Spammers must abide by rules.

Byline: Greg Bolt The Register-Guard

It took six years for Congress to prepare legislation on junk e-mail, and what it served up is called CAN SPAM.

That's the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (although it takes effect on the first day of 2004, it was signed into law in the waning days of 2003).

The law puts new requirements on those who send out unsolicited commercial bulk e-mail.

Not everything in CAN SPAM takes effect today.

The Federal Trade Commission and U.S. attorney general have 120 days to develop a notice to be required on all commercial e-mail that is sexually oriented, and the FTC has 18 months to prepare for Congress a plan that would require all commercial e-mail to carry the letters ADV in the subject line.

Also, the FTC has six months to prepare a report on the feasibility of creating a do-not-spam list, similar to the highly popular do-not-call list for telemarketing.

Here's a breakdown of the law. For the full text of the bill, visit www.spamhaus.org/ legal/CAN-SPAM.html.

Notice: Until a plan for requiring the letters ADV in all e-mail advertising is adopted, the law requires all commercial e-mail to include "clear and conspicuous identification" that it is a solicitation. It doesn't spell out how that identification must be made.

Identity: Commercial e-mail must contain accurate and valid information about the sender. The "From" line must contain the name of the person or company that actually sent the message, and the message must contain a valid physical postal address for that person or company.

Transmission: The sender of commercial e-mail cannot disguise the source of the message by using technology or engaging in practices that make it appear that the message came from someone else. It outlaws techniques such as using open relays, proxies, scripting or hijacking third-party computers to send commercial messages.

Finding you: The law bans two of the most popular methods of creating electronic mailing lists: harvesting and dictionary attacks. Harvesting, or scavenging, is taking e-mail addresses from public Web sites, such as company Web pages and computer bulletin boards. Dictionary attacks use randomly generated letter and word strings in message addresses sent out by the millions in an effort to stumble on valid addresses.

Opt-out: Commercial e-mail must have a clear mechanism that allows recipients to have their Internet address removed from the sender's mailing list. All requests to "opt out" of future mailings must be honored.

Penalties: Violations of CAN SPAM can be significant. Each messages that violates the law can bring a fine of up to $250, up to a total of $2 million. That total can be tripled in aggravated cases, but it also can be reduced if defendants show they have put measures in place to comply with the law. A prison sentence of up to five years also can be imposed.

Enforcement: Only the federal government, state attorneys general and commercial Internet service providers can bring a criminal or civil action under the law; individuals cannot. Also, the law pre-empts the many state laws regulating the transmission of commercial e-mail - including many that are stricter - but doesn't preclude state laws addressing fraud or deception.

ON THE INTERNET

For the full text of the bill, visit www.spamhaus.org/legal/CAN-SPAM.html