4 ms·

Deliberately circumventing email security controls, automation detection, and abuse prevention systems of email service providers constitutes a violation of 18

by ttul 2y ago

Deliberately circumventing email security controls, automation detection, and abuse prevention systems of email service providers constitutes a violation of 18 U.S.C. § 1030 (the Computer Fraud and Abuse Act). When done as part of a business operation with intent and at scale, this behavior meets the criminal threshold of intentionally accessing protected computer systems without or in excess of authorization and impairing their integrity and availability. Anti-abuse mechanisms are security controls under CFAA. Knowingly subverting them is criminal, not civil. I don’t know who runs “za-zu.com”, but they may wish to take down their handbook lest they capture the interest of law enforcement agencies who are working with Google and others major email services ongoingly to locate and take down spamming groups.

dannyobrien 2y ago
Are there examples of prosecutions of this nature?
- ttul 2y ago
  Yes, there have been notable CFAA prosecutions involving spamming activities. One significant case involved Power Ventures, which faced prosecution for both CFAA and CAN-SPAM violations. The company was sued by Facebook for sending promotional emails and messages through Facebook's platform without authorization[5][6]. The Department of Justice has recently revised its CFAA prosecution policies, particularly following significant court decisions that have narrowed the statute's interpretation. The DOJ now focuses on more clear-cut violations rather than mere terms of service violations[2][4]. For CFAA prosecution to proceed today, prosecutors must typically demonstrate that: - The defendant was aware of specific access restrictions - There were clear technological measures attempting to prevent unauthorized access - The defendant knowingly circumvented these measures[4] The cold email handbook clearly demonstrates how to circumvent Gmail’s limitations and the author is clearly aware that doing so violates their terms of service. So I would argue they are at risk of being prosecuted. And as someone who runs a large email filtering service, I can tell you with some authority and confidence that the industry really loves helping law enforcement go after these groups. Sources [1] CFAA Cases - NACDL https://www.nacdl.org/Content/CFAACases https://www.nacdl.org/Content/CFAACases [2] Hacking the CFAA - Infosecurity Magazine https://www.infosecurity-magazine.com/magazine-features/hacking-the-cfaa/ https://www.infosecurity-magazine.com/magazine-features/hack... [3] The Most Controversial Hacking Cases of the Past Decade - WIRED https://www.wired.com/2015/10/cfaa-computer-fraud-abuse-act-most-controversial-computer-hacking-cases/ https://www.wired.com/2015/10/cfaa-computer-fraud-abuse-act-... [4] DOJ Revises Policy for CFAA Prosecution to Reflect Developments ... https://newmedialaw.proskauer.com/2022/05/24/doj-revises-policy-for-cfaa-prosecution-to-reflect-developments-in-web-scraping-and-other-matters/ https://newmedialaw.proskauer.com/2022/05/24/doj-revises-pol... [5] Lessons from the Power Ventures Case Include “Terms of Use Can ... https://www.hoganlovells.com/en/publications/lessons-from-the-power-ventures-case-include-terms-of-use-can-create-computer-fraud-and-abuse-act-liability https://www.hoganlovells.com/en/publications/lessons-from-th... [6] 9th Circuit Weighs in on CFAA and CAN-SPAM - Cyber Report https://ilccyberreport.wordpress.com/2016/07/21/9th-cir-weighs-in-on-cfaa-and-can-spam/ https://ilccyberreport.wordpress.com/2016/07/21/9th-cir-weig...
justtocomment 2y ago
> [...] but they may wish to take down their handbook lest they capture the interest of law enforcement agencies [...] I wonder if I'm oblivious to some kind of sarcasm in your comment, because if I take what's written at face value, it sounds like you advocate for not getting caught in favour of not actually doing the criminal thing.
- ttul 2y ago
  I’m not implying that. I’m hopeful they’ll take down their handbook so that others don’t follow in their footsteps. I also wish for their business to cease operating.
  - justtocomment 2y ago
    Thank you for clarifying! (I'm not a native speaker, so your answer is much appreciated).

by ttul 2y ago

dannyobrien 2y ago

Are there examples of prosecutions of this nature?

ttul 2y ago
Yes, there have been notable CFAA prosecutions involving spamming activities. One significant case involved Power Ventures, which faced prosecution for both CFAA and CAN-SPAM violations. The company was sued by Facebook for sending promotional emails and messages through Facebook's platform without authorization[5][6]. The Department of Justice has recently revised its CFAA prosecution policies, particularly following significant court decisions that have narrowed the statute's interpretation. The DOJ now focuses on more clear-cut violations rather than mere terms of service violations[2][4]. For CFAA prosecution to proceed today, prosecutors must typically demonstrate that: - The defendant was aware of specific access restrictions - There were clear technological measures attempting to prevent unauthorized access - The defendant knowingly circumvented these measures[4] The cold email handbook clearly demonstrates how to circumvent Gmail’s limitations and the author is clearly aware that doing so violates their terms of service. So I would argue they are at risk of being prosecuted. And as someone who runs a large email filtering service, I can tell you with some authority and confidence that the industry really loves helping law enforcement go after these groups. Sources [1] CFAA Cases - NACDL https://www.nacdl.org/Content/CFAACases https://www.nacdl.org/Content/CFAACases [2] Hacking the CFAA - Infosecurity Magazine https://www.infosecurity-magazine.com/magazine-features/hacking-the-cfaa/ https://www.infosecurity-magazine.com/magazine-features/hack... [3] The Most Controversial Hacking Cases of the Past Decade - WIRED https://www.wired.com/2015/10/cfaa-computer-fraud-abuse-act-most-controversial-computer-hacking-cases/ https://www.wired.com/2015/10/cfaa-computer-fraud-abuse-act-... [4] DOJ Revises Policy for CFAA Prosecution to Reflect Developments ... https://newmedialaw.proskauer.com/2022/05/24/doj-revises-policy-for-cfaa-prosecution-to-reflect-developments-in-web-scraping-and-other-matters/ https://newmedialaw.proskauer.com/2022/05/24/doj-revises-pol... [5] Lessons from the Power Ventures Case Include “Terms of Use Can ... https://www.hoganlovells.com/en/publications/lessons-from-the-power-ventures-case-include-terms-of-use-can-create-computer-fraud-and-abuse-act-liability https://www.hoganlovells.com/en/publications/lessons-from-th... [6] 9th Circuit Weighs in on CFAA and CAN-SPAM - Cyber Report https://ilccyberreport.wordpress.com/2016/07/21/9th-cir-weighs-in-on-cfaa-and-can-spam/ https://ilccyberreport.wordpress.com/2016/07/21/9th-cir-weig...

justtocomment 2y ago

> [...] but they may wish to take down their handbook lest they capture the interest of law enforcement agencies [...] I wonder if I'm oblivious to some kind of sarcasm in your comment, because if I take what's written at face value, it sounds like you advocate for not getting caught in favour of not actually doing the criminal thing.

ttul 2y ago
I’m not implying that. I’m hopeful they’ll take down their handbook so that others don’t follow in their footsteps. I also wish for their business to cease operating.
- justtocomment 2y ago
  Thank you for clarifying! (I'm not a native speaker, so your answer is much appreciated).