May 7, 2013
According to a PwC report released last week, fewer Canadian tech startups are looking for buyers in order to exit the market, choosing instead to find ways to reach their next growth stage and generate revenue in Canada.
Lehigh Valley Business
CyOptics, once a startup that received funding and help from Ben Franklin, is just one success story, according to Laura S. Eppler, director of marketing for Ben Franklin Northeastern Pennsylvania.
At first glance you might not think there is much in common between the film industry and tech startups. I’m here to tell you differently. Both industries have their own set of challenges, whether you’re starting out, or refining your craft/company.
Wall Street Journal (blog)
Tech watchers once considered the database market pretty stagnant, at least in terms of new technology and new entrants. Suddenly it is anything but that, with Clustrix a prime example.
Leaders of the Chicago startup community released figures Friday regarding the city’s start-up growth coinciding with the first anniversary of 1871, one of the city’s start-up incubators. “Over the last year, the tech community has really come together.
The Next Web
Rumors about the move have been circulating since late last month and follows the announcement that Ben Finkel is also involved at Jelly as Christopher Isaac “Biz” Stone’s fellow co-founder and Chief Technology Officer.
Business Times (subscription)
Thermal management solutions for lithium-ion batteries are also exactly what Gcorelab, a local clean tech startup, specialises in. Gcorelab is developing what it calls a “small liquid-based thermal management system” for electric vehicles.
Tech in Asia
Gai When you’ve been co-founder and CEO of Snapture Labs, held the same titles at CardMunch, Inc. and are currently founder and chief ambassador at World Startup Report, you tend to attract attention when you enter the tech and startup community.
Tech Startup Develops Two-Click Checkout. – Yahoo! Finance
Finance: ALBUQUERQUE, N.M., May 2, 2013 /PRNewswire/ — Tech start-up @ Pay released its first public Application Programming Interface (API) today.
Silicon Valley based high tech start up in the Golf business, developing a cool product, is looking to expand its team in different disciplines including R&D.
On February 22, 2013, the FTC announced a settlement with HTC America over charges that HTC failed to use adequate “security by design” in millions of consumer mobile devices. As a result, the company is required to patch vulnerabilities on the devices which include #Smartphones and #Tablets. The settlement, the first action involving a mobile device manufacturer and the new “Privacy By Design” guidelines, sheds some light on the legal risks for mobile device manufacturers and, to some extent, mobile application developers.
The FTC alleged that HTC failed to take reasonable steps to secure the software it developed for its smartphones and tablet computers, introducing security flaws that placed sensitive information about millions of consumers at risk. The resulting vulnerabilities posed risks to sensitive functionality, including the possibility that malware could send text messages, record audio, and install additional malware onto a consumer’s device.
Here are four key take-aways for mobile device manufacturers and application developers from the FTC’s complaint:
- provide your engineering (programming) staff with security training
- review or test your software on mobile devices for potential security vulnerabilities
- follow well-known and commonly accepted secure coding practices
- establish a process for receiving and addressing vulnerability reports from third parties
Smartphones and tablets are powerful, popular, and continue to find their ways into our personal and business lives. New mobile apps hit the market each day. In this fast-moving era of entrepreneurship and creativity, mobile device and app developers need to keep up with evolving privacy and security. Apps and mobile devices that tap into consumer data — including contact information, photos, and location to name a few — pose a heightened risk to digital snoops, data breaches, and real-world thieves.
Please contact us if you are interested in learning how to evaluate your mobile security and privacy risk or to help develop a “Privacy By Design” approach mobile app security.
Please comment, tweet and forward!
- FTC moves against mobile device makers over security (networkworld.com)
- AT&T to usher in split-personality mobile devices (reviews.cnet.com)
Tagged: "Privacy By Design" guidelines, developers, device, Federal Trade Commission, FTC, HTC, HTC Corporation, legal risks, manufacturer, Mobile, mobile application, Mobile device, Smartphone, Tablet computer, Vulnerability (computing)
Three Things I Learned About Personal Cybersecurity At RSAConference That You Should Be Doing Right Now
February 28, 2013
I just returned from RSAConference 2013 where I had the privilege and honor of giving a presentation of the legal risks caused by social media in the workplace. As a speaker-attendee, I had the priceless benefit of access to all the other speakers and programs held during the conference.
One such program I attended was “We Were Hacked: Here’s What You Should Know”. The speakers, Matthew Prince (@eastdakota) CEO of CloudFlare, and Mat Honan (@mat) writer for Wired Magazine, shared their common experience as targets of high profile hacks. Hearing the details from them first hand, including information from interviews with the hackers themselves, I learned how easy it is to be the victim of hacking and how it’s the little things that create exploitable seams in our information security barriers.
Rather than rewrite their stories, I thought I would share three simple lessons I learned that I’ve already implemented and you should too. Besides, Matt does a better job telling his own story which can be found here.
Here are the three things I learned about how you can protect yourself and others in your organization.
First, security attacks go after the “low hanging fruit” and that often means figuring out a way to exploit your personal email address. With so many web-based services and so much login information to remember, many of us use our personal email as our username for everything from the web sites on which we comment, to our online photo gallery, to our online banking service. Unfortunately, this is probably the address we use for password recovery if we forget. Given that our digital lives are easily mapped, hackers already have one piece of the two-piece login puzzle: they know your user name.
TIP NO. 1: Use a private, obscure email address for your more sensitive information.
Second, once a hacker has accessed your accounts, your computer and your files, the fun has just begun for them. As Matt Honan described, these often adolescent script kiddies simply don’t understand the value of your stored memories and other information. In his case, all the photos of his children were permanently deleted. Regardless of a hacker attack, stuff happens and you don’t want to lose everything because you we’re too lazy to back up.
TIP NO. 2: Back Up your digital life, early and often.
Third, today’s’ Internet is an interdependent ecosystem. Just because you or your organization takes security seriously, doesn’t mean that other do as well. Your internal systems are not enough. Like it or not, the seams of your security perimeter are intertwined and permeated by the services and systems of customers and vendors. For most consumers, the there is a Hobbesian choice of Security v. Convenience. Multiple login usernames and super long passwords are difficult to remember and tedious to use. As a result, most people choose the least secure means of authentication on the assumption that using astringent password is enough. Unfortunately, some people don’t even bothers with that. A recent ZoneAlarm study found that “password” was the fourth most commonly used password by consumers.
Google, Facebook and others have started using two-factor authentication. Two-factor authentication requires that one enter a code after entering the username/password combo. The code is sent via, text message, voice call or email. This greatly reduces the chances of unauthorized access because hackers would need to have your phone, in addition to your username/password combo.
TIP NO. 3: Whenever possible enable two-factor authentication.
Please understand that there is no “magic bullet” when it comes to Cybersecurity. Taking these precautions does not guarantee that you won’t be attached or that your account information won’t be accessed. However, these are important and easy steps that you can take to improve your personal data security.
Please comment and follow!
- Twitter looks to add two-factor authentication to stop password hacks (arstechnica.com)
Tagged: Authentication, CloudFlare, Cyber, cybersecurity, Facebook, Google+, Hackers (film), Matthew Prince, Privacy, Risk, security, trust, Two-factor authentication, User (computing), ZoneAlarm
February 19, 2013
I will be speaking at Affiliate Management Days SF 2013 (April 16-17, 2013) on the topic of “Managing Risk: Legal Issues for Merchants & Affiliate Managers.”
Affiliate marketing is one of the most cost-effective techniques for monetizing web site traffic and driving sales. Unfortunately, it has a reputation for high risk. While the industry is unlikely to ever be risk-free, it is possible to manage risk by: (1) understanding how techniques like behavioral and contextual targeting affect consumers, affiliates and merchants, (2) understanding the legal and regulatory environment, (3) understating risks involved with prospective marketing partners, (4) using and maintaining proper contracts that allocate risk and provide appropriate indemnifications, and (5) keeping informed about the changes in technology, marketing practices and the regulatory environment. Attendees will learn how to identify these issues and develop policies and procedures to keep informed about the current technology, marketing strategies and regulatory compliance.
Topics covered include:
- Behavioral/Contextual Advertising
- Regulatory/Industry Compliance : FTC Guides & Enforcement Actions
- CAN-SPAM compliance
- IP Law: Rules governing use of others™ Trademarks/Keywords, Right of Publicity/Endorsement Issues.
- Identifying, protecting against, and disputing accusations of Click-Fraud
- Bad Affiliate Programs: Cheating and Stealing from Affiliates (earnblogger.com)
Tagged: Affiliate marketing, Affiliate Program, April 16-17 2013, Business, Marketing, Network affiliate, Online Opportunities, Opportunities
December 23, 2012
As a result of the rapid shift in marketing from unilateral one-to-many communications, to the multilateral, many-to-many or many-to-one conversations enabled by Social Media, employees and employers are struggling to manage accounts that are used for both work and personal purposes.
This new phenomenon has benefits, but it also creates a number of legal challenges. For employees, it may result in greater efficiency, more opportunities for authentic customers engagement and the ability to stay on top of the most current grands and business issues. For employers, it presents opportunity to reap substantial benefits from lower communications and customer support costs. For in-house counsel, it raises a host of legal and practical issues with few easy solutions and significant liability and regulatory risks.
First, there are hardware issues. Smartphones, tablets and other personal electronics often have social networking capabilities built in. in addition, they contain contain both personal and business data. Because these devices are always on and always connected, they are more than just personal property. They have become essential business tools. For both sides of the workplace equation, employers and employees must understand where the privacy lines fall between personal versus work-related information.
Second, there are data issues. Employers must balance their needs to monitor employee usage, employees’ privacy concerns, and the risk of liability for theft or exposure of data if a device is lost or stolen, or from lack of proper safeguards on account usage. For in-house counsel tasked with drafting policies to address these risks, , Prior to implementation of any policy, the legal team needs to educate front line employees and management on reasonable expectations of privacy and security and the harms that the organization seeks to prevent.
Lastly, recent cases such as the Cristou v. Beatport litigation, highlight the struggle to define and control the beginning and end of employee social media accounts, ownership and protection of intellectual property and the post termination risks that arise from the absence of appropriate policies.
As we prepare to start a new year, the time is ripe to establish security and privacy policies governing creation, maintenance and use of employees’ social media accounts for work functions. In-house counsel must lead the charge to educate, inform and train employees about privacy, security and evidence-recovery implications associated with use of social media.
Tagged: accounts, attorney, Business, BYOD, Communications, counsel, employee, employer, in-house, infosec, Law, Lawyer, Legal, Marketing, media, Mobile, policies, policy, Privacy, regulation, security, social, Workplace
November 27, 2012
By now most small business owners are aware that Cybersecurity is an issue. But, how much time and capital should be spent on cybersecurity protection? This article discusses three key factors that should play into that decision.
Factor #1 Awareness.
According to some experts, the biggest problem that small business owners face is simply awareness of the risk. This includes awareness by employees as well.
Most data leaks and other security incidents are caused by employees who are either unaware of security protocols or indifferent to them. Regardless of the level of security in your data center or the strength of encrypted communications, the weakest link will almost always be the human beings interacting with the network.
To address this risk, small business owners need to focus on training and awareness for employees. However, company management is usually focused on sales and customer service. Further, owners often lack the time and expertise needed to properly assess security risks. Companies in any industry should look to partner with a third-party security firm to asses risks and develop appropriate training.
Factor #2 Employee Training.
Training is the first line of defense against cyber threats. This training needs to include the entire company, and should cover three key areas: (a) proper password management on all company services and devices, including clear procedures for new and departing employees, as well as day-to-day usage; (b) clear guidelines for the sharing of information with remote employees, partners and third parties; and (c) a plan for monitoring usage and privileges to the company’s digital assets.
Employee training needs to account for how the public will access your company’s products or services. For example, what if a hacker got into a system by pretending to be another user? By rolling out new features slowly, its easier to identify and fix security loopholes.
All stakeholders need awareness of: (a) the type of information you’re transmitting (e.g. payment information), (b) the visibility of information you’re transmitting (e.g. highly-publicized public launch vs. a quiet rollout of some new software), and (c) the level of security inherent in the transmission (e.g. encrypted emails and documents shared via a secure server or data shared publicly through public networks and via social media sites.
Factor #3 Vigilance (Monitoring).
For some companies everything is available and accessed online. Since online relationships are built upon trust, it is critical that the company actively monitor the security and transparency of this relationship. Many tools are available to measure and respond to risk factors and gauge likelihood of an impact to help determine the level of investment required. Resources can be assigned to anything with high likelihood and high impact.
For example, monitoring potentially fraudulent user accounts has an immediate commercial benefit as well as reducing risk.
Unfortunately, a common misconception is that putting up basic defenses like firewalls will protect security vulnerabilities. However, after reinforcing your Cybersecurity defense, the focus should shift to monitoring and alerting. In many cases, this may require up-front investments to enable tracking and alerting to irregularities in network and data activity. Fortunately, in the event of a breach or a loss of data, this monitoring information will be the key factor in addressing the problem and pinpointing the issue. Managers, employees and business partners need to understand that Cybersecurity is an ongoing process. Awareness, training and monitoring will go a long way toward enhancing a small business’ Cybersecurity preparedness.
About the Author:
David M. Adler, Esq. is a partner in the Chicago office of Leavens, Strand, Glover & Adler, LLC, a boutique intellectual property and entertainment law firm in Chicago, Illinois whose mission is providing businesses with a competitive advantage by enabling them to leverage their intangible assets and creative content in order to drive innovation and increase overall business value. The practice is organized around five major substantive areas of law: Intellectual Property Law, Commercial & Finance Law, Entertainment & Media Law, Corporate Law and Contract Law.
Contact us for a free consultation today. Dadler @ lsglegal (dot) com or (866) 734 2568
Tagged: cybersecurity, data protection, information security, legal risk, Small Business
November 21, 2012
In today’s business world, web sites are no longer simply a static online presence. Today’s web sites are highly interactive and often make use of content (photos, text, images, videos, etc.) that have bee uploaded by visitors and registered users. With the speed of search engines, social networking platforms and mobile computing technologies, any online problem can quickly have far reaching effects well beyond the initial issue.
A recent federal District Court in Maryland examined whether the mere act of uploading photographs to a website met the requirements of forming a valid electronic contract sufficient to assign copyrights in the photographs under Section 204(a) of the Copyright Act, which requires assignments to be in writing and signed by the assignor.
The Court first looked at Section 204(a). That section provides that “[a] transfer of copyright ownership, other than by operation of law, is not valid unless an instrument of conveyance, or a note or memorandum of the transfer, is in writing and signed by the owner of the rights conveyed or such owner’s duly authorized agent.” 17 U.S.C. § 204(a). The Court then turned to the Electronic Signatures in Global and National Commerce Act (“E-SIGN”), 15 U.S.C. §§ 7001 et seq., to reject defendant’s argument that the assignments were invalid. E-SIGN provides, in relevant part:
“[n]otwithstanding any statute, regulation, or other rule of law . . . with respect to any transaction in or affecting interstate or foreign commerce–
(1) a signature, contract, or other record relating to such transaction may not be denied legal effect, validity, or enforceability solely because it is in electronic form; and
15 U.S.C. § 7001(a).
“The term ‘electronic signature’ means an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record.” Id. § 7006(5). The Court concluded that the TOU was clear in its terms and that the electronic process by which subscribers assigned the copyrights in the photographs met E-SIGN and Section 204(a) requirements. Accordingly, the Court held that the assignments were not invalid as a matter of law.
Tagged: Copyright, Website, Maryland, Electronic Signatures in Global and National Commerce Act, United States district court, Photograph, Electronic signature, assignment
November 14, 2012
|Cybersecurity Act of 2012 Back, but Same Problems and Questions Remain
Senate majority leader Harry Reid (D–NV) has vowed to bring the Cybersecurity Act of 2012 (CSA) up for a vote in the lame-duck session, and it looks as though the vote could take place this week.
|US-Canada Integrated Cybersecurity Agenda
Bay Area Indymedia
Under the guise of cybersecurity, the U.S. and Canada have been individually pushing draconian legislation domestically which would grant government agencies sweeping new powers. The implications would be far reaching and pose a risk to privacy.
|DHS aims to hire 600 cybersecurity pros — if it can find them
November 13, 2012 — CSO — The Obama administration is hoping to make good on its promise to create new jobs — in this case, 600 of them in cybersecurity.
|The Alarming Trend of Cybersecurity Breaches and Failures in the US …
This summer, the Cybersecurity Act of 2012 (CSA) failed to pass the Senate, with Democrats and Republicans alike voting against the bill. The overriding concern was that the regulatory approach of the bill would be ineffective at best and harmful at worst.
|The Elections and Cybersecurity
When President Obama was reelected last week, political pundits quickly turned to speculation and prognostication. Was the president’s reelection tantamount to a mandate? Would the election motivate both parties away from partisanship ?
|NSA: Looking for a few good cybersecurity professionals
Network World – At a time when cyberattacks on America’s critical infrastructure have increased 17-fold (between 2009 and 2011), the need for highly trained cybersecurity professionals is acute. However, 83% of federal hiring managers in a recent …
|Senate readies for fight over cybersecurity surveillance
has inserted the cybersecurity bill into the Senate’s post-election calendar, and a vote could happen as early as this week after debate on a proposal to open more public land for hunting and fishing. That move has reignited a long-simmering dispute …
|Governor launches cyber security training program
The program offers students and Internet technology professionals a full curriculum of meetings and workshops as well as critical cybersecurity training and awareness tools. The new cyber range serves as a central resource hub and a partner in …
|Seven 2013 Cybersecurity Predictions from Websense Security Labs
SAN DIEGO, Nov. 13, 2012 — /PRNewswire/ — From mass compromises of WordPress to a spear-phishing attack on the White House, there is no doubt cybercriminals gained confidence and momentum in 2012. To help organizations prepare for next year, the …
|Researcher to tackle cyber security for North American power grid
In response, Waterfall Security Solutions has announced a $234,000 donation to Michigan Technological University, in support of Dr. Chee-Wooi Ten’s research into the cyber-security of the North American power grid. Dr. Ten’s research addresses these …
Tagged: Barack Obama, Canada, Computer security, Harry Reid, Party leaders of the United States Senate, Senate, United States, United States Department of Homeland Security
October 19, 2012
On September 25, 2012, the Federal Trade Commission announced a settlement with seven rent-to-own companies that secretly installed software on rented computers, clandestinely collected information, took pictures of consumers in their homes (WTF?!) and tracked these consumers’ locations.
If you haven’t vomited on your computer from the sickening outrage, you can read the FTC press release here.
Software design firm DesignerWare, LLC licensed software to rent-to-own stores ostensibly to help them track and recover rented computers. The software collected the data that enabled rent-to-own stores, including franchisees of Aaron’s, ColorTyme, and Premier Rental Purchase, to track the location of rented computers without consumers’ knowledge
According to the FTC, the software enabled remote computer disabling if it was stolen, or if the renter failed to make payments. It included an add-on purportedly to help stores locate rented computers and collect late payments. Alarmingly, the software also collected data that allowed the rent-to-own operators to secretly track the location of rented computers, and thus the computers’ users.
When activated, the nefarious feature logged key strokes, captured screen shots and took photographs using a computer’s webcam, according to the FTC. It also presented a fake software program registration screen that tricked consumers into providing their personal contact information.
“An agreement to rent a computer doesn’t give a company license to access consumers’ private emails, bank account information, and medical records, or, even worse, webcam photos of people in the privacy of their own homes,” said Jon Leibowitz, Chairman of the FTC. “The FTC orders today will put an end to their cyber spying.”
“There is no justification for spying on customers. These tactics are offensive invasions of personal privacy,” said Illinois Attorney General Lisa Madigan.
Tagged: Aaron’s, breach, ColorTyme, Computer, data, data collection, FTC, invasion of privacy, key-logging, leasing, Premier Rental Purchase, Privacy, rent to own, security, software
October 15, 2012
I’m surprised at how often I receive commercial bulk email messages that are not compliant with the Federal CAN SPAM act.The two biggest mistakes I see are 1) no physical address and 2) no opt-out/unsubscribe mechanism.
Another common mistake is a “blind” bulk email address list like “Undisclosed-Recipients@email.com.” Not only do I NOT know which address this received the offensive message, there usually isn’t even a proper return address for me to send an “Unsubscribe” message.
With the popularity of social media, you’ve probably received a Twitter promotion for iPhones, special deals, free downloads, etc. While it’s easy to dismiss poorly-written tweets from obvious spammers, when someone replies to you on Twitter, says “must read, check it out” and the topic is clearly the kind of thing you read and share it’s more difficult to tell. Often, these are from legitimate accounts where a human has taken the time to compose and send the message.
In light of the growing use of electronic mail (“email”) messages for advertising, marketing, corporate communications and customer service, is essential to have some familiarity with the Federal “Controlling the Assault of Non-Solicited Pornography And Marketing Act of 2003” also known as the CAN SPAM Act (the “Act”) The Act provides the parameters of its application, explicit prohibitions, requirements for transmission of legally compliant email messages including the “Opt-Out” mechanism and vicarious liability. Generally speaking, the Act was written to prohibit the fraudulent, deceptive, predatory and abusive practices that threaten to undermine the success and effectiveness of commercial email and email marketing.
Congress drafted the Act to impose limitations and penalties on the transmission of unsolicited commercial email messages. Unlike some state initiatives, the Act is an “opt-out” law. Put another way, for most purposes permission of the e-mail recipient is not required. However, once an email recipient has indicated a desire to opt-out or no longer receive such messages, failure to comply with the recipient’s request may subject both the sender and the person or entity on whose behalf the message was sent to severe penalties.
Frequently asked question about the Act include:
1) To Whom Does The Act Apply? The Act applies to any person or entity that sends email.
2) What Activities Are Prohibited By The Act? The Act is primarily concerned with explicitly prohibiting certain predatory and abusive commercial email practices.
3) What Are The Requirements For Sending Email Messages? Section 5(a) of the Act sets requires the inclusion non-misleading information regarding: (a) transmission, (b) subject, (c) email address, (d) Opt-out and physical address, and (e) clear and conspicuous language identifying sexually-oriented messages.
4) Who Can Be Liable for Violations? The Act applies to both the party actually sending the commercial email messages and those who procure their services.
The primary substantive provisions of the Act can be divided into three parts found in Section 4, Section 5 and Section 6. Section 4 of the Act addresses “predatory and abusive” practices prohibited by the Act. Section 5 details the requirements for transmission of messages that comply with the Act. Section 6 details the requirements for transmission and identification of sexually-oriented messages. Section 6 is not discussed in this article.
Section 4 of the Act lists specific “predatory and abusive” practices prohibited by the Act. In short, the Act specifically prohibits: (i) accessing a computer without authorization for the purpose of initiating transmission of multiple commercial email messages, (ii) transmission of multiple commercial email messages with the intent to deceive or mislead recipients, (iii) transmission of multiple commercial email messages with materially false header information, (iv) registration of email accounts or domain names using information that materially falsifies the identity of the actual registrant, and (v) false representations regarding the registration of Internet Protocol addresses used to initiate multiple commercial email messages.
The second relevant part, set forth in Section 5 of the Act, details the requirements for transmission of messages that comply with the Act. Subject to certain limitations discussed below, the Act requires that email messages contain: (i) transmission information that is not materially false or misleading, (ii) subject information that is not materially false or misleading, (iii) a return address or comparable mechanism for opt-out purposes, (iv) identifier, Opt-out and physical address, and (v) clear and conspicuous language identifying sexually-oriented messages as such. (Note, this last requirement is not discussed. See above.) Lastly, the Act implicates both commercial email transmission service providers as well as those who procure their services.
To Whom Does The Act Apply?
The Act applies to any person or entity that sends email. The Act specifically regulates “commercial electronic mail messages,” defined as any email message “the primary purpose of which is the commercial advertisement or promotion of a commercial product or service (including content on an Internet website operated for a commercial purpose).” However, the Act specifically excludes from this definition “transactional or relationship messages.” A “transactional or relationship message” falls within one of five categories of messages:
- communications that facilitate, complete or confirm a commercial transaction previously agreed to by the recipient;
- communications that provide warranty or other product information with respect to a product or service previously used or purchased by the recipient;
- notifications with respect to a subscription, membership, account, loan, or comparable ongoing commercial relationship;
- information directly related to an employment relationship or related benefit plan in which the recipient is currently involved; and
- communications to deliver goods or services, including product updates or upgrades, under the terms of a transaction previously agreed to by the recipient.(Emphasis added.)
The purpose for the distinction between “commercial electronic mail messages” and “transactional or relationship messages” is to exempt certain types of communications from compliance with all the message transmission requirements of the Act. As should be clear from the list above, the Act distinguishes the types of communications based on the relationship between the sender and recipient rather than on the character of the message. Put another way, so long as the communication is related to some type of existing business relationship, it is not a “commercial electronic mail message.”
What Activities Are Prohibited By The Act?
Section 4 of the Act is primarily concerned with prohibiting certain predatory and abusive commercial email practices. Section 4(a) amends Chapter 47 of Title 18 of the United States Code by adding Section 1037 which specifies the offenses that constitute “fraud and related activity in connection with email.” An offense is committed by anyone who directly or indirectly, knowingly:
- accesses a protected computer without authorization, and intentionally initiates the transmission of multiple commercial electronic mail messages from or through such computer,
- uses a protected computer to relay or retransmit multiple commercial electronic mail messages, with the intent to deceive or mislead recipients, or any Internet access service, as to the origin of such messages,
- materially falsifies header information in multiple commercial electronic mail messages and intentionally initiates the transmission of such messages,
- registers, using information that materially falsifies the identity of the actual registrant, for five or more electronic mail accounts or online user accounts or two or more domain names, and intentionally initiates the transmission of multiple commercial electronic mail messages from any combination of such accounts or domain names, or
- falsely represents oneself to be the registrant or the legitimate successor in interest to the registrant of 5 or more Internet Protocol addresses, and intentionally initiates the transmission of multiple commercial electronic mail messages from such addresses.
Clearly, Section 4 is primarily concerned with preventing practices whereby the sender intentionally, either through outright fraud or other deception, conceals its true identity or the true commercial character of the message.
What Are The Requirements For Sending Email Messages?
Section 5(a) of the Act sets forth certain other protections for the users of commercial email.
Accurate Transmission Information. Among the affirmative requirements of Section 5(a), Section 5(a)(1) prohibits sending either a commercial electronic mail message, or a transactional or relationship message, that contains, or is accompanied by, header information that is materially false or materially misleading. Unlike the general prohibition against sending messages with materially false header information under Section 4, in addition to having technically accurate transmission information, the sender is prohibited from having used false pretense or other deceptive means to acquire such information (e.g. email accounts, domain names and IP addresses). Furthermore, the “from” line must “accurately identify the person transmitting the message.” Lastly, the sender must accurately identify the computers used to originate, relay or retransmit the message.
Note, the following only apply to commercial electronic mail messages:
Accurate Subject Information. Messages must have accurate subject information. Subject information would not be accurate if a “person has actual knowledge, or knowledge fairly implied on the basis of objective circumstances, that a subject heading of the message would be likely to mislead a recipient, acting reasonably under the circumstances, about a material fact regarding the contents or subject matter of the message.”
Inclusion of Opt-out Mechanism. Messages MUST contain a functioning return email address or other Internet-based mechanism (e.g. hyperlink), that is clearly and conspicuously displayed that enables a recipient to submit a request to opt-out of future email messages from the sender whose email address was contained in the message. The opt-out mechanism (whether email address or hyperlink, etc.) must remain functional for at least thirty (30) days after the transmission of the original message.
Removal After Objection. If a recipient makes a request using the opt-out mechanism, the sender shall not transmit any further messages to the recipient, more than ten (10) business days after the receipt of such request, if such message would fall within the scope of the request. A third-party acting on behalf of the sender shall not transmit or assist others to transmit, any further messages to the recipient, more than ten (10) business days after the receipt of such request, if such third party knows or should know of the recipient’s objection. Lastly, the sender and any third party who knows that the recipient has made such a request, shall not sell, lease, exchange, or otherwise transfer or release the electronic mail address of the recipient for any purpose other than compliance with the Act or other provision of law.
Inclusion of Identifier, Opt-out & Physical Address. Every message must clearly and conspicuously: (i) identify the message as an advertisement or solicitation; (ii) provide notice of the opportunity to opt-out of future communications; and (iii) provide a valid physical postal address of the sender. However, the notice that a message is an advertisement or solicitation does not apply where the recipient has given prior affirmative consent to receive the message.
Related Activities Proscribed.
Other prohibitions in the Act concern unethical or unscrupulous practices that tend to coincide with deceptive or abusive email. Several common methods for generating email distribution lists have also been proscribed. The Act prohibits certain unethical practices such as:
- hijacking another email server to send or relay messages;
- “harvesting” email addresses that appear on others’ Web sites;
- randomly generating email addresses;
- knowingly linking an email ad to a fraudulently registered domain; and
- participating in other offenses such as fraud, identity theft, etc.
Who Can Be Liable for Violations?
The Act applies to both the party actually sending the commercial email messages and those who procure their services. One cannot “outsource” its “spam” and thereby avoid liability under the Act. One may be held accountable if the email service employed isn’t actually using a legally-compiled or permission-based list. Under some parts of the Act one may be held liable for employing a third party to distribute the messages “with actual knowledge, or by consciously avoiding knowing, whether such [third party] is engaging or will engage, in a pattern or practice that violates this Act.”
The Act was written to prohibit the fraudulent, deceptive, predatory and abusive practices that threaten to undermine the success and effectiveness of commercial email and email marketing. Since Bacon’s uses email to communicate with employees, vendors, existing and prospective customers, Bacon’s is clearly subject to the Act. The Act focuses on enumerating proscribed activities rather than affirmative obligations to make it easier for legitimate, honest businesses to comply with the Act. The Act distinguishes communications based on a previously existing relationship between the sender and the recipient from those communications that are prospective in nature. Generally, email messages not based on a pre-existing relationship are subject to greater affirmative requirements.
- Be Aware of the Requirements for Transmitting Messages.
- Require Compliance by Clients.
- Monitor Distribution by Affiliates.
Tagged: Advertising, CAN SPAM Act, CAN-SPAM Act of 2003, E-mail spam, IP address, IPhone, Opt-out, Twitter