FTC Staff Comment to the Honorable Angelo "Skip" Saviano Concerning Illinois H.B. 0572 to Create a Child Protection Registry

UNITED STATES OF AMERICA
FEDERAL TRADE COMMISSION
WASHINGTON , D. C. 20580
Offce of Policy Planning
Bureau of Consumer Protection
Bureau of Economics
October 25 , 2005
The Honorable Angelo " Skip " Saviano
State Representative
77'h District
House of Reprcsentati ves
314 State House
Springfield , IL 62706
Re: Ilinois HE 0572
Dear Representative Saviano:
The staff of the Federal Trade Commission s ("FTC" or " the Commission ) Office of
Policy Planning, Bureau of Consumer Protection , and Bureau of Economics ' are pleased to
respond to your letter of September 12 , 2005 , that asks for our views on Ilinois HE 0572 ("HE
0572" or " the bill" ), a bil that appears to be designed to protect children from unwanted
commercial messages that advertise products or services they are prohibited from purchasing or
contain adult advertising or links to adult content. In particular , your letter solicited our expertise
and opinion on whether HE 0572 would reduce the amount of unwanted emails and what impact
the bill might have on Ilinois consumers and competition.
Ilinois HE 0572 would require the Ilinois Attorney General to establish a Child
Protcetion Registry and make it unlawful for a person to initiate any commercial message or
communication to any registered contact point if the message or communication advertises
products or services that a minor child is prohibited by law from purchasing, or if the message
contains or advertises adult content or links to such content. The bil would also impose liability
on a person that promotes or allows the promotion of such a message through a third party.
This letter briefly summarizes the Commission s interest and experience in consumer
privacy and provides the staff's opinion regarding the possible impact of HE 0572 on consumers
and competition, Based on our experience , our review of your letter , and HE 0572 , the FTC staff
have reached the following conclusions:
This letter expresses the views of the FTC' s Office of Policy Planning, Bureau of
Consumer Protection , and Bureau of Economics, The letter does not necessarily represent the
views of the Commission or of any individual Commissioner. The Commssion has , however
voted to authorize us to submit these comments.

Because existing computer security techniques arc inadequate to prevent the abuse
of such a registry, HE OS72 may provide pedophiles and other dangerous persons
with a list of contact points for Ilinois children.
HE OS72 is unlikely to reduce the amount of email spam received by registered
email addresses. Further, because such a registry cannot be cffcctively monitored
for abuse , it may have the unintended consequence of providing spammers with a
mechanism for verifying the validity of cmail addrcsses. This conscquence may
actually increase the amount of spam sent to registered children s addresses in
general , including spam containing adult content.
The proposed registry would likely impose substantial costs on legitimate email
marketers. Combined with the prospect of substantial criminal and civil liability
for individual violations , the extra burden that HB OS72 would place on Internet
sellers may, therefore , hamper a particularly competitive segment of merchants in
those industries covered by HE OS72 , curtail the benefits of such competition to
consumers , and cause consumers to no longer receive information that they value,
A brief summary of the Commission s history in consumer privacy and a detailed analysis
in support of each of the FTC staff's conclusions is provided below.
Interest and Experience of the Federal Trade Commission
The FTC enforces Section S of the Federal Trade Commission Act , which broadly
prohibits "unfair or deceptive acts or practices in or affecting commerce. '" Protecting consumer
privacy is a central element ofthe FTC' s consumer protection mission.' In recent years
advances in computer technology have made it possible for detailed information about people to
be compiled and shared more easily and cheaply than ever. These developments have produced
many benefits for society as a whole and individual consumers.' At the same time , some
consumers have expressed concerns about the compilation and sharing of their personal
information and a desire to limit unwanted contacts from marketers that use such information,
As personal information bccomes more accessible , individuals and institutions have foundit
necessary to take precautions against the misuse of such information. In recent years the FTC
has brought a number of cases to enforce promises in privacy statements , including promises
IS U.S, C, 9 4S,
See generally 	FTC , PRIVACY INITIATIVES (200S),
http://ftc 	. gov Ipri vacyli ndex . html.
For example , it is easier for law enforcement to track down criminals , for banks to
prevent fraud , and for consumers to obtain credit.

about the security of consumers ' personal information.
Under the Gramm-Leach- Bliley Act, the Commission has also implemented rules
concerning financial privacy notices and the administrative , technical , and physical safeguarding
of personal information and has enforced provisions against prctcxting 	The Commssion also
protects consumer privacy under the Fair Credit Reporting Act' and the Chi Idren ' s Online
Privacy Protection Act." The FTC also educates consumers and businesscs about thc importance
of personal information privacy and security .' In addition , the Commission provides Congress
FTC , ENFORCING PRIVACY PROMISES: SECTION S OF THE FTC
C-
ACT (200S), 	at 	http://ftc. gov/privaey/privacyinitiatives/promises. html. 	See, e. 	, Eli Lilly 	Co.
FTC Dkt. No. C-4047 (May 10 , 2002) (settling charges relating to the unauthorized disclosure of
sensitive personal information collected through the company s Prozac.com website), 	available
at http://www.ftc. gov/os/2002/0Slindex.htm;Microsoft Corp. 	4069 (Dec. 24
See generally
FTCDkt. No.
2002) (scttling charges relating to the privacy and security of personal information collccted
through company s " Passport" web service), 	available at
http://www. ftc. gov/os/2002/12Iindex. htm.
IS U.S. C, 9 6801 	et seq, 	(1999), 	See generally 	FTC , FINANCIAL PRIVACY: THE
GRAMM-LEACH BLILEY Acr (200S), 	at 	http://ftc. gov/privacy/glbact/index. html.
IS U.S.c. 9 1681 	et seq, 	(as amended 2003), 	See generally 	FTC , CREDIT
REPORTING: THE FAIR CREDIT REpORTING ACT (200S),
http://ftc . gov /pri vacy/pri vacyini tiati ves/ credi t.h tml,
IS U.S. c. 9 6S01 	et seq. 	(1998). 	See generally 	FTC , CHILDREN' S PRIVACY: THE
CHILDREN' S ONLINE PRIVACY PROTECTION ACT (200S),
http://ftc. gov/privacy/privacyinitiatives/childrens. html. The Act requires operators of
commercial web sites to: post a privacy policy on the web site s homepage and link to the policy
on every page where personal information is collected; provide notice about the site
information collcction practices to parents and obtain verifiable parental consent before
collecting personal information from children; give parents a choice as to whether their child'
personal information will be disclosed to third parties; provide parents access to their child'
personal information and the opportunity to delete the child' s personal information and opt- out
of future collection or use of the information; not to condition a child' s participation in a game
contest , or other activity on the child' s disclosing more personal information than is rcasonably
necessary to participate in that activity; and maintain the confidentiality, security, and integrity of
personal information collected from children.
See generally 	FTC , ENFORCING PRIVACY PROMISES (200S),
http://ftc. gov/privacy/privacyinitiatives/promises educ, html;FTC , il THEFT HOME (200S), 	at
http://www. consumer.govlidtheft/; FTC, FTC CONSUMER ALERT, SPYWAR (200S), 	at
http://ftc. gov/bcp/conline/pubs/alerts/spywarealrt. htm,

with information and analysis regarding privacy issues,
In recent years , the FTC' s privacy agenda has included the Commission s " Do Not Call"
Registry, " which provides consumers with a simple , free , and effective means to limit unwanted
telemarketing calls. t1 The Commission has also worked vigorously to combat mass email
spam " both bcfore and after the enactment of the Controlling the Assault of Non- Solicited
Pornography and Marketing Act of 2003 ("CAN- SP AM"), 12 through law cnforcement against
spammers , the education of consumers and businesses , and through continued study of the
problem. 13 In addition , thc Commssion is in the process of completing rulemakings and reports
required by CAN- SPAM. 14 The FTC has pursued a vigorous law enforcement program against
deceptive spam and , to date , has brought 79 cases in which spam was an integral element of the
alleged overall deceptive or unfair practice.
The Commission s recent report to Congress Subject Line Labeling As a Weapon Against
Spam 	noted that Internet Service Providers ("ISPs ) have developed a number of technological
options to sort , deJete , or block unsolicited commercial email. 	The Commission has also
monitorcd the development of filtering technologies that consumers may use in their personal
email accounts to sort, delete , or block unwanted commercial email that may contain age-
inappropriate content , and has cncouraged consumers to consider using such technologics.
Notably, in one of the FTC's congressionally- mandated reports - a June 2004 report
10 See, e, 	Press Release , FTC , FTC Testifies on Data Security and Identity Theft
(June 16 2005), 	available at 	http://ftc. gov/opa/2005/06/datasectest.htm.
11 See generally 	FTC, NATIONAL DO NOT CALL REGISTRY (2005),
http://ftc . gov /bcp/ coni i ne/edcams/ donotcalllindex. htmi.
15 U. 	et seq. (2003),	c. 9 7701
13
See generally 	FTC, SPAM , PRESS ROOM (2005),
http://www.ftc. gov/bcp/conline/edcams/spam/press. htm ,
See generally id.
15 FTC, SUBJECT LINE LABELING AS A WEAPON AGAINST SPAM , A REPORT TO
CONGRESS 10- 12 (2005), 	available at
http://www .ftc, gov/reports/canspam05/050616canspamrpt. pdf. Examples incl ude: customized
filters that block out email messages containing words that occur more frequently in known
spam; " blacklists " of Internet Protocols determined to be an open relay or proxy used by
spammers; and " whitelists " of legitimate marketers that ensure legitimate , non- spam email is not
blocked.
16 E.g. FTC , YOU' VE GOT SPAM: HOW TO " CAN" UNWANTED EMAIL 2 (2002),
available at 	http://www. ftc. gov/bcp/conline/pubs/onlinelinbox. pdf.

, "
entitled 	National Do Not Email Registry, a Report to Congress 	Do Not Email Report )17 - the
Commssion analyzed the issues identified in your September 12 , 2005 letter. In the Report , the
Commssion concluded that spammers would most likely use a registry as a mechanism for
verifying the validity of email addresses and , without the ability to authenticate their identities
enforcement officials would be largely powerless to identify and pursue those responsible for
misusing a registry, Thus , a registry would raisc serious security, privacy, and enforcement
difficulties , especially for children s email accounts. 18 A discussion of the Report s conclusions
is provided below,
II. 	Summary of HB 0572
Ilinois HE 0572" would require the Office of the Ilinois Attorney General to "establish a
Child Protection Registry in which parents may register their children s Contact Points as off
limits from certain categories of commercial messages, . , ."'0 These contact points would
include: electronic mail addresses; instant message identities; postal addresses; telephone
numbers; and any additional points designated by the Ilinois Attorney General " from time to
time and as messaging technology develops.
Under the bill 	(e)xcept as otherwise authorized by the Attorney General in rules
prescribed under this Act , it is unlawful for a person to initiate any commercial message or other
communication to any registered contact point if the message or communication: (1) advertises
products or services that a 	minor 	child is prohibited by 	law 	from purchasing; or (2) contains or
advertises adult content or links to adult content."22
17 	FTC, NATIONAL DO NOT EMAIL REGISTRY , A REpORT TO CONGRESS (June
2004), available at 	http://www.ftc, gov/reports/dneregistry/report.pdf. Specifically, CAN-SPAM
required that the FTC transmit to Congress a report that: "(1) sets forth a plan and timetablc for
establishing a nationwide marketing Do- Not- Email registry; (2) includes an explanation of any
practical , technical , security, privacy, enforceability, or other concerns that the Commission has
regarding such a registry; and (3) includes an explanation of how the registry would be applied
with respect to children with e-mail accounts." 15 U.S. C. 9 7708.
Do Not Email Report 	note 17 ati- ii.	See generally 	supra
19 HE 0572, 2005 Leg. , 2005- 06 Sess, (II. Jan. 27 , 2005), 	available at
http://www .ilga. gov/legislationlfulltext.asp?DocN ame=&Sessionld=50&GA=94&DocTypeld=H
B&DocNum=0572&GAID=8&Legil= 14958&SpecSess=&Session=
Id, 	at 9 5(a).
Id. 	at 9 5(c)-(d).
Id, 	at 9 5(e)(1)- (2).

, "
A person may also be liable where he or she promotes , or allows the promotion of
another s goods , products , or services through a third party where that person: (1) knows or
should have known in the ordinary course of business that they were being promoted in such a
message; (2) received or expected to receive an economic benefit from such promotion; and (3)
took no reasonable action to prevent the transmission or to detect it and report it to the Ilinois
Attorney General.
Neither actual nor implied consent given by a minor creates a defense to liability,24 But a
person does not violate the Act if the contact point in qucstion has been on the registry for less
than thirty days or if a person "reasonably relies " on the registry, as provided by the Attorney
General and " takes reasonable measures to comply with this Act. "25
The llinois Attorney General is required to establish proccdures to pcrmit the reporting
of violations of the Act..' HE 0572 also makes it an Ilinois Class B criminal misdemeanor to
violate the Act. Each separate message in violation of the Act constitutes a separate violation.
Each unauthorized use of the Registry constitutes a Class A misdemeanor , for which a fine of not
more than $500 000 may be imposed." In addition 	(p)arents may recover actual damages , on
behalf of their children " for messages sent to a contact point in violation of the Act.29 In lieu of
actual damages, a parent may recover $1 000 per violation.
II. 	Effect of' HB 0572 on Registered Children
HB 0572 May Provide Pedophiles and Other Dangerous Persons With a
List of Contact Points of Ilinois Children
The registry proposed by HE 0572 would create an extensivc directory of childrens
contact points that currently does not exist. As explained below , such a list cannot be effectively
Id. 	at 9 5(f)(1)- (3).
Id. 	at 9 5(g).
Id. 	at 9 10.
Id. 	at 9 15(a).
Id. 	at 9 15(b).
Id.
Id. 	at 9 15(c).
Id.

, "
monitored for abuse.Jt By compiling such a list that cannot be effectively monitored for abuse
HE 0572 may provide pedophiles and other dangerous persons with a potential list of contact
points of Ilinois children. As the Do Not Email Report concluded 	(tJhe possibility that such a
list 	could fall into the hands of the Internet's most dangerous users , including pedophiles , is truly
chilling. "32
Although difficult to quantify, the risk of a pedophile or other dangerous pcrsons
misusing the registry data to discover the contact point of an Ilinois minor is certainly real. First
such a list 	could 	be misused by registry personnel." Second , such a list is subject to direct
hacking by technologically sophisticated persons. Third, the Ilinois Attorney General's office is
unlikely to be able to screen every single individual who might seek , or to whom it might
provide, registry access, For example, it is unlikely that the state would be able to perform
background chccks on every employee of all marketing firms that may potentially misuse their
acccss to such a registry. In sum , a central registry of children s contact points may provide
pedophiles and other dangerous persons with a means of contacting those children.
Email Addresses on the Proposed Registry are Unlikely to Receive Less
Spam and May Actually Receive More Spam , Including Adult Content
A Registry Could Provide Spammers With a List of Valid Children s Email
Addresses For Spam Marketing
31 Recently, two states have established similar children s registries , the " Michigan
Children s Protection Registry Act " MICH. COMPo LAWS 9 752. 1061 	(2004) and the	et seq.
Utah Child Protection Registry Act " H.R. 165 2004 General Session (2004), The Commission
will continue to monitor these registries with regard to their effect on children s privacy.
Do Not Email Report supra 	note 17 , at 33- 34,
As a computer sccurity expert retained by the FTC explained:
In the Computer Security 	field it is well known that insider attacks account for
the most loss in terms of proprietar data. While we have well- developed
techniques for thwaring external attackers , for example , firewalls , intrusion
detection systems , and virtual private networks , the state of the art at protecting
against malicious insiders is currently dismal. Proprietar algorithms , code , and
designs leak all the time. Industral espionage is rampant , and theft of data by
people with legitimate access is the most common form of loss known to today
corporations. This is why the hashed list of email addresses , which is such a
valuable target , is almost certain to be compromised at some point if a Do Not
Email registry is deployed. The 	technology 	does not exist to protect it against
insiders,
A VlEL D. RUBIN , A REpORT TO THE FTC ON RESPONSES TO THEIR REQUEST FOR
INFORMATION ON ESTABLISHING A NATIONAL DO NOT E-MAIL REGISTRY 11 (May 2004),
available at 	http://www . ftc. gov /reports/ dneregis try/expertrpts/rubin. pdf.

As mentioned above , HE 0572 would create an extensivc directory of active children
email addresses. As technology stands today, it is	impossible 	to know whether any particular
stated email address is actively used by an actual user , until it is tested to verify that it is valid.
A registry of email addresses , such as the one proposed by HE 0572 	eliminate that	would
technological hurdle , one of the few remaining barers that can slow spammers down.
Spammers 	would 	have significant incentives to attempt to obtain a copy of such a registry
or portions thereof for two main reasons, First, spam marketcrs of products and scrvices used by
children (e. 	, CDs , ringtones , clothing, video games) could use such a list to focus their spam
marketing campaigns, According to a 2003 study conducted by Symantec Corp" 76 percent of
children who use thc Internet have one or more email accounts.35 Such email accounts are
attractive contact points for spam marketers , and marketers of products used by children would
likely be willing to pay a premium to obtain a list of children s email addresses. Second , even
spam marketers that do not specifically target children would find such a list valuable simply
because the email addresses on it would have been verified as being valid and could , therefore
help a spammer to evade an anti-spam filter put in place by an Internet Service Provider
ISP"
Disturbingly, 47 percent of the children surveyed in the Symmantec study reported
receiving spam with links to pornographic websites.37 The Commission has found no data to
suggcst that spammers are currently targeting childrcn to receive specific types of spam
Do Not 	Email 	Report supra 	note 17 , at 1- 12.
35 The study, conducted by Symantec Corp. in June 2003 , surveyed 1 000 children
between the ages of seven and eighteen. 	See 	Press Release , Symantec , Symantec Survey Reveals
More Than 80 Percent of Children Using Email Receive Inappropriate Spam Daily ("Symantec
Survey ) (June 9, 2003), 	http://www. symantec. com/press/2003/n030609a.html. The	available at
findings of the study are discussed in the Do Not Emaij Report 	note17 , at 33- 34.	supra
36 As spammers send more messages , they necessarily increase the number of
undeliverable messages coming from their Internet Protocol ("IP") addresses. ISPs , however
filter out all messages from an IP address from which a high number of undeliverable messages
are sent. This filtering increases the probability that 	all 	of a spammer s messages from that IP
address will not be delivered , including those messages that would have been delivered but for
the undeliverable messages that were sent with them. By including in a marketing campaign a
large number of known valid email addresses with email addresses of unknown validity, the
sparer increases the odds that the ISP wil deliver messages to the addresses of unknown
validity. Do Not Email Report 	note 17 , at 18- 	93.	supra
37 note 17. Notably, over 20 percent of children with email	Symantec Survey, 	supra
accounts open and read spam messages. 	Id. 	Even when children feel uncomfortable, offended
or curious after seeing inappropriate spam, 38 percent of them do not tell their parents. 	Id.

however.38 Rather, spammers appear to use indiscriminate marketing techniques , and , therefore
children generally receive the same types of spam that adults receive." This fact is not surprising
because spammers and others currently have no way of knowing that particular email addresses
belong to children 	the children have divulged their ages and email addresses , or otherwise	unless
indicated their minor status by signing up with an HE 0572- type registry. Thus , because such a
registry cannot be effectively monitored for abuse , it may have the unintended consequence of
may	providing spammers with a mechanism for verifying the validity of email addresses, This
actually increase the amount of spam sent to registered children s addresses in general , including
spam containing adult content. To the extent that the registry may be misused to verify the
validity of email addresses, such verified email addresses could then bc 	re-sold 	to spam
marketers in general , including spam marketers of adult content.
Existing Computer Security Techniques are Inadequate to Prevent the Abuse
of Such a List
In its Do Not Email Report to Congress, the Commission analyzed three computer
significantly reduce the security
and privacy risks associated with a registry of individual email addresses: (1) the centralized
scrubbing of marketers ' distribution lists; (2) the conversion of addresses to one- way hashes; and
security techniques that registry proponents had claimed 	could
(3) the seeding of the registry with " canar" email addresses. As explained below , although cach
of these three techniques may reduce certain types of computer security threats , none of them can
completely prevent the misuse of registry data.
Centralized Scrubbing Would Not Prevent Registry Misuse
Rather than distributing to email marketers copies of a registry that could then fall into
the hands of pedophiles or other dangerous persons , some have proposed that a registry could
instead require email marketers to submit their distribution lists to the registry to be scrubbed of
38 When Commission investigators " seeded" 175 different locations on the Internet
with 250 undercover email addresses , they found that the content of the resulting spam was
unrelated to the location on the Internet from which the address was harvested. Consumer Alert
FTC , Email Address Harvesting: How Spammers Reap What You Sow (Nov. 2002), 	available
at 	See also	http://www.ftc. gov/bcp/conline/pubs/alerts/spamalrt. htm. 	Do Not Email Report
supra 	note 17 , at 34 , n. 187.
39 According to one ISP , about thirty percent of all spam delivered to its subscribers
inboxes in January and February 2004 contained sexually explicit material or references. Do Not
Email Report supra 	note 17 , at 	, n. 174. The Commission found that 17 percent of
pornographic offers in the spam it analyzed contained "adult imagery. " FTC , FALSE CLAIMS IN
SPAM , A REPORT BY THE FTC' s DIVISION OF MARKETING PRACTICES 13 (Apr. 30 , 2003),
available at 	http://www .ftc, govlreports/spam/030429spamreport, pdf.

registered contact points. 40 The state could then return a list purged of registercd email addresses.
But such centralized scrubbing would not prevent spammers from using the registry to obtain
valid email addresses. Although 	central 	scrubbing by the registry might prevent spammers from
obtaining a full copy of the registry, spammers would simply have to compare their pre-scrubbed
and post-scrubbed lists for differences between them , and identify email addresses removed by
the scrubbing. Thus , list scrubbing has a fatal flaw that, ironically, 	allow spammers to	could
verify addresses on their mailing lists. By repeatedly submitting lists of email addresses to a
registry for scrubbing, spammers could potentially reconstruct a substantial portion of the
registry,
Although Illinois could attempt to track the identities of marketers submitting their lists
for scrubbing, in many cases the state would have no practical means of knowing whether
persons making such submissions were misusing the registry data. Generally, a law-abiding
marketer who purchased an emaillist and then submitted it to the registry for scrubbing would be
indistinguishable from a malicious spammer who purchased the same list and thcn submitted it in
order to validate addresses for future spamming, If a marketer who misused the registry for
spamming purposes included its identity in the resulting violative spam the state could of course
discipline such a marketer. This type of scenario is unlikely in the current context of
technologically sophisticated and elusive spammers. Similarly, the state 	would 	generally have no
practical way of preventing or detecting such a spammer from selling a validated emaillist to
other spammers.
One-Way Hashing 	Would 	Not Prevent Registry Misuse
One-way hashing involves using cryptographic algorithms to transform a string of text
into character strings called " hashes, " In a hashed registry, a consumer could enter an email
address on the registry using a web-based form. The state would then send a confirmation email
to the consumer s email address, To activate the registration, the consumer would return to the
registry s web site and enter a code appcaring in the confirmation email. Upon activation of the
registration , the state would convert the email address to a one-way hash using a publicly- known
hashing algorithm. The entire registry would be stored as one-way hashes.
A marketer authorizcd to use an email registry would convert registered email addresses
on its distribution list into hashes using the same hashing algorithm used by the registry. The
marketer would also create a database identifying each original email address and its associated
40 See, e. 	Email 	Report 	note 17 at19 	(noting that when the	Do Not 	supra
Commission solicited input for the Do Not Email Report , it received ten Request for Information
("RFI" ) responses proposing registries that use a centralized scrubbing mechanism ).
Id. 	at 19-20.
42 For example , a consumer might register an email address , such as abc(Qftc. gov.
Then , using a securing hashing algorithm standard , the registry would convert the address into a
hashed form , such as 55 1ge3f2ba5aef2dead64f72cf3I 507e88d6eb23 , and add it to the registry.

hash. The marketer would then submit its hashed distribution list to the state for scrubbing. The
registry would compare the marketer s hashed distribution list to the hashed registry and return to
the marketer a hashed distribution list purged of those hashes appearing on the registry. A
legitimate marketer would then send messages only to those addresses that corresponded to
hashes on the list returned by the state. An illegitimate spammer , however 	determine	could
which of the addresses on its original distribution list were on the registry (and , therefore , are
valid addresses) by comparing the hashed list submitted to the statc with the scrubbed list of
hashes returned by the state and determining the email addresses that corresponded to the purged
hashes,
It is virtually impossible using current computing and software 	technology 	to determine
an original un- hashed text by analyzing the resulting hash. Thus , if someone obtained the
registry of hashed email addresses, it is unlikcly that the databasc could be un- hashed and turned
back into a list of readable emaiJ addresses. Hashing may protect a registry from outside hackers
by maintaining data in an encrypted form. But , although a hashed registry would provide some
measure of security against a hacker , it would not protect against the likely threat of a spammer
using the registry as a tool for validating emaiJ addresses." In sum, whether un-hashed or
hashed , centrally-scrubbed or distributed , the legitimate bulk emailer needs to know which
addresses on its distribution list are on the registry. The inevitable corollary is that the
ilegitimate spammer can use the registry to deduce valid email addresses through comparison.
Seeding the Registry Would Not Prevent Misuse
The Do Not 	Email 	Report also analyzed the utility of seeding a registry with secret
registry-controlled addresses designed to detect spammers ("canar addresses 	" To ensure that
43 A spammer with little technical sophistication could easily convert milions of
emaiJ addresses to hashes in seconds using a standard desktop computer. Do Not Email Report
supra 	note 17 , at 21- 	, n. 105.
As a computer security expert retained by the Commission explained:
Cryptographic hashing can be thought of as a method for " anonymizing " an
address, . . that helps to protect the original list from becoming a source of new
addresses for spammers. However , due to the mathematical properties of
crytographic hashes , it is still possible for a person who knows an email address
to tell whether that address is on the anonymized list. So a system based on
crytographic hashes is roughly equivalent. . . to one that allows emailers to
query a centralized database to check whether particular addresses are on the list.
Id. 	at 22. Another computer security expert retained by the Commssion explained that "hashing
provides absolutely no security against a marketer who obtains a scrubbed 	list 	and uses (it) to sell
the addresses that were scrubbed by the Registry. 	at n. 106.	Id.
Id. 	at 22-23,

, " 	, "
emails received by canar addresses would be true indicators of registry misuse , each canary
address would have to be 	extremely 	unlikely to receive spam , absent a registry violation. In other
words , the canar addresses could not already be circulating on emaillists on the Internet and
would need to include characters unlikely to be generated by a computerized dictionary attack
program." For instance , using a random character generation program, the Commssion 	could
establish the email address " 25ceI2a4(gfederaltcommiss. com. 	The address would be monitored
constantly. Any email sent to the canary address 	would 	indicate a misuse of the registry.
Seeding a registr with canary addresses may aid the detection of the outright hacking of
an un-hashed registry, if such an address obtained through hacking then receives spam. But it is
prevent spammers from misusing a registry through the submit- and
compare technique. A canary address would not be circulating on a spammer s pre-scrub email
lists outside the registr, absent a direct hack , and would include character strings unlikely to bc
created by a dictionary attack program. Therefore , with a hashed registry, a canar address
would never receive a spam message, preventing the dctcction of a 	of thc registry.
unlikely that seeding 	could
misuse
Moreover, although the receipt of email by a canary address may make it possible to
not prevent such abuse, as such detection 	would	dctect the misuse of a registry it 	could
necessarily occur 	only 	after the registry had already been compromised. Detection would likely
headers , opcn relays , open proxies , and
zombie drones by sophisticated spammers would make it exceedingly difficult or impossible to
be too little help too late. The widespread use of 	false
trace a message from the seeded address back to its source.'8 The 	result 	would be the same cven
if a centralized registr were to distribute un- hashcd copics of the rcgistry, including canary
addresses , to marketers,
Senders of Offensive Spam Wil Be Diffcult to Locate and Prosecute
The FTC's experience in its spar cases shows that the primary law enforcement
challenge is identifying and locating the targeted spammer. As the Do Not Email Report
explains , the ability of spammers to hide their identities by using false headers, open relays , open
proxies , zombie drones , and foreign servers makes tracing an email's path " an often fruitless
46 If the registry were seeded with FTC-controlled email addresses that were likely to
be targeted by dictionar attack programs (e. 	john(gftc. gov ), the receipt of-a message at this
address would not necessarly indicate that the Registry had been misused to search for valid
addresses. A spammer with a dictionary attack program may have sent the message. 	Id. 	at 22
l1O.
47
Id. 	at 22- 	, n, 112. As one computer security expert concluded 	canaries are
useless when dealing with a hashed registry. " Do Not Email Report supra 	note 17 , at 22
lI!.
Id. 	at 8- 13 (explaining these techniques).

, "
task. "" Thus 	(t)racing an email almost always leads to a dead end because spammers rarely
send messages from their own email accounts. ISPs which , like the Commssion , have
considerable experience dealing with spam , have been similarly stymied by spammers ' use of
zombie drones and other camouflage tactics. "50
Unable to identify a spammer based on the email trail , law enforcement and ISPs must
locate spammers by tracing the flow of funds from victim to spammer. The experiences of Jaw
enforcement and ISPs belie claims that spammers can be caught easily. First , numerous spam
messages , such as those that are purely malicious 	vehicles 	for viruses and Trojans , do not
typically request money. Second , spammers that request funds often use novel payment methods
offshore banks 	credit card accounts , and other techniques that make tracing the flow of	stolen
moncy a painstaking, and often futile, endeavor.
IV. 	Impact on Consumers and Competition
In addition to the risks to children discussed above , HE 0572 would also likely have
significant consequences for email marketers throughout the United States, not just those that
conduct business in Illinois. Because an 	email 	address does not indicate the geographic
residence of its user, a marketer cannot easily separate out residents of certain 	locations 	from a
marketing list. Any sender of email marketing goods , products , or services covered by HE 0572
would , as a practical matter , therefore , need to scrub each registered address from its list in order
to ensure that it did not violate the registry and subject itself to substantial criminal and civil
pen alti es.
For example, in a centrally-scrubbed registry, before sending any customers an email
newsletter featuring a new crime novel , a bookseller would need to submit its entire emaillist to
the registry for scrubbing because Illinois minors are prohibited from purchasing " any book
pamphlet, magazine , newspaper, story paper or other printed paper devoted to the publication , or
principally made up of criminal news , police reports , or accounts of criminaJ deeds , or pictures
and stories of deeds of bloodshed, lust or crime. "51 Similarly, a winery would need to scrub its
entire emaillist before embarking on an email marketing campaign to promote its wines to avoid
inadvertently violating HE 0572 by sending a message to a registered email address. Under HE
0572 , such marketers would need to conduct such scrubbing every 30 days.
The cost of such scrubbing and monitoring can be substantial for legitimate marketers
who are generally unlikely to use email to target minors for products they are prohibited from
at 23- 26, 	at 8- 12.	Id. 	See also id.
Id. 	at 23-26.
720 ILL. COMPo STAT. 670/1 (1889).
Do Not Email Report supra 	note 17 , at 	, n. 165.

).
purchasing.53 Marketers of certain types of products, such as sexually explicit content , are
already subject to substantial legal penalties if they do not comply with laws that protect minors
(and adults who do not wish to view such content). " Spammers are unlikely to honor any such
registry of prohibited contacts and may, in fact , misuse such a list to spam the children on it. The
costs of complying with HE 0572 , in addition to the potential for substantial criminal and civil
liability for individual violations , may cause some legitimate markcters to consider ending mass
email campaigns 	altogether.55 The aggregate effect of HB 0572 might be to close off the
legitimate email marketing of those products and services that it would cover , throughout the
United States , not just for Ilinois residents , and for all consumers , not just minors. Thus , HE
53 See BEER INSTITUTE , ADVERTISING AN MARKETING CODE 1 (2005),	, e.
available at 	http://www. beerinstitutc. org/adcode. htm (stating that brewers should not market to
underage persons , and that " (t)hese guidelines apply to all brcwer marketing materials , including
Internet and other cyberspace media. ); DISTILLED SPIRITS COUNCIL OF THE UNITED STATES
CODE OF RESPONSIBLE PRACTICES FOR BEVERAGE ALCOHOL ADVERTISING AND MARKETING
http://www. discus. org/industry/code/code.htm (stating that alcoholic	(2005), available at
beverages 	should 	not be marketed to underage persons , and that " (t)he provisions of the Code
apply to every type of print and electronic mcdia , including the Internet and any other on- line
communications used to advertise or market beverage alcohol."); and FREE THE GRAPES! , WINE
available at
http://www.freethegrapes. org/wineries,html#code (specifying that wineries may direct ship wine
to adults only in states where it is legal to do so; must request the birth date of the purchaser to
verify he/she is over 21 years of age before completing any transaction; and must conspicuously
label shipmcnts with a minimum notification "signature of person age 21 or 	required for
INDUSTRY CODE FOR DIRECT SHIPPING (2005),
older
delivery 	FTC , CIGARTTE REpORT FOR 2003 8-9 (2005), 	available at	See also
http://www. ftc, gov/reports/cigarette05/050809cigrpt.pdf (noting that in 2003 , besides creating a
company website , cigarette "companies reported no expenditures on any other Internet
advertising 	(e. 	banner ads on third party sites and direct mail advertising using - email).
54 For example , under the FTC' s recent " Label for E- mail Messages Containing
Sexually Oriented Material" Final Rule , adopted pursuant to the CAN-SPAM Act, commercial
email messages containing sexually oriented materials must " ( e )xclude sexually oriented
materials from the subject heading for the electronic 	mail 	message and include in the subject
heading the phrase ' SEXUALLY- EXPLICIT: ' in capital letters " and include the electronic
equivalent of a " brown paper wrapper " in the body of the message. 16 C, F.R. 9 316.4. Thus , the
Rule protects minors (and 	adults 	who do not wish to inadvertently view sexually explicit content)
by requiring that the sender prevent recipients from viewing such material without a recipient's
affirmative decision to do so. Courts can award up to $11 000 in penalties per violation of the
CAN- SPAM Act , including a violation of the Rule. 15 U.S.c. 9 7706(a); 15 U.S. C. 9 7(a)(I)(B);
15 U. 	c. 9 45(m)(1)(A), as modified by 28 U. 	C. 9 2461 , as amended and implemented by 16
F.R. 9 1.98(d).
55 Jon Swartz Anti-Porn Spam Laws to Shield Kids Backfire USA	Id. See also
TODAY , Aug. 21 , 2005 at Bl available at
http://www. usatoday.com/tech/new s/ computersec uri ty/2005 -08- 2l-email-children 	htm.

, "
0572 would likely have a greater effect on sellers that rely on emai) contact points in lieu of a
physical presence in order to conduct business , such as a stand-alone Internet company. As noted
in the FTC staff report Possible Anticompetitive Barriers to E- Commerce: Wine Internet
merchants often provide consumers with lower prices , more choices , and better quality products
and services. " The extra burden that HE 0572 	would 	place on Internet sellers may, therefore
hamper a particularly competitive segment of merchants in those industries covered by HE 0572
curtailing the benefits of such competition to consumers.
Conclusion
Ilinois HE 0572 appears to be designed to protect children from unwanted commercial
messages that advertise products or services they are prohibitcd from purchasing or contain adult
advertising or links to adult content. By compiling a list of 	children 	contact points that cannot
be effectively monitorcd for abuse , however , HE 0572 may provide pedophiles and other
dangerous pcrsons with a list of contact points for Ilinois children and may actually increasc the
amount of spam sent to those addresses , ineluding adult content. The extra burden that HE 0572
would place on legitimate Internet sellers may 	also 	hamper a particularly competitive segment of
56 See 	FTC STAF , POSSIBLE ANTICOMPETITIVE BARIERS TO E- COMMERCE:
WINE 1 (July 2003), 	available at 	http://www.ftc. gov/osI2003/07/winereport2. pdf.ld. atl . 3 , 14
26. For example 	(t)he staff. . . coneludcs that onlinc winc sales give consumers the
opportunity to save money and to choose from a much greater variety of wines, 	See	Id. 	at 14.
also 	FTC STAF , POSSIBLE ANTICOMPETITIVE BARIERS TO E- COMMERCE: CONTACT LENSES
(Mar. 2004), 	available at 	http://www.ftc. gov/os/2004/03/040329clreportfinal.pdf.
57 For example , it is likcly that some consumers would no longer receive
information that they value and , in some cases, that they have specifically requested , such as a
monthly email newsletteradvertisingcurrentpricesforcoveredgoodsorserviccs. This is not to
suggest , however , that the FTC is unconcerned about the marketing of age- inappropriate products
and materials to minors, such as entertainment having violent content. 	See 	FTC , MARKETING
VIOLENT ENTERTAINMENT TO CHILDREN: A REVJEW OF SELF-REGULATION AN INDUSTRY
PRACTICES IN THE MOTION PICTURE , MUSIC RECORDING & ELECTRONIC GAM INDUSTRIES
(2000), available at 	http://www. ftc. gov/reports/violence/vioreport. pdf (recommending that the
motion picture , music recording, and electronic game industries continue to improve compliance
with existing ad placement guidelines and rating information practices , avoid advertising venues
with under- 17 audiences , and enhance efforts to prevent minors from purchasing age-
inappropriate content). The Commission also has a toll- free consumer complaint line and
Internet complaint form available for consumer complaints about the marketing of media
violence to childrcn. FTC, FTC ACCEPTING COMPLAINTS ABOUT VIOLENT ENTERTAINMENT
MARKETED TO KIDS (2004), 	available at
http://www. ftc. gov/bcp/conline/pubs/alerts/mediavioalrt.htm In addition , as noted above , the
FTC has 	also 	urged consumers to consider using filtering technologies in their personal email
accounts that allow users to sort , delete , or block unwanted commercial email that may contain
age-inappropriate content. 	See supra 	note 16.

II
merchants in those industries covered by HE 0572 , curtail the benefits of such competition to
consumers , and cause consumers to no longer receive information that they value.
Sincerely,
0,Maureen K. Ohlhausen , Director
Christopher M, Grengs , Attorney Advisor
Office of Policy Planning
Lydia B, Parnes , Director
Daniel R. Salsburg, Attorney
Bureau 	of Consumcr Protcction
Michael A. Salinger , Director
Louis Silversin , Economist
Bureau of Economics