Wednesday, March 19, 2008

Spammer to the Slammer -- Unfair Business of Spamming Results in Jail Sentence

This post was based on the Virginia Supreme Court's opinion rendered February 29, 2008. That opinion was subsequently withdrawn and a new opinion was issued on September 12, 2008. The post below was edited to remove the link to the old opinion because that link was changed. Otherwise, the post is unchanged. Click here for our post discussing the subsequently issued Jaynes opinion: http://unfairbusinesspractices.blogspot.com/2008/10/virginia-supreme-court-overturns.html.

The conviction of a spammer was upheld by the Virginia Supreme Court in an opinion published on February 29, 2008. The case is styled Jaynes v. Commonwealth. This case is an example of unfair business practices that are so nefarious as to invite criminal prosecution.

Criminal liability was based on Virginia Code Ann. Sec. 18.2-152.3:1 which provides:

A. Any person who: 1. Uses a computer or computer network with the intent to
falsify or forge electronic mail transmission information or other routing
information in any manner in connection with the transmission of unsolicited
bulk electronic mail through or into the computer network of an electronic mail
service provider or its subscribers . . . is guilty of a Class 1 misdemeanor.

B. A person is guilty of a Class 6 felony if he commits a violation of subsection A
and: 1. The volume of UBE transmitted exceeded 10,000 attempted recipients in
any 24-hour period, 100,000 attempted recipients in any 30-day time period, or
one million attempted recipients in any one-year time period. . .

An interesting aspect of the case was the Court holding that Virginia has jurisdiction to criminally prosecute the spammer who was located in North Carolina, but sent the spam emails through AOL servers located in Virginia. The Court held, in part, that jurisdiction was proper because '[b]y selecting AOL subscribers as his e-mail recipients, Jaynes knew and intended that his e-mails would utilize AOL servers because he clearly intended to send to users whose e-mails ended in '@aol.com.' The evidence established that the AOL servers are located in Virginia, and that the location of AOL's servers was information easily accessible to the general public.

The Court rejected the spammer's claim that he had standing to assert a First Amendment defense to argue that the statute was unconstitutionally overbroad on behalf of an "unknown individual’s potentially protected speech." Opinion at 12. Similarly, it rejected the spammer’s argument that the statute was void for vagueness. The Opinion invited three dissenting Justices, who disagreed with the Court’s standing analysis.

The court did not address how this unfair business practice might be treated for any civil claims that may be filed.

The scope of the spammer's activity and the number of emails in his possession were extraordinary, and it is worth reading extended excerpts from the Court's factual summary.

"From his home in Raleigh, North Carolina, Jaynes used several computers, routers and servers to send over 10,000 e-mails within a 24-hour period to subscribers of America Online, Inc. (AOL) on each of three separate occasions. On July 16, 2003, Jaynes sent 12,197 pieces of unsolicited e-mail with falsified routing and transmission information onto AOL's proprietary network. On July 19, 2003, he sent 24,172, and on July 26, 2003, he sent 19,104. None of the recipients of the e-mails had requested any communication from Jaynes. He intentionally falsified the header information and sender domain names before transmitting the e-mails to the recipients, causing the Internet Protocol (IP) addresses to convey false information to every recipient about Jaynes’ identity as the sender. However, investigators used a sophisticated database search to identify Jaynes as the sender of the e-mails."

"During trial, evidence demonstrated that Jaynes knew that all of the more than 50,000 recipients of his unsolicited e-mails were subscribers to AOL, in part, because the e-mail addresses of all recipients ended in ' @aol.com ' and came from discs stolen from AOL. Jaynes' e-mails advertised one of three products: (1) a FedEx refund claims product, (2) a 'Penny Stock Picker,' and (3) a 'History Eraser' product. To purchase one of these products, potential buyers would click on a hyperlink within the e-mail, which redirected them outside the e-mail, where they could consummate the purchase. Jaynes operated his enterprise through several companies which were not registered to do business in North Carolina, and evidence was introduced as to billing and payment activities for these companies, including evidence that registration fees were paid to AOL with credit cards held by fictitious account holders."

"While executing a search of Jaynes' home, police discovered a cache of compact discs (CDs) containing over 176 million full e-mail addresses and 1.3 billion e-mail user names. The search also led to the confiscation of a storage disc which contained AOL e-mail address information and other personal and private account information for millions of AOL subscribers. Police also discovered multiple storage discs which contained 107 million AOL e-mail addresses. Richard Rubenstein, manager of technical security investigations at AOL, testified that the discs recovered at Jaynes’ home "contained proprietary information" of 'pretty near all' AOL account customers. The AOL user information had been stolen from AOL by a former employee and was in Jaynes' possession."

"AOL, which houses all of its e-mail servers in Virginia, was directly affected by Jaynes' spam e-mail attack. Brian Sullivan, the senior technical director for mail operations at AOL, testified that bulk e-mail 'tends to create a lot of confusion' for AOL customers and that AOL receives '7 to 10 million complaints per day' regarding spam e-mails. Sullivan also described the impact of spam e-mails, explaining that '[i]f someone’s mailbox is full because they got a truckload of spam and there’s no more room, a message coming from Grandma is returned back to the sender. We can’t take it at that point.'"

"Jaynes' enterprises were apparently quite successful. Although not introduced as evidence during the guilt stage of the trial, counsel for the Commonwealth informed the Court following the jury verdict against Jaynes and during the discussion of bond for Jaynes that Jaynes' '[p]ersonal financing statement list[s] assets at $17 million and a net worth of $24 million,' and his income from all of his businesses exceeded $1 million in 2001, 2002 and 2003."

No comments: