http://www.nytimes.com/2003/10/28/technology/28SPAM.html

October 28, 2003

Big Companies Add to Spam

By
SAUL HANSELL

Ever wonder how a certain company sending unsolicited e-mail
messages got your address?

Michael Rathbun, the director of policy enforcement at Allegiance
Telecom, an Internet service provider in Dallas, says he thinks he has much
of the answer.

Some five years ago, Mr. Rathbun bought a Palm
hand-held organizer and, in registering it on Palm's Web site, gave the company
an e-mail address he never used for anything else. Initially his in-box
received only offers for products related to the organizer, but eventually he
started getting advertising from some well-known companies like Bank
of America, SBC
Communications and Sprint.
Lately, that one address alone has been receiving dozens of e-mails a month
offering everything from travel clubs to acne remedies.

"This is not stuff," Mr. Rathbun said, "that I should be
getting from them."

The problem of spam or unwanted commercial e-mail is usually attributed to
outlaws and hucksters — peddlers of pornography, get-rich-quick schemes and
pills of dubious merit — who use hackers to send their fraudulent messages in
ways that cannot be traced.

But the torrent of spam that is flowing into people's electronic mailboxes
comes not only from the sewers but also from the office towers of the biggest
and most well-known corporations.

Established companies insist they send e-mail only to people who have
voluntarily agreed to receive marketing offers. A spokeswoman for Palm says it
does not know how Mr. Rathbun's e-mail address got into the hands of spammers
and says it has never sold its customer list.

But often companies rent e-mail lists from a cottage industry that has
emerged to lure Internet users, through a variety of schemes, into signing up
for e-mail marketing.

At best, if you have ever entered a contest to win a prize, subscribed to an
online newsletter or simply purchased a product on the Web, you may well have
also agreed, as many such fine-print contracts put it, "to receive
valuable offers from our marketing partners."

This practice falls under the rubric of what is called opt-in marketing, or
getting permission to send advertising messages.

But many e-mail executives admit that these same list companies also add to
their databases by buying, trading — sometimes even stealing — names.

"Everyone is looking for a quick buck now, and people are claiming to
sell opt-in data who don't have it," said Pesach Lattin, who runs Adspyre,
a New York e-mail marketing firm.

Moreover, some companies have allowed the e-mail addresses of their own
customers, either deliberately or inadvertently, to fall into the hands of list
peddlers who in turn sell them to e-mail marketers of all stripes. Sometimes,
the lists are stolen from corporate owners by employees or vendors looking to
make a quick profit. But in many cases, the big companies are deliberately
buying and selling access to names, relying on privacy policies — often hard to
find on their sites — that they say permit such actions.

"White-collar spam" is how Nick Usborne, a newsletter writer and
Internet marketing consultant, refers to this phenomenon.

"When a responsible company," Mr. Usborne said, "gets someone
to sign up for a newsletter and says, now that we have their e-mail address
let's make more money off it and send them e-mail they didn't ask for, that's
white-collar spam."

The antispam bill passed unanimously by the Senate last week imposes tough
penalties on people involved in the lowest forms of spam but it does not deal
with the central questions Mr. Usborne and others raise about white-collar
spam. It does nothing, for example, to establish rules defining an appropriate
list of names that a purveyor of a legitimate product can use to send an offer
by e-mail. Nor does it regulate the transfer of names between companies.

The law would require that every e-mail message offer recipients a method to
remove themselves from an advertiser's mailing list. But with the way that
names are traded today, this method would do little to reduce the amount of
e-mail people receive, industry executives say.

"People don't realize that once you sign up for a contest or free stuff
on the Web and you forget to uncheck a box, these people will pass your name to
a hundred other people,'` said Paul Nute, a partner of Soho Digital, a New York
advertising agency that represents e-mail marketers. "You've just raised
your hand and said, `Send me the diet pill offers.' And there is no way to get
them all to stop."

A new state law scheduled to take effect in California on Jan. 1 tries to
take a stricter approach: it requires that commercial e-mail to or from anyone
in the state be sent only to people who specifically request information from
the advertiser. Many in the e-mail industry read the law as curbing many of the
more common ways that names are gathered and used, but the exact limits will be
left up to the courts to define.

Moreover, if the federal bill passed by the Senate is enacted it would void
most state spam laws, including California's. Although the Senate bill also
authorizes the Federal Trade Commission to create a do-not-spam list modeled
after the wildly popular do-not-call list that is already starting to curb
unwanted telemarketing calls, F.T.C. officials said that, unlike telemarketing,
it would be extremely difficult to determine the difference between solicited
and unsolicited e-mail. That is in part because so many companies go beyond
their own customers to rely on opt-in list collectors.

Not surprisingly, companies that are active users of conventional mail solicitations
have gravitated to e-mail, which can be far cheaper, to push certain products.
These include Morgan
Stanley's Discover Card, Altria's Gevalia Coffee, Schering-Plough's
Claritin, and The New
York Times, which uses opt-in e-mail lists to sell subscriptions.

One such list maker is Xuppa.com, a 38-person firm working from a cramped
office in Midtown Manhattan across Seventh Avenue from Macy's department store.
It has gathered half a billion e-mail addresses since it started four years
ago, but most of those are no longer valid. The 65 million names left on its
lists, Lance Laifer, Xuppa's chief executive, says, have given permission to
receive marketing messages.

Visitors to Xuppa.com are encouraged to enter its $1 million sweepstakes. To
do so they must enter not only their e-mail address but postal address and
telephone number as well. Entering the contest gives Xuppa permission to market
to users. On the same Web page, some 75 other offers from advertisers are
displayed, each adjacent to a check box — some already checked by default. When
Xuppa users enter the contest, their personal information is passed to any
advertiser whose offer is checked.

"There are a lot of people who would rather register and give their
e-mail addresses than pay for services," Mr. Laifer said.

This process of putting many offers on one page where users enter
information is called co-registration, and it has become one of the main ways
that names are gathered online.

Some such sites make it hard for users to see all the lists they are
joining. AmericanGiveAways.com, a site run by Synergy6, allows users to
register to earn free gifts. "By signing up with us," a notice at the
bottom of the page reads, "you are also agreeing to receive great offers,
special coupons and promotions from our partner sites."

Dozens of partners are listed on separate links, yet once a single button is
clicked each of the advertisers can claim — with some degree of truth — that
the user agreed to receive marketing messages.

Such sites stretch users' consent beyond any recognition, argues Seth Godin,
a former Yahoo
executive, who coined the term "permission marketing" to define the
practice of sending e-mail marketing to people who ask for it.

"The people who are talking about permission marketing are almost
entirely doing it wrong," Mr. Godin said. "Greed and avarice drove
people to wreck the system."

The trade in e-mail names is not limited to the back alleys of the Internet.
Big traditional mailing list companies — like Equifax
and Experian — have been buying e-mail addresses, often from these contest
sites, and linking them with their vast stores of other information about
people. They use this so marketers can send e-mail to people with, say, a
certain disease, or who own a specific car, and so on.

The chain of permission can be stretched even further. Some names come from
customer lists of Internet companies that collapsed as the dot-com bubble
burst. For example, MatchLogic, a Colorado marketing company that gathered 13
million names was acquired by Excite@Home, a high-speed Internet service
controlled by AT&T.

MatchLogic had a clear privacy policy that said it would not transfer those
names to any third party without permission. But when Excite@Home was
liquidated in bankruptcy in 2001, its mailing list was purchased by a group of
marketing firms led by RHC Direct of Salt Lake City. Some of those companies in
turn sold the list to others. Robert Caldwell, RHC's president, says he
believes it is also being traded by former MatchLogic employees.

"Names get flipped and flipped and flipped until everyone's name is
everywhere," Mr. Caldwell said.

Nothing is wrong with that, he contended, because the people who originally
provided their e-mail addresses agreed to receive marketing messages.

"As much as people talk about privacy," he said, "they will
give it up for the chance to win a Lexus."

Mr. Rathbun, who also has an e-mail address exclusively used to enter a
MatchLogic contest, says it has received thousands of pieces of spam, some from
big companies.

Bankruptcy courts have generally allowed the sale of lists from failed
companies like MatchLogic. But those transfers were against Excite@Home's
stated privacy policy, said Christopher Kelly, Excite@Home's former chief
privacy officer, now a lawyer with Baker & McKenzie. He said he would
advise any client not to send e-mail to that list "as there is
insufficient proof of the permission of the information."

Officials at many of the big companies marketing by e-mail admit that the list
companies are not always honest about the sources of their names. But they say
there is no way to test the quality of a list other than to send e-mail to its
addresses and find out how many complaints result.

"There are some irresponsible companies that are bringing a bad name to
those of us trying to be responsible,'` said Rajive Johri, executive vice
president for marketing for J.
P. Morgan Chase's credit card unit, an active user of opt-in e-mail.

"We do a lot of due diligence on the vendors we utilize," Mr.
Johri said. "At the same time, can I feel 100 percent sure that there are
no abuses? No."

Copyright 2003 The
New York Times Company