$873 million Facebook award could add fuel to CAN-SPAM lawsuits

Now that courts have awarded hundreds of millions of dollars in damages to both Facebook and MySpace, will more civil lawsuits start smacking spammers directly in their wallets?

In a ruling that looks likely to further the use of the federal CAN-SPAM Act in civil lawsuits, MySpace has been awarded $873 million in damages from a Canadian spammer accused of sending sexually explicit messages to members.

The ruling against Adam Guerbuez and Atlantis Blue Capital by federal judge Jeremy Fogel in San Jose, California represents the largest judgment in history for an action brought under CAN-SPAM, according to Max Kelly, Facebook's director of security.

"We've all experienced spam -- those unwanted and, sometimes, inappropriate marketing messages. The bad guys behind those messages are always looking to find new ways to annoy people and Facebook's users have been among those targeted. We don't take this affront to our users lying down," Kelly wrote in his blog yesterday.

Signed into law December 16, 2003, CAN-SPAM establishes the United States' first set of national standards for commercial e-mail. The law permits e-mail marketers to send unsolicited commercial e-mail, but only if it meets three basic types of compliance defined in the Act: unsubscribe, content, and sending behavior.

Under "sending behavior compliance," for example, it is illegal under CAN-SPAM to send a message to a harvested e-mail address, through an open relay, or with a false header.

Companies that provide Internet access can sue suspected spammers under the CAN-SPAM Act, as social networks Facebook and MySpace have both already done. In addition, the FTC and other federal and state agencies can enforce the law against organizations under their jurisdiction. The FTC has reportedly brought almost 30 actions against offenders since 2003.

Facebook accused Guerbuez and his apparently fictitious company of sending more than four million illegal messages to members in March and April offering "male enhancement" drugs and other products.

Also under Facebook's complaint, Guerbuez managed to get Facebook logins and passwords of many members, sometimes taking them to phishing sites. Computers would then automatically log into Facebook profiles and send out more spam.

The court found that Guerbuez illegally accessed Facebook's user profile information to start his spamming activities.

In another recent case involving a social networking site, Sanford Wallace
and Walter Rines were found guilty of sending unsolicited advertisements for pornography and gambling Web sites to MySpace users. The two were ordered to pay $230 million to MySpace, the largest reward under CAN-SPAM up to that time.

But it isn't really all about the money, according to Facebook's Kelly, who doubts that Guerbuez will be able to come up with anything close to $873 million to pay the damages.

"We are confident that this award represents a powerful deterrent to anyone and everyone who would seek to abuse Facebook and its users," Kelly wrote.

Facebook is still reportedly investigating spam messages in members' profiles which started offering phony Macy's gift cards last month.

Meanwhile, could the Facebook and MySpace rulings serve as precedents for other anti-spam cases, too? Many civil lawsuits filed by ISPs since 2003 under the CAN-SPAM Act are still pending, although some of these have been settled.