* * * * * * *
TITLE 18--CRIMES AND CRIMINAL PROCEDURE
Part Section
I. CRIMES................................................. 1
* * * * * * *
PART I--CRIMES
Chapter Section
1. General provisions..................................... 1
* * * * * * *
47. Fraud and false statements............................ 1001
* * * * * * *
CHAPTER 47--FRAUD AND FALSE STATEMENTS
Sec.
1001. Statements or entries generally.
* * * * * * *
1036. Entry by false pretenses to any real property, vessel, or aircraft
of the United States or secure area of any airport.
1037. Fraud and related activity in connection with electronic mail.
* * * * * * *
Sec. 1036. Entry by false pretense to any real property, vessel, or
aircraft of the United States or secure area of any
airport
(a) Whoever, by any fraud or false pretense, enters or
attempts to enter--
(1) any real property belonging in whole or in part
to, or leased by, the United States;
* * * * * * *
(c) As used in this section--
(1) the term ``secure area'' means an area access to
which is restricted by the airport authority or a
public agency; and
(2) the term ``airport'' has the meaning given such
term in section 47102 of title 49.
Sec. 1037. Fraud and related activity in connection with electronic
mail
(a) In General.--Whoever, in or affecting interstate or
foreign commerce, knowingly--
(1) accesses a protected computer without
authorization, and intentionally initiates the
transmission of multiple commercial electronic mail
messages from or through such computer;
(2) uses a protected computer to relay or retransmit
multiple commercial electronic mail messages, with the
intent to deceive or mislead recipients, or any
Internet access service, as to the origin of such
messages;
(3) falsifies header information in multiple
commercial electronic mail messages and intentionally
initiates the transmission of such messages;
(4) registers, using information that falsifies the
identity of the actual registrant, for 5 or more
electronic mail accounts or online user accounts or 2
or more domain names, and intentionally initiates the
transmission of multiple commercial electronic mail
messages from any combination of such accounts or
domain names; or
(5) falsely represents the right to use 5 or more
Internet protocol addresses, and intentionally
initiates the transmission of multiple commercial
electronic mail messages from such addresses;
or conspires to do so, shall be punished as provided in
subsection (b).
(b) Penalties.--The punishment for an offense under
subsection (a) is--
(1) a fine under this title, imprisonment for not
more than 5 years, or both, if--
(A) the offense is committed in furtherance
of any felony under the laws of the United
States or of any State; or
(B) the defendant has previously been
convicted under this section or section 1030,
or under the law of any State for conduct
involving the transmission of multiple
commercial electronic mail messages or
unauthorized access to a computer system;
(2) a fine under this title, imprisonment for not
more than 3 years, or both, if--
(A) the offense is an offense under
subsection (a)(1);
(B) the offense is an offense under
subsection (a)(4) and involved 20 or more
falsified electronic mail or online user
account registrations, or 10 or more falsified
domain name registrations;
(C) the volume of electronic mail messages
transmitted in furtherance of the offense
exceeded 2,500 during any 24-hour period,
25,000 during any 30-day period, or 250,000
during any 1-year period;
(D) the offense caused loss to 1 or more
persons aggregating $5,000 or more in value
during any 1-year period;
(E) as a result of the offense any individual
committing the offense obtained anything of
value aggregating $5,000 or more during any 1-
year period; or
(F) the offense was undertaken by the
defendant in concert with 3 or more other
persons with respect to whom the defendant
occupied a position of organizer or leader; and
(3) a fine under this title or imprisonment for not
more than 1 year, or both, in any other case.
(c) Forfeiture.--
(1) In general.--The court, in imposing sentence on a
person who is convicted of an offense under this
section, shall order that the defendant forfeit to the
United States--
(A) any property, real or personal,
constituting or traceable to gross proceeds
obtained from such offense; and
(B) any equipment, software, or other
technology used or intended to be used to
commit or to facilitate the commission of such
offense.
(2) Procedures.--The procedures set forth in section
413 of the Controlled Substances Act (21 U.S.C. 853),
other than subsection (d) of that section, and in Rule
32.2 of the Federal Rules of Criminal Procedure, shall
apply to all stages of a criminal forfeiture proceeding
under this section.
(d) Civil Remedies.--
(1) In general.--The Attorney General, or any person
engaged in the business of providing an Internet access
service to the public aggrieved by reason of a
violation of subsection (a), may commence a civil
action against the violator in any appropriate United
States District Court for the relief set forth in
paragraphs (2) and (3). No action may be brought under
this subsection unless such action is begun within 2
years of the date of the act which is the basis for the
action.
(2) Attorney general action.--In an action by the
Attorney General under paragraph (1), the court may
award appropriate relief, including temporary,
preliminary, or permanent injunctive relief. The court
may also assess a civil penalty in anamount not
exceeding $25,000 per day of violation, or not less than $2 or more
than $8 per electronic mail message initiated in violation of
subsection (a), as the court considers just.
(3) Other actions.--In any other action under
paragraph (1), the court may award appropriate relief,
including temporary, preliminary, or permanent
injunctive relief, and damages in an amount equal to
the greater of--
(A) the actual damages suffered by the
Internet access service as a result of the
violation, and any receipts of the violator
that are attributable to the violation and are
not taken into account in computing actual
damages; or
(B) statutory damages in the sum of $25,000
per day of violation, or not less than $2 or
more than $8 per electronic mail message
initiated in violation of subsection (a), as
the court considers just.
(e) Definitions.--In this section:
(1) Commercial electronic mail message.--The term
``commercial electronic mail message'' means any
electronic mail message the primary purpose of which is
the commercial advertisement or promotion of a
commercial product or service (including content on an
Internet website or online site operated for a
commercial purpose).
(2) Computer and protected computer.--The terms
``computer'' and ``protected computer'' have the
meaning given those terms in section 1030(e) of this
title.
(3) Domain name.--The term ``domain name'' means any
alphanumeric designation which is registered with or
assigned by any domain name registrar, domain name
registry, or other domain name registration authority,
and that is included in an electronic mail message.
(4) Header information.--The term ``header
information'' means the source, destination, and
routing information attached to an electronic mail
message, including the originating domain name, the
originating electronic mail address, and technical
information that authenticates the sender of an
electronic mail message for network security or network
management purposes.
(5) Initiate.--The term ``initiate'' means to
originate an electronic mail message or to procure the
origination of such message, regardless of whether the
message reaches its intended recipients, and does not
include the actions of an Internet access service used
by another person for the transmission of an electronic
mail message for which another person has provided and
selected the recipient electronic mail addresses.
(6) Internet access service.--The term ``Internet
access service'' has the meaning given that term in
section 231(e)(4) of the Communications Act of 1934 (47
U.S.C. 231(e)(4)).
(7) Loss.--The term ``loss'' has the meaning given
that term in section 1030(e) of this title.
(8) Message.--The term ``message'' means each
electronic mail message addressed to a discrete
addressee.
(9) Multiple.--The term ``multiple'' means more than
100 electronic mail messages during a 24-hour period,
more than 1,000 electronic mail messages during a 30-
day period, or more than 10,000 electronic mail
messages during a 1-year period.