Turning up the heat on spam

WASHINGTON -- Sitting in a plush leather chair in a borrowed office at George Washington University Law School, Eric Menhart seems nothing more than an ambitious, third-year law student with some impressive experience under his belt.

He has interned for Congress, the Federal Trade Commission and the Joint Center for Political and Economic Studies, a Washington think tank. He's on the elections and technology committees of the American Bar Association's student division, and he started his own Web site company in college, which he sold for $21,000.

But his enterprising nature has led him into another pursuit that some people describe in harsh terms -- like "extortion" or "blackmail."

"People like [Menhart] should be locked up in prison for life," Paul Kroto wrote in a letter to a Montgomery County judge after Menhart sued him for sending what appeared to be illegal spam, the popular term for unsolicited advertising that floods e-mail accounts. "They are just looking to make a quick buck on innocent people," Kroto said.

Menhart, 25, is fighting spam by filing civil suits against the people and companies who allegedly send it. He has turned the crusade into a full-fledged business -- a limited liability corporation named MaryCLE, which stands for Maryland Legal Consumer Equity and is pronounced "miracle."

The company and a partner, an Internet service provider, have filed nine lawsuits in Maryland courts. The suits seek between $3,000 and $168,750 in damages from defendants in eight states, including Delaware, Illinois, Wisconsin and Tennessee.

Menhart is one of a handful of people around the country who are using recent state laws against spam to mount a cyber-vigilante battle against junk e-mail, which has grown into a fixture -- many say an annoying one -- of life in the digital age. It's also a problem for legitimate e-mail marketers, who are tired of being lumped in with those less scrupulous.

"The hallmark of legitimate e-mail marketing is that the company has asked and received your permission" to send it, said Laura Atkins, an e-mail marketing consultant and president of California-based SpamCon Foundation, which supports efforts to eradicate spam through filing lawsuits.

Companies should be truthful, send material only to clients who've asked for it and provide an audit trail, Atkins said. Such suggestions are similar to the requirements in the year-old law that regulates telephone solicitations.

Spam rarely follows those provisions. It clogs computer in-boxes with often fraudulent messages, bogs down personal and business equipment and often is offensive. Some estimate that spam makes up as much as 80 percent of electronic mail messages. Much of it is designed to part the naive from their money.

But while millions of people denounce spam, few do anything about it, in part because spammers are difficult to catch. They're even tougher to pin down than their older cousins: junk-mail senders and telemarketing operators.

"They're modern snake-oil salesmen that rely upon the [anonymity of the] Internet in being able to disappear," said Chris Hoofnagle, an attorney and associate director of the Electronic Privacy Information Center, a civil liberties research facility based in Washington. "It takes a more sophisticated litigant to track these defendants."

Chasing spammers is usually done by "the big guys," such as Internet service provider America Online Inc., state attorneys general or the Federal Trade Commission, Atkins said.

Microsoft Corp. is involved in more than 100 cases against spammers in state and federal courts. And this month, a Virginia court handed down the country's first felony spam conviction. Virginia's attorney general indicted defendants from North Carolina. The jury recommended nine years in prison for one spammer and a fine for his sister of $7,500.

Sentencing for the spam operators, which prosecutors described as among the top 10 in the world, is set for February. The illegal business was said to have generated nearly $1 million a month in revenue and used fake names to sell pornography and questionable products.

More than three dozen states, including Maryland, have spam-regulating laws on the books. But most were pre-empted by the federal CAN-SPAM Act, which took effect in January and doesn't allow individuals to sue for damages.

The federal law regulates how spam may be sent: Among other requirements, it must have an "unsub- scribe" option and contain warnings about any pornographic material. Language in the law says the act "supersedes" all similar state legislation unless those laws -- like Maryland's -- address the fraud aspect of spam.

"Eric is basically riding on a loophole in the CAN-SPAM Act that allows states to create greater protections against deceptive or fraudulent spam," Hoofnagle said. "It's going to take a wave of litigation like Eric's to bring spam down."

Two Maryland laws

There have been other cases of individuals taking anti-spam action. In January, a Washington state man made national headlines when he filed a $600,000 lawsuit in a state court against a Pennsylvania e-mail marketer. But such enforcement efforts are usually few and far between and involve small claims. No one besides Menhart appears to have set up a company specifically to take on spammers, say people who follow the industry.

Maryland has two laws specifically targeting spam -- a civil statute passed in 2002 and another imposing criminal penalties that took effect last month. Menhart is employing the civil version, the state's 2002 Commercial Electronic Mail Act. It allows residents to sue for $500 in civil damages for every misleading or fraudulent e-mail they receive and Internet service providers to sue for up to $1,000 per message. He also files the lawsuits under the state's Consumer Protection Act, asking that the "wrongful and deceptive practices" be stopped.

Menhart said his goal is getting people to comply with the law, and they're "much more willing to pay attention to you if they know it's going to cost them. That's the way the world works. ... People pay attention to lawsuits."

But those he sues contend his goal is making money, and he gets it by baiting e-mail marketers.

By his own description, Menhart carefully set up MaryCLE to specifications within the Maryland law, and then sat back, waiting for the illegal e-mail to flow in. He incorporated the company last year in Maryland, listing an Adelphi address he and some friends were renting, so the business could be considered a resident even though Menhart now lives in Washington.

He also bought the Internet domain "maryland-state-resident.com" so it would -- or should -- be clear to e-mail marketers that they were sending messages to a Maryland resident. And he partnered with an Internet service provider so his lawsuits would have more teeth, in part because ISPs lose money because of spam and can prove it. There's the bonus of being able to sue for higher amounts, as well.

Spam is "the real bane of our existence," said Andrew Wheelock, president and founder of Neit Solutions Inc., a Frederick-based Internet service provider. "As a consumer, it's fairly annoying, but it doesn't really cost you anything. On the ISP side, it does."

Wheelock, whose company hosts Menhart's Web site (www.marycle.com), said spam costs him labor hours, bandwidth, customer satisfaction and disk space. So when Menhart cold-called him last year and offered another way to fight it, Wheelock signed on.

Menhart chooses defendants by sifting through the more than 200 spams MaryCLE receives daily, picking the worst offenders. Whether he is able to track down the senders, though, often determines if he files suit.

"Obtaining judgments is not necessarily our goal in most cases. First, we want people to stop violating the law and stealing electronic resources," Menhart said in an e-mail interview last week. "We enforce when people either (a) ignore the fact that they are in violation of the law, or (b) tell us that they're not doing it, and offer no proof on the matter. ... We have never, and will never, file a case where we don't have the documentation to back it up."

Menhart said he can't discuss the particulars of the suits he files. But court records and telephone interviews show MaryCLE's early targets include Mark Wolf, the father of a 15-year-old spammer from Idaho who sent MaryCLE two messages from his dad's e-mail account. Menhart claimed the e-mail messages were illegal and filed a $3,000 suit against Wolf, who filed a $5,000 countersuit. Both sides eventually dropped their suits, but it still cost Wolf $2,500 in attorney's fees.

The defendant in another case, James Keith McCune of Florida, said he was the wrong guy and called the $3,000 suit "arbitrarily" filed. McCune said he gave Menhart the name of the marketing company he worked for, and the suit was withdrawn.

Kroto, who wrote the letter of outrage to the judge, is a registered dietitian who said he does e-mail marketing on the side. He said he followed all laws, and if he didn't, it's not his fault because he bought a list of e-mail addresses from a disreputable company.

"I was ready to pin it on" the vendor that provided the e-mail addresses, Kroto said in a telephone interview from Buffalo, N.Y. Now, he's relying on the Montgomery County suit being tossed out of court because he says it's baseless. He doesn't plan to attend any hearings.

"I don't know if it's illegal," Kroto said about Menhart's efforts. "But it's definitely unethical."

Menhart's suit against Kroto, filed in February, seeks $71,250 and claims Kroto sent messages with false and misleading subject lines and deceptive transmission paths meant to disguise the messages' origin.

A Prince George's County District Court judge recently awarded MaryCLE and Neit Solutions a $4,525 judgment against a 72-year-old Florida spammer, Erwin Koltay, who never showed up for the hearing. Koltay has previous fraud convictions, but still complained in a letter to Menhart that he was a "small fish" and shouldn't be used to "make your stupid spam points." Koltay also accused the judge of corruption, set up a Web site to denounce MaryCLE and threatened to take further steps that "will really hurt."

Menhart will have to travel to Florida and file a claim there to get the money.

Those suits are small potatoes, however, compared with Menhart's case against Joseph Frevola, a New York e-mail marketer and president of First Choice Internet Inc.

Menhart claims Frevola sent MaryCLE more than 80 messages containing false information via Neit's servers. The suit, filed in Montgomery County Circuit Court, asks for $168,750 from Frevola: $90,000 on behalf of Neit, $45,000 for MaryCLE and $33,750 to cover court and attorney costs.

It's the first time the Maryland law has been tested in a courtroom, and both plaintiff's and defendant's attorneys are eager to have the law clarified by a judge.

"No court has interpreted this statute yet; this is a case of first impression," said Andrew Dansicker, the Baltimore lawyer representing Frevola. Frevola did not want to be interviewed but in a deposition stated that Menhart "files these lawsuits presumably to extort monies from small companies such as First Choice."

The case is sitting in the chambers of Judge Durke G. Thompson, where it has been since Nov. 1 while the judge decides whether it should go to trial. Any day now, the judge is expected to rule on Dansicker's motion to dismiss the suit. The attorney says the Maryland law is unconstitutional and has no jurisdiction over Frevola, who did nothing wrong anyway.

"I would characterize [the lawsuit] as frivolous," Dansicker said.

Still, Dansicker said his client has stopped sending mass e-mailings because of Menhart's lawsuit and fear of others like it.

Defendants often contend that the emerging spam laws are unconstitutional, have no jurisdiction over them and that extortion, not altruism, is at the root of the lawsuits.

Offer to settle

Menhart said he is not making any money, though he does offer defendants the chance to settle out of court for undisclosed sums. He added that the financial settlements are not antithetical to his goal of ending spam because he needs the funds to file other cases.

"It always helps to make a couple bucks," he said. Menhart had offered to settle with Frevola for $20,000.

Menhart has big plans for his "consumer protection firm." He is turning it into a nonprofit organization, which means he'll be able to accept donations. And soon he'll turn it into a career. Right now, he has to pay an attorney $200 an hour to oversee his cases, but after graduation in May, Menhart expects that to change: MaryCLE will become his practice.

"This type of law is risky," Menhart said. "But that's fine with me. I'm not risk averse."

Industry analysts believe that managing spam will take a multipronged approach, involving commercial remedies, legislation and the courts. Individual litigation like Menhart's helped curtail junk faxes, which are almost nonexistent today, Hoofnagle said. But others remain skeptical.

"I think it's an interesting experiment. Still, I'd be surprised if it has much impact on spam," said David E. Sorkin, an associate law professor at the Center for Information Technology and Privacy Law at the John Marshall Law School in Chicago. "More likely, it's just a matter of principle. ... Unless he gets a large judgment, it's not going to make much of a dent."

Md.'s anti-spam laws

Commercial Electronic Mail Act

Enacted in 2002, it permits civil damages for Maryland residents who receive e-mail that has false or misleading information about its transmission path or in its subject line. Individuals may sue for $500 per message or more, plus legal fees, if they can prove damages, such as having lost money by falling for a scheme. Internet service providers may sue for $1,000 per message or more. The act also allows parties whose Internet domains were used without their permission to sue for $500 per instance.

Spam Deterrence Act

A criminal statute enacted this year, it prohibits people from sending commercial e-mail with falsified address information, registering for domain names under false circumstances, or using the protected computer of another to send a message without permission or with the intent to deceive. Such acts are considered misdemeanors and punishable by fines of up to $25,000 and 10 years in prison.

Recommended on Baltimore Sun