INDICADORES DEL AXIOMA

61. Address-harvesting, in the context of spamming, means the acts done by spammers to search for and collect new electronic addresses (mostly e-mail addresses) from telecommunications networks, particularly the Internet, for sending spam. They use software to scan web pages, newsgroups, chat rooms, message boards and e-mail service directories etc. for obvious signs of e-mail addresses like those containing “@” followed by “.com” and then “harvest” them into lists for sending spam. According to a study by the FTC22, chat rooms, newsgroups and web pages are the most harvested forum for e-mail addresses.

62. Because this technique is prevalent among spammers to maximise the reach of their spam e-mails, some overseas anti-spam legislation prohibits the supply, acquisition and/or use of address-harvesting software and harvested-address lists in connection with sending commercial electronic messages23. Since spammers can easily collect large numbers of e-mail addresses through the use of this technique and then send spam to those addresses, it can be considered as an abuse of the electronic communications system with the price for such abuse being paid for by communications service providers (e.g. Internet service providers) and recipients. We are therefore of the view that the UEM Bill should also contain similar provisions to prohibit such activities, tackling the issue from three sides – supply, acquisition and use.

63. Although address-harvesting activities are probably confined to e-mail addresses on the Internet, we consider it desirable to maintain a technology neutral approach so that the statutory provisions would be able to cover harvesting activities for other types of electronic addresses that may become more common in the future.

64. As pointed out by some stakeholders, address-harvesting software does have some legitimate uses, e.g., for corporate-wide system administration purposes. For the UEM Bill, we propose to link the offence to using address-harvesting software or harvested-address lists in connection with sending commercial electronic messages when it is done

22 _{http://www.ftc.gov/bcp/conline/pubs/alerts/spamalrt.pdf} 23

Australia’s Spam Act 2003 prohibits the supply, acquisition and use of address-harvesting software and harvested-address lists in connection with sending commercial electronic messages. US’s CAN-SPAM Act stipulates a prohibition to transmit unlawful commercial e-mail messages using, or to provide list of addresses obtained through, address harvesting. The anti-spam law in South Korea has similar prohibitions on the act of harvesting e-mail addresses from websites that expressly prohibit automated harvesting with software, the sale and circulation of e-mail addresses harvested and the knowing use of e-mail address harvested. Singapore’s proposed Spam Control Bill prohibits the sending of an electronic message to electronic addresses through the use of address harvesting software.

in contravention of the requirements under opt-out regime. This linkage is considered necessary because under an opt-out regime, it is acceptable for an e-marketer to send the first and subsequent commercial electronic message to a recipient until and unless the recipient has expressed his wish not to receive such messages. Thus, using address-harvesting software or a harvested-address list for the purpose of sending commercial electronic messages before an unsubscribe message is sent is, strictly speaking, not aiding in any wrongful act. However, if an e-marketer does not comply with the opt-out regime and at the same time uses address harvesting techniques indiscriminately, then he should be punished not only for non-compliance with the opt-out regime, but also for using address-harvesting software and/or harvested-address lists in an abusive way.

65. Given the implication of address harvesting to the problem of UEMs and the potential gain that a spammer may obtain through the use of such techniques, we consider that a relatively heavy penalty, with the possibility of imprisonment, should be introduced. For the supply, acquisition and use of address-harvesting software or harvested-address list, we consider that on summary conviction, offenders should be punished by a fine up to level 6 as prescribed in Schedule 8 of the Criminal Procedure Ordinance (Cap. 221) (i.e. $100,000) and by imprisonment for up to 2 years. On conviction on indictment, we consider that the fine should rise to a maximum of $1,000,000 and by imprisonment for up to 5 years.

Legislative Proposals

66. In the UEM Bill, we propose to specify that –

(a) no person shall supply or offer to supply address-harvesting software, a harvested-address list, or a right to use them to another person, subject to a defence that he has no reason to suspect that the acquirer of the address-harvesting software, harvested-address list or the right intended to use them in connection with the sending of commercial electronic messages in contravention of the requirements of the opt-out regime;

(b) no person shall acquire address-harvesting software, a harvested-address list, or a right to use them for use in connection with, or to facilitate, the sending of commercial electronic messages in contravention of the requirements of

the opt-out regime;

(c) no person shall use address-harvesting software or a harvested-address list in connection with the sending of commercial electronic messages in contravention of the requirements of the opt-out regime. The act of forwarding address-harvesting software or a harvested-address list to another person or organisation should be caught by (a) above and should not constitute a “use” of such software or address list;

(d) a contravention of the above requirements is an offence and a person who commits such an offence is liable –

(i) on summary conviction, to a fine at level 6 as prescribed in Schedule 8 of the Criminal Procedure Ordinance (Cap. 221) (i.e. $100,000) and to imprisonment for 2 years; or

(ii) on conviction on indictment, to a fine of $1,000,000 and to imprisonment for 5 years.

We wish to seek comments on the above legislative proposals for prescribing the rules about address harvesting.

Part VI Offences Relating to the Sending of Commercial