onstitutes criminal
activity, report it to Penn Public Safety at 511 (on-campus)
or 215-573-3333 (off-campus). There is one notable exception
to this, though - the infamous "419" or "Nigerian
Scam". This is a well-known "fee fraud" scheme that
has been around for more than 20 years, but has multiplied many times
over in the form of spam. We have a special page for it at http://www.upenn.edu/computing/security/advisories/419scam.php.
In general, though, do not report Nigerian Scam messages.
Isn't "spam" itself illegal?
A number of states and local jurisdictions have enacted laws aimed at
prosecuting people who send spam, however, a close reading of these laws
shows that they are actually laws against sending e-mail with forged or
fraudulent headers, and make no reference to content.
In 2003, Congress enacted anti-spam legislation that has come to be known as the CAN-SPAM Act, which states that in order for a commercial e-mail message to be considered legal, it must:
- Contain no false or misleading message header information - the "To:", "From:" and "Received:" (message routing) headers must be accurate
- Contain no deceptive or misleading "Subject:" header information
- Provide the recipient with a valid "opt-out" method to request the sender stop sending additional messages
- Identify itself as a commercial message and include the sender's correct, valid postal ("snailmail") address
As long as a message meets the above criteria, a commercial e-mail message generated in the US may meet the definition of "spam" - commercial and unsolicited - yet be perfectly legal. The fact, of course, is that the overwhelming majority of "spam" contains all sorts of bogus headers and misleading information. However,
the larger problem is that even if valid, constitutional laws exist, they
are to a large extent unenforceable because:
- U.S. law enforcement agencies do not have the time, resources and
manpower to pursue what would likely amount to millions of individual
- A major portion of spam sent to U.S. addressees comes from foreign
countries which, in most cases, have no anti-spam laws at all, or if
they do are likewise unable (or unwilling) to follow up and prosecute.
Why do they keep "spamming"? Nobody buys
stuff through "spam", do they?
Available figures suggest that the "rate of return" on direct
e-mail marketing is somewhat less than one percent, some peg it at about
0.75%. Compared to more traditional Third Class "junk mail" postal marketing, this is abysmal,
but on the other hand, the cost to send several million e-mails is miniscule
when compared to the cost of third class mailing of a similar number of
printed flyers, etc. So, surprisingly, "spamming" turns out
to be very profitable if the spammer has a big enough list of valid e-mail
addresses. The plain fact is that spammers keep spamming because they
are making money, because there are enough people who do
respond to spam ads to make it worthwhile.
How do they get these addresses - including mine?
It is nearly impossible to keep your e-mail address "secret"
or exclusive, no matter how hard you try. There are numerous ways that
spammers acquire the addresses they bombard. Here are just a few:
- If you ever entered your e-mail address on a website, it might be
used by that site, or sold or given to others for mass mailings
- Any e-mail you send out contains your return address. The original
recipients may forward it on through a chain of others until it lands
on a spammer's list
- If you use "vacation/out of office" replies on your e-mail account when you're away, you may be automatically generating a reply to each incoming spam message that confirms that your address is valid, and that someone is reading it (see "What should not be done about 'spam'?", below). This makes it more likely that your address will be sold/swapped by spammers.
- Spammers use "bots" to scan Usenet newsgroup postings for
e-mail addresses, so if you ever posted to a group and put your e-mail
address in the post, it may have been "harvested" in this
- Similarly, spammers' "bots" also cruise the web l