CRTC fines individual for company violations under CASL

The Commission finds that nCrowd, Inc. committed one violation of paragraph 6(1)(a) and one violation of paragraph 6(2)(c) of Canada’s Anti-Spam Legislation (the Act) in relation to commercial electronic messages sent to recipients in Canada. The Commission also finds that Brian Conley is liable, under section 31 of the Act, for those violations. Accordingly, the Commission imposes an administrative monetary penalty of $100,000 on Brian Conley. CRTC
Icon of a courthouse

The commission’s report is well worth a read as it discusses many of the things I’ve noticed from spamming operations over the years. It’s pretty standard business practice for spammers to have a complex set of sorta but not really different businesses. They all interact and share data, but not legal liability. They’re mostly treated as one business by the principles and there’s no real dedication to any one brand name.

I don’t think I can describe it much better than the commission did:

The investigation uncovered a complex corporate network and a business pattern, characterized by acquisitions, foreclosures, and bankruptcies. During this chain of acquisitions, the customer email distribution list grew exponentially to reach more than 2 million email addresses. The common threads amid this corporate network and string of acquisitions of email distribution lists are the key players involved, namely Ghassan Halazon and Brian Conley Footnote3 , as shown in the chart below and detailed in the corresponding description.

Besides this chain of acquisitions, the investigation uncovered a whole network of corporations in various lines of businesses, throughout several countries, and characterized by (a) high frequency of business registrations, (b) high frequency of business acquisitions, (c) high frequency of corporate changes, including names and addresses, and (d) dealings with companies specialized in dividend routing and tax optimization services.

Through the years I’ve dealt with folks in this space as they regularly have delivery problems. Seeing the image of the myriad companies and bankruptcies and list transfers from the CRTC solidified in my mind that this really was a nest of spammers. Just look at how many businesses they went through without losing any email addresses.

It’s not coincidental that there are so many business name changes. In this case, there was some fraud going on for the customers, but frequent domain changes are a hallmark of spammers. If you talk to them, and I have, they will tell you they have to change names otherwise the ISPs block their mail. They’ll tell you they keep bounces low and remove complainers and follow all the best practices, but the ISPs hate them so they have to change business names.

Business models like this are nothing new, of course. One of my earliest clients asked me to help them set up a fake ESP. The idea would be to set up a whole bunch of different entities each with their own domains and business information. When one of the entities would get blocked, they’d tell the blocklist or ISP that it was a customer who was now terminated. After the block was lifted, they’d spin up a new customer and keep sending.

The ease at which spammers set up companies and sending domains and Its is the reason why ISPs treat mail with new domains and IPs as spam unless proven otherwise. 20 years of history indicates spammers do go so far as to create new companies to send spam. Given the recent action by the CRTC, it’s pretty clear that this isn’t ancient history, it’s continuing to this very day.

Related Posts

Implied permission

Codified into law in CASL, implied permission describes the situation where a company can legally mail someone. The law includes caveats and restrictions about when this is a legitimate assumption on the part of the company. It is, in fact, a kludge. There isn’t such a thing as implied permission. Someone either gives you permission to send them email or they don’t.
We use the term implied permission to describe a situation where the recipient didn’t actually ask for the mail, but isn’t that bothered about receiving it. The mail is there. If it has a particularly good deal the recipient might buy something. The flip side of not being bothered about receiving mail, is not being bothered about not receiving mail. If it’s not there, eh,  no biggie.

Implied permission isn’t real permission, no matter what the law says.
Now, many deliverability folks, including myself, understand that there are recipients who don’t mind getting mail from vendors. We know this is a valid and effective way of marketing. Implied permission is a thing and doesn’t always hurt delivery.
However, that does not mean that implied permission is identical to explicit permission. It’s one of the things I think CASL gets very right. Implied permission has a shelf life and expires. Explicit permission doesn’t have a shelf life.
Implied permission is real, but not a guarantee that the recipient really wants a particular email from a sender, even if they want other emails from that sender.

Read More

CASL Private Right of Action Delayed

Today the Canadian Government announced they were suspending the provision that allows individuals to sue marketers for violations of CASL.
Under these provisions, individual Canadian consumers had a private right of action. Any Canadian could sue any company that sent mail violating the law. This part of the law upset many senders and marketers. I’m sure many are relieved at this delay in enforcement.
 
This delay has no effect on the other major CASL provision with a July 1, 2017 deadline.
On July 1 a 3 year waiver on implied consent collected prior to CASL will end. What does that mean? Implied consent is just what it sounds like. Under certain conditions, senders can assume they have legal consent to mail the recipient. These conditions are spelled out in Section 10(9) of the law. Implied consent expires after 2 years. However, companies were granted a 3 year waiver on this provision for email addresses collected prior to July 1, 2014.
The waiver allowed senders to continue mailing addresses with implied consent even after the 2 year expiration.  This was to allow companies time to convert implied consent into express consent as to not lose recipients. There are about 3 weeks left for senders to get explicit permission to continue mailing addresses collected prior to July 1, 2014.
Additionally, as of July 1, 2017 CASL requires a parliamentary committee to review the law and its operation over the last 3 years.

Many senders are thrilled with the indefinite suspension of the PRA. It was, I think, one of the parts of the law that worried people the most. Allowing any citizen to sue someone who sent them mail they thought violated CASL? That concept struck fear into the hearts of many a legitimate marketer. I was never quite so sure it was going to be as bad as some thought.
A few years ago I had the opportunity to sit in a conference session with an individual from the Canadian government. They explained that there were significant barriers to individuals suing senders. Plaintiffs must file in provincial courts, not local ones. Second, defendants couldn’t be under investigation by the CRTC and a PRA at the same time. The presenter implied that CRTC had priority over any joint defendant. Finally, the plaintiff must prove actual damages. This is difficult for defendants that use a freemail provider like Gmail. There aren’t really damages in that case.
The overall gist of the session was that PRA in Canada was not that simple. Individuals wanting to sue had some bigger hoops to jump through than just filing something in small claims court. Nevertheless, I’m sure that many senders are relieved to hear the PRA is indefinitely suspended.

Read More

The 10 worst …

Spamhaus gave a bunch of us a preview of their new “Top 10 worst” (or should that be bottom 10?) lists at M3AAWG. These lists have now been released to the public.
sh_logo1
The categories they’re measuring are:

Read More