This case has particular interest for attorneys with a virtual worlds ... Emile Loza is Managing Attorney and Founder of ... Committee and the new Committee on Gaming and .... number and constituted injury to MySpace's goodwill. .... with permission from Aspen Publishers, Inc., a Wolters Kluwer business, New York, NY,.
Computer & Internet Lawyer
The
Volume 25
▲
Number 6
▲
Ronald L. Johnston, Arnold & Porter, LLP Editor-in-Chief*
JUNE 2008
MySpace v.Wallace: The CAN-SPAM Act Applied Within the MySpace Community By Emile Loza
I
n MySpace, Inc. v. Wallace,1 MySpace, the purveyor of the popular social networking Web site myspace.com, sued the operator of the freevegasclubs. com and real-vegassins.com Web sites under the federal CAN-SPAM Act2 and under California state law.3 MySpace alleged that Wallace set up some 11,000 fictitious MySpace accounts through “bots,” or automated software means, and then used those accounts to send numerous unsolicited email messages, or spam, regarding its gambling Emile Loza is Managing Attorney and Founder of Technology Law Group, LLC, in Boise, ID. Ms. Loza’s strategic practice centers on international transactions and Internet and intellectual property law. She is past two-term chair of the Intellectual Property Law Section of the Idaho State Bar and an active member of the American Bar Association’s International and Intellectual Property Law Sections, including the China Committee and the new Committee on Gaming and Virtual Worlds. Ms. Loza holds a law degree from The George Washington University Law School, a master’s degree in business administration, and an undergraduate degree in science and technology. Please contact Ms. Loza at 208.939.4472.
sites to legitimate MySpace account holders. This spam allegedly circumvented the terms of use governing behavior on myspace.com. MySpace sought and prevailed, in part, in obtaining a preliminary injunction against Wallace. Under 15 U.S.C. § 7704(b)(2), however, MySpace did not prevail because the court held that MySpace was not likely to succeed on the merits of its bot-related claim because it had failed to provide adequate evidence demonstrating that Wallace’s set-up of the subject accounts could have been achieved only by bots. This case has particular interest for attorneys with a virtual worlds practice in that it elucidates several crucial definitions under the CANSPAM Act and applies the CAN-SPAM Act to messages sent entirely with the MySpace domain and not between domains and to messages carried out by means of pretexting and the hijacked accounts of innocent MySpace members. In addition, this case is instrumental on several points of evidentiary sufficiency under the legal standard applicable to motions to preliminary injunction orders. Further, it outlines the proper scope of a narrowly tailored injunction order in addressing conduct in the virtual world. Finally,
Law & Business
CAN-SPAM Act the facts suggest that alternative or additional avenues are available to prosecute such wrongful online conduct on consumer protection or intellectual property grounds or both.
Statement of Facts Wallace sent messages to MySpace members to promote his Web sites freevegasclubs.com and real-vegassins. com. Wallace’s Internet business generates revenues of some US$1 million each year. These messages allegedly directed legitimate MySpace members to log in on a counterfeit Web site modeled on the MySpace log-in page. Account holders then did so, enabling Wallace to allegedly harvest their user identification and password log-in information. With this information, Wallace allegedly sent out almost 400,000 promotional messages to other MySpace account holders with those messages appearing to originate from the MySpace account holders whose log-in information was stolen. In addition, he allegedly posted some 890,000 related comments to the MySpace pages of other account holders. As became key, however, to its allegation under § 7704(b)(2), MySpace did not establish the dates and times on which the subject MySpace accounts were created or the corresponding America Online (AOL) email accounts were created. These AOL accounts were used as part of MySpace’s verification process in the establishment of new MySpace accounts.
Summary of Legal Issues The principle legal issue before the court was whether to grant MySpace’s motion for preliminary injunction.4 To prevail on its motion, MySpace had to satisfy either one of two alternatives. To prevail, the movant must show a likelihood of success on the merits and the possibility of irreparable harm, or it must show that serious questions going to the merits were raised and the balance of hardships tips sharply in its favor.5 The 2003 CAN-SPAM Act regulates the transmission of commercial email and prohibits certain conduct.6 Relevantly here, it prohibits the use of false, misleading, deceptive information; prohibits the use of “bots” to create multiple email accounts; and requires certain contact information to be contained in commercial email messages.7 Electronic Mail Messages under the CAN-SPAM Act MySpace’s private right of action hinged upon whether Wallace’s messages met the statutory definition of “commercial electronic mail message” under the CAN-SPAM Act. The court held that they did.8 2 • The Computer & Internet Lawyer
The CAN-SPAM Act defines a commercial email message as “a message sent to a unique electronic mail address.”9 A “unique electronic mail address” is defined as: a destination, commonly expressed as a string of characters, consisting of a unique use (commonly referred to as the ‘local part’) and a reference to an Internet domain (commonly referred to as the ‘domain part’), whether or not displayed, to which an electronic mail message can be sent or delivered.10 Finally, the CAN-SPAM Act defines “domain name” as “any alphanumeric designation which is registered with or assigned by any domain name registrar, domain name registry, or other domain name registration authority as part of an electronic address on the Internet.”11 Wallace argued that his messages were not “electronic mail messages” under the CAN-SPAM Act because the addresses to which those messages were sent had no domain name and had no route, remaining instead entirely within the MySpace system. The court rejected Wallace’s argument, holding that the MySpace addresses to which Wallace sent messages were “destinations,” a word that the CAN-SPAM Act exemplified in a commonly occurring but not exclusive form: an email address consisting of a local part followed by a domain part. The court explained that such an interpretation was proper because Congress presumably had knowledge of other forms of electronic communications, such as instant messaging, when it passed the Act in 2003 and because this interpretation was in keeping with the CAN-SPAM Act’s stated purpose to curtail the rapid and detrimental increase in commercial email that overburdened email systems.12 Likelihood of Prevailing on the Merits Having concluded that the CAN-SPAM Act applied to Wallace’s message, the court considered the likelihood that MySpace would prevail on the merits. The court held that MySpace would likely prevail under three of four asserted provisions of the CAN-SPAM Act: under § 7704(a)(1), regarding the use of false or misleading header information; under § 7704(a)(3), regarding a pattern or practice of sending commercial email without a functional return email address by which to, within at least forty (40) days of the message, request that no more messages be sent; and under § 7704(a)(5), regarding the clear and conspicuous identification of the message as an advertisement or solicitation.13 Note that the CANSPAM Act does not define “pattern or practice,” and the court illuminated the meaning of this element by reference to other circuit court cases.14 Volume 25 • Number 6 • June 2008
CAN-SPAM Act The court held, however, that MySpace was not likely to prevail on the merits of its claim under § 7704(b)(2), or the bot clause, which prohibits the use of scripts or other automated means to register for multiple electronic mail accounts or online user accounts.15 In its treatment of false or misleading email header information, § 7704(a)(1) includes a prohibition on technically correct information that includes an originating electronic mail address, domain name, or Internet protocol (IP) address to which access for the purpose of initiating the challenged message was obtained by false or fraudulent pretenses or representations. Unlike with other sections of the CAN-SPAM Act, MySpace did not need to demonstrate Wallace’s pattern or practice of conduct under this section.16 MySpace asserted that Wallace had obtained some 342,000 MySpace.com members’ user names and passwords through his Web sites that had been designed to resemble the MySpace log-in Web page.Those members were directed to these copycat sites by messages sent by Wallace. After harvesting their log-in information, Wallace hijacked those MySpace members’ accounts to send out some 400,000 messages, conduct clearly prohibited by the CAN-SPAM Act.17 MySpace claimed that Wallace similarly violated § 7704(a)(3) in that recipients replying to Wallace’s messages sent through other MySpace members’ accounts would be directed to the unwitting members whose accounts were used to send the message and not to Wallace, the message sender. MySpace presented evidence that the Wallace-hijacked member accounts were used to send violative messages on at least three occasions, including once after it filed its motion for preliminary injunction in this case.18 The post-filing occasion involved a group of 110,000 messages sent from 76,200 MySpace member accounts within a 48-hour period.19 MySpace alleged that Wallace’s 400,000 messages sent via hijacked member accounts were not identified as advertisements and lacked other information and that this demonstrated a pattern of or practice of violative conduct as required by § 7704(a)(5). Wallace countered that the messages were not commercial, but rather invitations to view pictures, electronic cards, or other non-commercial material through a “Tell-a-Friend” service. He also argued that the messages did contain the required return email address, those being MySpace return addresses.20 Section 7702(2)(a) defines “commercial electronic mail message” as any email message, irrespective of its appearance, for which the primary purpose is the commercial advertisement or promotion of a commercial product or service, including content on a Web site operated for a commercial purpose.21 Volume 25 • Number 6 • June 2008
Under this definition, the court determined that MySpace was likely to prevail on the merits because the messages did not contain the required clear and conspicuous identifications of advertisement or solicitation and other required components under § 7704(a)(5).22 Further, even though the messages contained return addresses, those addresses were wholly ineffectual for the purposes of opting out, given that Wallace, the commercial solicitor, would never receive those opt-out replies.23 Having demonstrated its likelihood of succeeding on the merits on these three claims under the CAN-SPAM Act, MySpace fell short on its bot clause claim under § 7704(b)(2). There, it put on evidence of the creation of the 11,000 MySpace profiles, 2,000 of which share the same name and all of which were registered using similar AOL email addresses. Despite these large numbers of profile creations, the court held that this fact did not compel the conclusion that Wallace had used an automated bot to set up the profiles.24 MySpace did not put on any evidence as to the timeframe in which the profiles were created or as to how a bot could circumvent its set-up procedure’s verification step, a step designed to prevent automated registration.25 The court acknowledged that it may not have been appropriate for MySpace to disclose its verification step in open court. It did analyze MySpace’s profile set-up procedure and the estimated time required to carry it out; the court estimated that a single person without the aid of a bot could create the subject profiles within 23 eight-hour days. Even though the court viewed this as unlikely, it held that MySpace could not demonstrate its likelihood of prevailing merely by an inference that Wallace had used a bot because he set up 11,000 member accounts over an unspecified period of time.26 Possibility of Irreparable Harm As to this second prong of the applicable standard, MySpace claimed that it had suffered irreparable harm by the clogging of its network by Wallace’s messages, resulting in the usurpation of bandwidth and degradation of its members’ MySpace experience and in delivery-related costs, those are, the costs of its attempts to thwart Wallace’s activities. MySpace also said that the 800 member complaints lodged in response to Wallace’s activities demonstrated that its reputation and goodwill had suffered. MySpace also incurred substantial costs in detecting, investigating, and remedying Wallace’s conduct, including its removal of 290,000 unauthorized hyperlinks and more than 890,000 comments posted throughout the MySpace network.27 The court agreed that MySpace had satisfied the irreparable harm requirement, given the inability to The Computer & Internet Lawyer • 3
CAN-SPAM Act quantify reputational harm. Further, the court held that the occurrence of 800 complaints was a substantial number and constituted injury to MySpace’s goodwill. The court was not disturbed by the numeric discrepancy between 800 complaints in response to 400,000 messages, noting that members could not be expected to complain about each spam message they received because they would spend as much time doing so as they would responding to legitimate email. Furthermore, the court stated that, because Wallace’s messages misled members as to his affiliation with MySpace, this conduct impacted the quality of the members’ experiences with MySpace services and that impact was also irreparable harm. Thus, MySpace succeeded on the irreparable harm element of its motion for preliminary injunction.28 Balance of Hardships and Public Interest MySpace won decisively in demonstrating that the balance of hardships tipped sharply in its favor and that the public interest was served in enjoining Wallace’s illegal conduct.29 Under its hardship analysis, the court reiterated the evidence of complaints regarding Wallace’s conduct to MySpace and his continuation of the challenged conduct after MySpace’s filing of the instant motion. MySpace also asserted that, absent an injunction, it would be difficult to technically curb Wallace’s conduct, for example, by blocking his IP addresses, without also curbing that of legitimate users. Even if MySpace were able to block Wallace’s IP addresses, the court noted Wallace’s conduct in another case, Compuserve v. Cyber Promotions, Inc.,30 in which he modified his equipment and messages to circumvent similar blocking software.31 Having delineated the hardships for MySpace, the court held that Wallace would experience no hardship from being enjoined from committing further violations of the CAN-SPAM Act.32 On the public interest prong, the court stated that Wallace’s conduct fell squarely within that which Congress found to be detrimental when it enacted the CAN-SPAM Act.33
Holding The court granted MySpace’s motion for a preliminary injunction in part because MySpace succeeded in satisfying the applicable legal standard on all points with the one exception of the likelihood of its success on the bots claim under § 7704(b)(2).34 The court agreed that the scope of injunction sought by MySpace was overbroad on First Amendment grounds.35 The court narrowed that scope, set MySpace’s bond at $50,000, well below its requested $1 million, and enjoined Wallace from: 4 • The Computer & Internet Lawyer
1. Accessing or using the MySpace.com Web site, Internet messaging services, or any other services offered by or through MySpace; 2. Establishing or maintaining MySpace profiles; 3. Referring to MySpace in connection with unsolicited commercial electronic communications; 4. Using any MySpace logo or graphic, interface, or other presentations that approximate or resemble the MySpace log-in page; 5. Inducing MySpace members to provide identifying information; and 6. Encouraging, facilitating, enabling, or inducing any person or entity to do any of the above.36
Points of Interest for Lawyers Whose Clients Do Business in Virtual Worlds Lawyers practicing in virtual world matters may learn several lessons from MySpace, Inc. v. Wallace. First, this case teaches that the CAN-SPAM Act defines “commercial email message” to encompass messages sent entirely within a single domain. Second, it applies the CAN-SPAM Act to a case in which the defendant used pretexting to steal identification information from members of an online community and in the form of messages appearing to be affiliated with a legitimate community organizer and to hijack those members’ accounts for its illegal purposes. Third, it gives meaning to the Act’s undefined “pattern or practice” element. Fourth, this case demonstrates the level of evidentiary support that does not suffice to establish likelihood to prevail on a § 7704(b)(2) claim that the defendant used outlawed automated means to accomplish its commercial email messaging. Particularly, it shows that the courts will require more than a tenuous inference of the use of automated means, even when it seems highly unlikely that the challenged conduct can have occurred by other than unlawful automated means. Fifth, this case recognizes that irreparable harm can be caused by the degradation of a plaintiff ’s customers’ experiences in using its online services and by the likely ultimately ineffectual efforts that a plaintiff can undertake to protect its operations and its customers’ experiences. Sixth, the decision in this case indicates that a court will examine other cases in which the defendant’s similar conduct has been challenged to infer how that defendant will respond to protective actions undertaken by the plaintiff. Eighth, the court’s analysis and redrafting Volume 25 • Number 6 • June 2008
CAN-SPAM Act of the scope of the preliminary injunction granted in this case provides helpful guidance to attorneys seeking narrowly tailored injunctive relief for their clients in virtual world matters. Finally, given the facts of this case, one wonders whether MySpace considered simultaneously bringing a cause of action under consumer protection law to challenge Wallace’s apparent pretexting as a means of stealing MySpace members’ identification information, or at least referring the case for action by the Federal Trade Commission or one or more state attorneys general.37 Additionally, MySpace would also seemed to have had an intellectual property claim on copyright, trademark, or trade dress claims for Wallace’s copying or knock off of the MySpace log-in page. These would seem likely additional means of combating his wrongful actions.
Notes 1.
MySpace, Inc. v. Wallace, 498 F. Supp. 2d 1293 (C.D. Cal. 2007).
2.
See MySpace, Inc. v. Wallace, 498 F. Supp. 2d 1293, 1299 (C.D. Cal. 2007) (citing 15 U.S.C. § 7704(a)(1), (3), (5), and (b)(2)).
3.
See id. (citing Cal. Bus. & Prof. Code § 17529.5, §§ 22984, et. seq., & §§ 17200, et seq., and §§ 17500, et seq.).
4.
The court also dispatched evidentiary objections going to the relevant facts. It nullified testimony of Wallace’s purported expert, sustaining MySpace’s objections, and overruled other evidentiary objections in summary fashion. See id. at 1298-1299.
unique uniform resource locators, or URLs, and required routing as the Act. Id. at 1300-1301. 13. See id. at 1301-1304 (citations omitted). 14. See id. at 1302 (citing Cherosky v. Henderson, 330 F.3d 1243, 1246-1247 (9th Cir. 2003); United States v. Ironworkers Local 86, 443 F.2d 544, 552 (9th Cir. 1971); Omega World Travel, Inc. v. Mummagraphics, Inc., 469 F.3d 348, 358 (4th Cir. 2006)). 15. See id. at 1304-1305 (citations omitted). 16. See id. at 1301 (citations omitted). 17. Id. at 1301-1302 (citations omitted). 18. 19. 20. 21.
Id. at 1303; see also id. at 1306. Id. at 1303 & 1306. See id. at 1302-1303. Id. at 1303 (quoting 15 U.S.C. §§ 7702(2)(A) & 7704(a)(5)(A)). Regulations promulgated under the CAN-SPAM Act further refined the definition of “primary purpose” to mean an email message “consist[ing] exclusively of ” the commercial advertisement or promotion. Id. (citing 16 C.F.R. § 316.3(a)(1)) (emphasis supplied). 22. See id. at 1304. 23. See id. 24. See id. 25. See id. at 1305. 26. See id. at 1304-1305. 27. See id. at 1305-1306 (citations omitted). 28. Id. at 1305-1306 (citations omitted). 29. See id. at 1306.
5.
See id. at 1298 (citations omitted).
6.
See id. at 1300.
30. CompuServe v. Cyber Promotions, Inc., 962 F. Supp. 1015, 1019 (S.D. Ohio 1997).
7.
See id. at 1299 (citations omitted).
31. See MySpace, 498 F. Supp. 2d at 1306.
8.
See id. at 1299-1301 (citations omitted).
32. See id. at 1306.
9.
Id. at 1299 (quoting 15 U.S.C. § 7702(6)).
33. See id. at 1306.
10. Id. at 1299-1300 (quoting 15 U.S.C. § 7702(5)).
34. See id. at 1308-1309.
11. Id. at 1300 (quoting 15 U.S.C. § 7702(4)).
35. See id. at 1306-08.
12. See id. at 1300 (citations omitted). The court also opined that MySpace would still have a right to private action under the narrower interpretation of the CAN-SPAM Act advocated by Wallace because the recipient email addresses were resident at
36. See id. at 1308-1309. 37. See generally Emile Loza, “Internet Fraud: Federal Trade Commission Prosecutions of Online Conduct,” 23 Communications & the Law 55 (2001).
Reprinted from The Computer & Internet Lawyer, June 2008, Volume 25, Number 6, pages 1 to 5, with permission from Aspen Publishers, Inc., a Wolters Kluwer business, New York, NY, 1-800-638-8437, www.aspenpublishers.com.
Volume 25 • Number 6 • June 2008
The Computer & Internet Lawyer • 5
