UNITD STATES OF AMERICA


FEDERAL TRADE COMMSSION 

WASHINGTON, D. C. 20580 

Offce of Policy Planning 

Bureau of Consumer Protection 

Bureau of Economics 

March 31 , 2006 

The Honorable Carol Fukunaga 

State Senator 

Eleventh Distrct


State Capitol 

Honolulu, il 96813 

Re: il SB 2200


Dear Senator Fukunaga: 

The staff of the Federal Trade Commssion s ("FTC" or "the Commission ) Office of 

Policy Planning, Bureau of Consumer Protection, and Bureau of Economics! are pleased to 

respond to your letter of February 15 , 2006 , that asks for our views on Hawaii SB 2200 (" 

2200" or "the bill"), a bill that appears to be designed to protect children from unwanted 

commercial messages that advertise products or services they are prohibited from purchasing or 

contain adult advertising or links to adult content. In particular, your letter solicited our expertise 

and opinion on whether SB 2200 would reduce the amount of unwanted emails and what impact 

the bil might have on Hawaii consumers and competition. 

Hawaii SB 2200 would require the Hawaii Deparment of Commerce and Consumer 

Affairs ("the Deparment ) to establish and operate a child protection registry and make it 

unlawful for a person to initiate any commercial message or communication to any registered 

contact point if the message or communication advertises products or services that a minor child 

is prohibited by law from purchasing, or if the message contains or advertises adult content or 

links to such content. 

This letter briefly summarizes the Commission s interest and experience in consumer 

privacy and provides the staff's opinion regarding the possible impact of SB 2200 on consumers 

and competition, Based on our experience, our review of your letter, and SB 2200, the FTC staff 

have reached the following conclusions: 

Because existing computer security techniques are inadequate to prevent the abuse 

This letter expresses the views of the FTC' s Office of Policy Planning, Bureau of 

Consumer Protection, and Bureau of Economics. The letter does not necessarly represent the 

views of the Commission or of any individual Commissioner. The Commission has , however 

voted to authorize us to submit these comments. 
of such a registry, SB 2200 may provide pedophiles and other dangerous persons 

with a list of contact points for Hawaii children. 

SB 2200 is unlikely to reduce the amount of email spam received by registered 

email addresses. Further, because such a registry cannot be effectively monitored 

for abuse, it may have the unintended consequence of providing spammers with a consequence mechanism for verifying the validity of email addresses, This may

actually increase the amount of spam sent to registered children s addresses in 

general, including spam containing adult content. 

The proposed registry would likely impose substantial costs on legitimate email 

marketers. Combined with the prospect of substantial criminal and civil liability 

for individual violations, the extra burden that SB 2200 would place on Internet 

sellers may, therefore, hamper a paricularly competitive segment of merchants in 

those industries covered by SB 2200, curtail the benefits of such competition to 

consumers, and cause consumers to no longer receive information that they value. 

A brief summar of the Commission s history in consumer privacy and a detailed analysis 

in support of each of the FTC staff' s conclusions is provided below. 

Interest and Experience of the Federal Trade Commission 

The FTC enforces Section 5 of the Federal Trade Commission Act, which broadly 

prohibits "unfair or deceptive acts or practices in or affecting commerce.'" Protecting consumer 

privacy is a central element of the FTC' s consumer protection mission.' In recent years 

advances in computer technology have made it possible for detailed information about people to 

be compiled and shared more easily and cheaply than ever. These developments have produced 

many benefits for society as a whole and il1dividual consumers.' At the same time, some 

consumers have expressed concerns about the compilation and sharng of their personal 

information and a desire to limit unwanted contacts from marketers that use such information. 

As personal information becomes more accessible, individuals and institutions have found it 

necessar to take precautions against the misuse of such information. In recent years the FTC 

has brought a number of cases to enforce promises in privacy statements, including promises 

15 U.S. C. g 45. 

See generally FTC , PRIVACY INITIATIVES (2006), 

http://ftc.gov/privacy/index .html. 

For example, it is easier for law enforcement to track down criminals, for banks to 

prevent fraud, and for consumers to obtain credit. 
q. 

about the security of consumers ' personal information. 

Under the Gramm-Leach-Bliley Act, the Commission has also implemented rules 

concerning financial privacy notices and the administrative, technical, and physical safeguarding 

of personal information and has enforced provisions against pretexting. The Commission also 

protects consumer privacy under the Fair Credit Reporting Act' and the Children s Online 

Privacy Protection Act. The FTC also educates consumers and businesses about the importance 

of personal information privacy and security.' In addition, the Commission provides Congress 

See generally 
 FTC , ENFORCING PRIVACY PROMISES: SECTION 5 OF THE FTC 

C-ACT (2006), at http://ftc.gov/privacy/privacyinitiatives/promises. html. See, e. , Eli Lilly Co. 

FTC Dkt. No. C-4047 (May 10, 2002) (settling charges relating to the unauthorized disclosure of 

sensitive personal information collected through the company s Prozac. com website), available 

at http://www.ftc.gov/os/2002/05/index.htm;Microsoft Corp. FTC Dkt. No. 4069 (Dec. 24

2002) (settling charges relating to the privacy and security of personal information collected 

through the company s "Passport" web service), available at 

http://www.ftc.gov/os/2002/12/index.htm. 

15 U.S. C. g 6801 et seq. (1999). See generally FTC , FINANCIAL PRIVACY: THE 

GRAM-LEACH BULEY ACT (2006), at http://ftc.gov/privacy/privacyinitiatives/glbact.html. 

15 U. c. g 1681 et s (as amended 2003). See generally FTC , CREDIT 

REpORTING: THE FAIR CREDIT REpORTING ACT (2006), 


http://ftc . gov Ipri vacy/pri vacyini tiati vesl credi t.html. 

15 U. C. g 6501 et seq. (1998). See generally FTC, CHILDREN' S PRIVACY: THE 

CHILDREN' S ONLINE PRIVACY PROTECTION ACT (2006), 

http://ftc.gov/privacy/privacyinitiatives/childrens.html. The Act requires operators of 

commercial web sites to: post a privacy policy on the web site s homepage and link to the policy 

on every page where personal information is collected; provide notice about the site 

information collection practices to parents and obtain verifiable parental consent before 

collecting personal information from children; give parents a choice as to whether their child' 

personal information wil be disclosed to third paries; provide parents access to their child' 

personal information and the opportunity to delete the child' s personal information and opt-out 

of future collection or use of the information; not to condition a child' s paricipation in a game 

contest, or other activity on the child' s disclosing more personal information than is reasonably 

necessar to paricipate in that activity; and maintain the confidentiality, security, and integrity of 

personal information collected from children. 

See generally FTC , ENFORCING PRIVACY PROMISES (2006), 

http://www.ftc.gov/privacy/privacyinitiatives/promises.html; FTC, il THEFT HOME (2006), at 

http://www.consumer.gov/idtheft/;FTC FTC CONSUMR ALERT, SPYWAR (2006), at

http://ftc. gov/bcp/conline/pubs/alerts/spywareal rt.htm. 
with information and analysis regarding privacy issues. 

In recent years, the FTC' s privacy agenda has included the Commssion s "Do Not Call" 

Registry," which provides consumers with a simple, free, and effective means to limit unwanted 

telemarketing calls. ll The Commssion has also worked vigorously to combat mass email 

spam " both before and after the enactment of the Controlling the Assault of Non-Solicited


Pornography and Marketing Act of 2003 ("CAN-SPAM' ')2 through law enforcement against


spamers, the education of consumers and businesses, and through continued study of the


problem. " In addition , the Commssion is in the process of completing rulemakings and reports


required by CAN-SPAM. The FTC has pursued a vigorous law enforcement program against


deceptive spam and, to date, has brought 85 cases in which spam was an integral element of the


alleged overall deceptive or unfair practice.


The Commission s recent report to Congress Subject Line Labeling As a Weapon Against 

Spam and the Division of Marketing Practices ' recent report Email Address Harvesting and the 

Effectiveness of Anti-Spam Filters note that Internet Service Providers ("ISPs ) have developed 

a number of technological options to sort, delete, or block unsolicited commercial email. The 

Commission has also monitored the development of filtering technologies that consumers may 

use in their personal email accounts to sort, delete, or block unwanted commercial email that may 

contain age-inappropriate content, and has encouraged consumers to consider using such 

IO See, e. Press Release FTC; FTC Testifies on Data Security and Identity Theft

(June 16 2005), available at http://ftc.gov/opa/2005/06/datasectest.htm. 

II 

See generally FTC, NATIONAL DO NOT CALL REGISTRY (2006), 

http://ftc . gov /bcp/conl i net edcams/ donotcallii ndex .html. 

15 U. C. g 7701 et seq. (2003).

13 See generally FTC, SPAM, PRESS ROOM (2006), 

http://www.ftc.gov/bcp/conline/edcams/spamlpress.htm. 

See generally id. 

15 FTC, SUBJECT LINE LABEUNG AS A WEAPON AGAINST SPAM, A REpORT TO 

CONGRESS 10- 12 (2005), available at 

http://www.ftc. gov/reports/canspam05/050616canspamrpt.pdf; FTC DIVISION OF MATING 

PRACTICES , EMAI ADDRESS HAVESTING AN THE EFFECTIVENESS OF ANTI-SPAM FILTERS 

6 (2005), available at 
 http://www.ftc.gov/opa/2005/11/spamharvest.pdf. Examples include: 

customized filters that block out email messages containing words that occur more frequently in 

known spam; "blacklists" of Internet Protocols determined to be an open relay or proxy used by 

spammers; and "whitelists" of legitimate marketers that ensure legitimate, non-spam email is not 

blocked. 
, 

), 

technologies. 

Notably, in one of the FTC' s congressionally-mandated reports - a June 2004 report 

entitled National Do Not Email Registry, a Report to Congress ("Do Not Email Report )!7 - the 

Commission analyzed the issues identified in your Februar, 15 2006, letter. In the Report, the 

Commssion concluded that spammers would most likely use a registry as a mechanism for 

verifying the validity of email addresses and, without the ability to authenticate their identities 

enforcement officials would be largely powerless to identify and pursue those responsible for 

misusing a registry. Thus, a registry would raise serious security, privacy, and enforcement 

diffculties , especially for children s email accounts. !S A discussion of the Report s conclusions 

is provided below. FTC staff have also previously commented on another state proposal similar 

to SB 2200. 

II. Summary of SB 2200 

Hawaii SB 220020 would require the Hawaii Deparment of Commerce and Consumer 

Affairs to "establish and operate, or contract with a qualified third party to establish and operate 

the child protection registry."'! Under the bill (tJhe deparment or a third pary administrator 

shall establish procedures, to the extent possible, to prevent the use or disclosure of protected 

16 E. FTC, YOU' VE GOT SPAM: HOW TO "CAN" UNWANTED EMAI 2 (2002), 

available at 
 http://www .ftc. gov/bcp/conline/pubs/online/inbox. pdf. 

17 FTC, NATIONAL DO NOT EMAIL REGISTRY, A REPORT TO CONGRESS (June 

2004), available at 
 http://www.ftc.gov/reports/dneregistry/report.pdf. Specifically, CAN-SPAM 

required that the FTC transmit to Congress a report that: "(1) sets forth a plan and timetable for 

establishing a nationwide marketing Do-Not-Email registry; (2) includes an explanation of any 

practical, technical, security, privacy, enforceability, or other concerns that the Commssion has 

regarding such a registry; and (3) includes an explanation of how the registry would be applied 

with respect to children with e-mail accounts. " 15 U. C. g 7708. See also FTC 

EFFCTIVENESS AN ENFORCEMENT OF THE CAN-SPAM ACT, A REpORT TO CONGRESS (Dec.


2005) ("Effectiveness and Enforcement Report available at


http://www .ftc . gov /reports/canspam05/051220canspamrt. pdf.


See generally Do Not Email Report supra note 17 ati-ii. 

19 FTC Staff Comment to the Honorable Angelo "Skip" Saviano Concerning Ilinois 

HB 0572 to Create a Child Protection Registry (2005), 
 available at 

http://www.ftc.gov/os/2005/11/051101cmtbil0572.pdf.

20 Hawaii S.B. 2200 , 23'd Leg. (2006), available at 

http://www .capitol.hawaii.gov/sessioncurrent/bills/SB2200 SD 1 pdf. 

Id. at g B(a). 
, 




contact points. . . ."22 These contact points would include: instant message identities; wireless 

communications device numbers; fax numbers; email addresses; or other electronic addresses 

subject to rules adopted by the Deparment.23 A parent, guardian, individual , school , or other 

institution responsible for a contact point to which a minor may have access may register that 

contact point with the Deparment.24 Such a registration would last for up to three years and 

expire upon a minor s eighteenth birthday. 

Under SB 2200 (a) person shall not send, cause to be sent, or conspire with a third party 

to send a message to a contact point that has been registered for more than thirty calendar days 

with the department if the primar purpose of the message is , directly or indirectly, to advertise 

or otherwise link to a message that advertises a product or service that a minor is prohibited by 

law from purchasing, viewing, possessing, paricipating in, or otherwise receiving."" The 

sending of such a message "is prohibited only if it is otherwise prohibited for the minor to 

purchase, view , possess, paricipate in, or otherwise receive the product or service."2O The 

consent of a minor or third pary to receive the message is not a defense. 

The bil would require the Deparment to establish a procedure to allow senders to verify 

compliance with the registry." A person desiring to send a message containing content 

inappropriate for minors would need to pay the Deparment for access to this mechanism at a rate 

set by the Department based on the number of contact points checked against the registr, not to 

exceed .03 cents per contact point.30 SB 2200 would also prohibit a person from releasing to 

Id. 

Id. at g A. 

Id. at g B(b), (d). 

Id. at g B(c). 

Id. at g D(a). 

Id. at g D(e).

28 Id. at g D(c). It is not a violation if a person is merely an intermediary between

the sender and recipient of a prohibited electronic message or unknowingly provides transmission 

of such a message over a computer network or facility. Id. at g D(d)(I)-(2).

29 Id. at g B(f). See also id. at g (H) ("The deparment shall adopt rules. . .

necessar for the purposes of this par. "

30 Id. at g B(g). Such collected fees would be credited to a children s protection

registry fund administered by the Deparment and to the Hawaii Attomey General in order to 

administer and conduct investigations, enforcement, and defense of the registry. Id. at gg B(h),

C(a)-(c). 
another person information contained on the registry, selling or using the registry for any reason 

other than to meet the requirements of the bill, or accessing or attempting to access the registry 

except as provided under the bill.'! 

SB 2200 would make "an intentional or knowing violation" of the bil a computer crime 

punishable as a class C felony, in addition to any penalties authorized by the state s computer 

crime statute." A civil action based on such a computer crime could also be brought by an 

authorized individual or the registrant of the contact point on behalf of a minor who has received 

a prohibited message, a person through whose facilities such a message was transmitted, or the 

Attorney General against a person who has violated the bill.33 A person bringing such an action 

could recover actual damages including reasonable attorney s fees or, in lieu of actual damages 

the lesser of five-thousand dollars per each message received or transmitted or two-hundred fiftythousand dollars for each day the violation occurS.34 In addition, SB 2200 would give the Hawaii 

Attorney General the power to investigate the business transactions of a person reasonably 

believed to have violated the bil. 

II. Effect of SB 2200 on Registered Children 

SB 2200 May Provide Pedophiles and Other Dangerous Persons With a 

List of Contact Points of Hawaii Children 

The registry proposed by SB 2200 would create an extensive directory of children 

contact points that currently does not exist. As explained below, such a list cannot be effectively 

monitored for abuse.36 By compiling such a list that cannot be effectively monitored for abuse 

Id. at g E(a)-(c). 

SB 2200 at g F. See also 
 HAW. REv. STAT. g 78 Par IX (2004). 

SB 2200 at g G(a)(I)-(3). 

Id. at g G(c)(I)-(2). 

Id. at g G(d).

36 Recently, two states have established similar children s registries, the "Michigan 

Children s Protection Registry Act " MICH. COMPo LAWS g 752. 1061 et seq. 
 (2004) and the

Utah Child Protection Registr Act " UTAH CODE ANN. g 13-39- 101 et seq. 
 (2004). The

Commssion staff wil continue to monitor these registries with regard to their effect on 

children s privacy. In its December, 2005 , report to Congress Effectiveness and Enforcement of 

the CAN-SPAM Act the Commission reiterated that it "generally supports initiatives that protect 

children from inappropriate content, but state registries that maintain sensitive information 

belonging to children raise troubling issues." Effectiveness and Enforcement Report supra note

, at 39-41. Thus, the Commssion continues to "caution against legislative action on the state 
, 




SB 2200 may provide pedophiles and other dangerous persons with a potential list of contact 

points of Hawaii children. As the Do Not Email Report concluded (t)he possibility that such a 

list could fall into the hands of the Internet's most dangerous users , including pedophiles, is truly 

chiling. "37


Although difficult to quantify, the risk of a pedophile or other dangerous persons 

misusing the registry data to discover the contact point of a Hawaii minor is certainly real. First 

such a list could be misused by registry personnel.38 Second, such a list is subject to direct 

hacking by technologically sophisticated persons. Third, the Hawaii Attorney General's office is 

unlikely to be able to screen every single individual who might seek, or to whom it might 

provide , registry access. For example, it is unlikely that the state would be able to perform 

background checks on every employee of all marketing firms that may potentially misuse their 

access to such a registry. In sum, a central registry of children s contact points may provide 

pedophiles and other dangerous persons with a means of contacting those children. 

level to adopt registry-style laws in the hope they may effectuate improved protections for 

children in the online environment. The Commission believes that grave security and privacy 

concerns argue decisively against such measures. Id. Because Michigan and Utah have only

recently established such registries, which became effective last summer, it may be useful for you 

to continue to evaluate their experiences once they have been in effect for several years. 

Do Not Email Report supra note 17 , at 33-34. 

As a computer security expert retained by the FTC explained: 

In the Computer Security field, it is well known that insider attacks account for 

the most loss in terms of proprietar data. While we have well-developed 

techniques for thwaring external attackers, for example, firewalls, intrusion 

detection systems, and virtual private networks, the state of the ar at protecting 

against rnalicious insiders is currently dismal. Proprietar algorithms, code, and 

designs leak all the time. Industrial espionage is rampant, and theft of data by 

people with legitimate access is the most common form of loss known to today 

corporations. This is why the hashed list of email addresses, which is such a 

valuable target, is almost certain to be compromised at some point if a Do Not 

Email registry is deployed. The technology does not exist to protect it against 

insiders. 

A VIEL D. RUBIN, A REpORT TO THE FTC ON RESPONSES TO THEIR REQUEST FOR 

INFORMATION ON ESTABUSHING A NATIONAL DO NOT E-MAI REGISTRY 11 (May 2004), 

available at http://www .ftc . gov /reports/ dnere gistry/ex pertrpts/rubin. pdf.

39 Since the Commssion s Do Not Email Report, there have been no technological 

advances that would alleviate the risk that pedophiles and spammers would misuse registry data. 

Effectiveness and Enforcement Report supra note 17 , at 40 n. 164 (citing expert report of

Mathew Bishop, Ph. , Professor of Computer Science at the University of California ("UC" 

Davis and Co-Director of the UC Davis Computer Security Laboratory). 
).

 

Email Addresses on the Proposed Registry are Unlikely to Receive Less 

Spam and May Actually Receive More Spam, Including Adult Content 

A Registry Could Provide Spammers With a List of Valid Children s Email 

Addresses For Spam Marketing 

As mentioned above, SB 2200 would create an extensive directory of active children impossible email addresses. As technology stands today, it is
 to know whether any particular 

stated email address is actively used by an actual user, until it is tested to verify that it is valid. 

A registry of email addresses, such as the one proposed by SB 2200, would eliminate that 

technological hurdle, one of the few remaining barrers that can slow spammers down. 

Spammers would have significant incentives to attempt to obtain a copy of such a registry 

or portions thereof for two main reasons. First, spam marketers of products and services used by 

children (e. , CDs , ringtones, clothing, video games) could use such a list to focus their spam 

marketing campaigns. According to a 2003 study conducted by Symantec Corp. , 76 percent of 

children who use the Internet have one or more email accounts.'1 Such email accounts are 

attractive contact points for spam marketers, and marketers of products used by children would 

likely be wiling to pay a premium to obtain a list of children s email addresses. Second, even 

spam marketers that do not specifically target children would find such a list valuable simply 

because the email addresses on it would have been verified as being valid and could, therefore 

help a spammer to evade an anti -spam filter put in place by an Internet Service Provider 

ISP" 

Disturbingly, 47 percent of the children surveyed in the Symmantec study reported 

Do Not Email Report supra note 17, at 1- 12.

41 The study, conducted by Symantec Corp. in June 2003 , surveyed 1 000 children 

between the ages of seven and eighteen. See Press Release, Symantec, Symantec Survey Reveals 

More Than 80 Percent of Children Using Email Receive Inappropriate Spam Daily ("Symantec 

Survey ) (June 9 , 2003), available at 
 http://www.symantec.comlpress/2003/n030609a.html. The

findings of the study are discussed in the Do Not Email Report supra note 17 , at 33-34. 

42 As spammers send more messages, they necessarly increase the number of 

undeliverable messages coming from their Internet Protocol ("IP") addresses. ISPs , however 

filter out all messages from an IP address from which a high number of undeliverable messages 

are sent. This filtering increases the probability that all of a spammer s messages from that IP 

address will not be delivered, including those messages that would have been delivered but for 

the undeliverable messages that were sent with them. By including in a marketing campaign a 

largc number of known valid email addresses with email addresses of unknown validity, the 

spammer increases the odds that the ISP wil deliver messages to the addresses of unknown 

validity. Do Not Email Report supra note 17, at 18- 19 93.
receiving spam with links to pornographic websites.'3 The Commssion has found no data to 

suggest that spamers are currently targeting children to receive specific types of spam 

however.44 Rather, spammers appear to use indiscriminate marketing techniques, and, therefore 

children generally receive the same types of spam that adults receive ' This fact is not surprising 

because spammers and others currently have no way of knowing that paricular email addresses 

belong to children, unless the children have divulged their ages and email addresses , or otherwise 

indicated their minor status by signing up with an SB 2200-type registry. Thus, because such a 

registry cannot be effectively monitored for abuse, it may have the unintended consequence of mayproviding spammers with a mechanism for verifying the validity of email addresses. This


actually increase the amount of spam sent to registered children s addresses in general, including 

spam containing adult content. To the extent that the registr may be misused to verify the 

validity of email addresses, such verified email addresses could then be re-sold to spam 

marketers in general, including spam marketers of adult content. 

Existing Computer Security Techniques are Inadequate to Prevent the Abuse 

of Such a List 

In its Do Not Email Report to Congress, the Commission analyzed three computer 

security techniques that registry proponents had claimed could significantly reduce the security 

and privacy risks associated with a registry of individual email addresses: (1) the centralized 

scrubbing of marketers' distribution lists; (2) the conversion of addresses to one- way hashes; and 

(3) the seeding of the registry with "canar" email addresses. As explained below , although each 

of these three techniques may reduce certain types of computer security threats, none of them can 

completely prevent the misuse of registry data. 

43 Symantec Survey, supra note 41. Notably, over 20 percent of children with email 

accounts open and read spam messages. Id. Even when children feel uncomfortable, offended 

or curious after seeing inappropriate spam, 38 percent of them do not tell their parents. Id. 

44 When Commssion investigators "seeded" 175 different locations on the Internet 

with 250 undercover email addresses, they found that the content of the resulting spam was 

unrelated to the location on the Internet from which the address was harvested. Consumer Alert 

FTC, Email Address Harvesting: How Spammers Reap What You Sow (Nov. 2002), available 

at http://www.ftc.gov/bcp/conline/pubs/alerts/spamalrt. htm. See also Do Not Email Report

supra note 17 , at 34 n. 187. 

45 According to one ISP, about thirty percent of all spam delivered to its subscribers 

inboxes in January and Februar 2004 contained sexually explicit material or references. Do Not 

Email Report supra note 17 , at 32 n. 174. The Commission found that 17 percent of 

pornographic offers in the spam it analyzed contained "adult imagery. " FTC, FALSE CLAIMS IN 

SPAM, A REpORT BY THE FTC' s DIVISION OF MARKETING PRACTICES 13 (Apr. 30, 2003), 

available at http://www .ftc. gov/reports/spaml030429spareport. pdf. 
Centralized Scrubbing Would Not Prevent Registry Misuse 

Rather than distributing to email marketers copies of a registry that could then fall into 

the hands of pedophiles or other dangerous persons, some have proposed that a registry could 

instead require email marketers to submit their distribution lists to the registry to be scrubbed of 

registered contact points." The state could then return a list purged of registered email addresses. 

But such centralized scrubbing would not prevent spamers from using the registry to obtain 

valid email addresses. Although central scrubbing by the registry might prevent spammers from 

obtaining a full copy of the registry, spammers would simply have to compare their pre-scrubbed 

and post-scrubbed lists for differences between them, and identify email addresses removed by 

the scrubbing. Thus, list scrubbing has a fatal flaw that, ironically, could allow spammers to 

verify addresses on their mailing lists. By repeatedly submitting lists of email addresses to a 

registry for scrubbing, spammers could potentially reconstruct a substantial portion of the 

registry.'7 

Although Hawaii could attempt to track the identities of marketers submitting their lists 

for scrubbing, in many cases the state would have no practical means of knowing whether 

persons making such submissions were misusing the registry data. Generally, a law-abiding 

marketer who purchased an emaillist and then submitted it to the registry for scrubbing would be 

indistinguishable from a malicious spammer who purchased the same list and then submitted it in 

order to validate addresses for future spamming. If a marketer who misused the registr for 

spamming purposes included its identity in the resulting violative spam the state could of course 

discipline such a marketer. This type of scenaro is unlikely in the current context of 

technologically sophisticated and elusive spammers. Similarly, the state would generally have no 

practical way of preventing or detecting such a spamer from selling a validated emaillist to 

other spammers. 

One-Way Hashing Would Not Prevent Registry Misuse 

One-way hashing involves using cryptographic algorithms to transform a string of text 

into character strngs called "hashes." In a hashed registry, a consumer couJd enter an email 

address on the registry using a web-based form. The state would then send a confirmation email 

to the consumer s email address. To activate the registration, the consumer would return to the 

registry s web site and enter a code appearng in the confirmation email. Upon activation of the 

registration, the state would convert the email address to a one-way hash using a publicly-known 

hashing algorithm. The entire registry would be stored as one-way hashes.'" 

46 See, e. Do Not Email Report supra note 17, at 19 (noting that when the 

Commission solicited input for the Do Not Email Report, it received ten Request for Information 

RF") responses proposing registries that use a centralized scrubbing mechanism ). 

Id. at 19-20. 

48 For example, a consumer might register an email address, such as abc(Qftc.gov. 

Then, using a securing hashing algorithm standard, the registry would convert the address into a 
A marketer authorized to use an email registry would convert registered email addresses 

on its distribution list into hashes using the same hashing algorithm used by the registry. The 

marketer would also create a database identifying each original email address and its associated 

hash. The marketer would then submit its hashed distrbution list to the state for scrubbing. The 

registry would compare the marketer s hashed distribution list to the hashed registry and return to 

the marketer a hashed distribution list purged of those hashes appearng on the registry. A 

legitimate marketer would then send messages only to those addresses that corresponded to 

hashes on the list returned by the state. An ilegitimate spammer, however, could determine 

which of the addresses on its original distribution list were on the registry (and, therefore, are 

valid addresses) by comparing the hashed list submitted to the state with the scrubbed list of 

hashes returned by the state and determining the email addresses that corresponded to the purged 

hashes. 

It is virtually impossible using current computing and software technology to determne 

an original un-hashed text by analyzing the resulting hash. Thus, if someone obtained the 

registry of hashed email addresses , it is unlikely that the database could be un-hashed and turned 

back into a list of readable email addresses. Hashing may protect a registry from outside hackers 

by maintaining data in an encrypted form. But, although a hashed registry would provide some 

measure of security against a hacker, it would not protect against the likely threat of a spammer 

using the registry as a tool for validating email addresses.50 In sum, whether un-hashed or 

hashed, centrally-scrubbed or distributed, the legitimate bulk emailer needs to know which 

addresses on its distrbution list are on the registry. The inevitable corollar is that the 

ilegitimate spammer can use the registry to deduce valid email addresses through comparson. 

hashed form, such as 551ge3f2ba5aef2dead64n2cf31507e88d6eb23 , and add it to the registry. 

49 A spamer with little technical sophistication could easily convert millions of 

email addresses to hashes in seconds using a standard desktop computer. Do Not Email Report 

supra note 17 , at 21-22 n. 105. 

As a computer security expert retained by the Commission explained: 

Crytographic hashing can be thought of as a method for "anonymizing" an 

address. . . that helps to protect the original list from becoming a source of new 

addresses for spammers. However, due to the mathematical properties of 

cryptographic hashes, it is stil possible for a person who knows an email address 

to tell whether that address is on the anonymized list. So a system based on 

crytographic hashes is roughly equivalent. . . to one that allows emailers to 

query a centralized database to check whether paricular addresses are on the list. 

Id. at 22. Another computer security expert retained by the Commssion explained that "hashing 

provides absolutely no security against a marketer who obtains a scrubbed list and uses (it) to sell 

the addresses that were scrubbed by the Registry. Id. at n. 106.
, 

 ,  

Seeding the Registry Would Not Prevent Misuse 

The Do Not Email Report also analyzed the utility of seeding a registry with secret 

registry-controlled addresses designed to detect spammers ("canar addresses 51 To ensure that 

emails received by canary addresses would be true indicators of registry misuse, each canary 

address would have to be extremely unlikely to receive spam, absent a registry violation. In other 

words, the canar addresses could not already be circulating on emaillists on the Internet and 

would need to include characters unlikely to be generated by a computerized dictionary attack 

program.52 For instance, using a random character generation program, the Commission could 

establish the email address "25ceI2a4QYfederaltcommiss.com. The address would be monitored 

constantly. Anyemail sent to the canary address would indicate a misuse of the registry. 

Seeding a registry with canar addresses may aid the detection of the outright hacking of 

an un-hashed registry, if such an address obtained through hacking then receives spam. But it is 

unlikely that seeding could prevent spammers from misusing a registry through the submit-andcompare technique. A canar address would not be circulating on a spammer s pre-scrub email 

lists outside the registry, absent a direct hack, and would include character strings unlikely to be 

created by a dictionar attack program. Therefore, with a hashed registry, a canar address 

would never receive a spam message, preventing the detection of a misuse of the registry. 

Moreover, although the receipt of email by a canar address may make it possible to 

detect the misuse of a registry it could not prevent such abuse, as such detection would 

necessarily occur only after the registry had already been compromised. Detection would likely 

be too little help too late. The widespread use of false headers, open relays, open proxies, and 

zombie drones by sophisticated spammers would make it exceedingly difficult or impossible to 

trace a message from the seeded address back to its source.54 The result would be the same even 

if a centralized registry were to distrbute un-hashed copies of the registry, including canary 

addresses, to marketers. 

Id. at 22-23. 

52 If the registry were seeded with FTC-controlled email addresses that were likely to 

be targeted by dictionary attack programs (e. johnQYftc.gov ), the receipt of a message at this 

address would not necessarly indicate that the Registry had been misused to search for valid 

addresses. A spamer with a dictionary attack program may have sent the message. Id. at 22 

ll0. 

53 Id. at 22-23 n. 112. As one computer security expert concluded canares are 

useless when dealing with a hashed registry." Do Not Email Report supra note 17, at 22­

ll1. 

Id. at 8- 13 (explaining these techniques). 
, 

 

Senders of Offensive Spam Wil Be Diffcult to Locate and Prosecute 

The FTC' s experience in its spam cases shows that the primary law enforcement 

challenge is identifying and locating the targeted spammer. As the Do Not Email Report 

explains , the ability of spamers to hide their identities by using false headers, open relays, open 

proxies, zombie drones, and foreign servers makes tracing an email's path " an often fruitless 

task."" Thus (t)racing an email almost always leads to a dead end because spamers rarely 

send messages from their own email accounts. ISPs which, like the Commission, have 

considerable experience dealing with spam, have been similarly stymied by spammers' use of 

zombie drones and other camouflage tactics. 

Unable to identify a spammer based on the email trail, law enforcement and ISPs must 

locate spammers by tracing the flow of funds from victim to spamer. The experiences of law 

enforcement and ISPs belie claims that spamers can be caught easily. First, numerous spam 

messages, such as those that are purely malicious vehicles for viruses and Trojans, do not 

typically request money. Second, spammers that request funds often use novel payment methods 

offshore banks, stolen credit card accounts, and other techniques that make tracing the flow of 

money a painstakng, and often futile, endeavor. 

IV. Impact on Consumers and Competition 

In addition to the risks to children discussed above, SB 2200 would also likely have 

significant consequences for email marketers throughout the United States, not just those that 

conduct business in Hawaii. Because an email address does not indicate the geographic 

residence of its user, a marketer cannot easily separate out residents of certain locations from a 

marketing list. Any sender of email marketing goods , products, or services covered by SB 2200 

would, as a practical matter, therefore, need to scrub each registered address from its list in order 

to ensure that it did not violate the registry and subject itself to substantial criminal and civil 

penalties. 

For example, with a centrally-scrubbed registry, before sending any customers an email 

newsletter featuring a laser pointing device, a merchant would need to submit its entire emaillist 

to the registry for scrubbing because Hawaii minors are prohibited from purchasing such 

devices.57 Similarly, a winery would need to scrub its entire emaillist before embarking on an 

email marketing campaign to promote its wines to avoid inadvertently violating SB 2200 by 

sending a message to a registered email address. Under SB 2200, such marketers would need to 

conduct such scrubbing every 30 days. 

Id. at 23- 26. See also id. at 8- 12. 

Id. at 23-26. 

57 HAW. REv. STAT g 136-3 (1999) ("It shall be unlawful to sell or furnish a laser 

pointing device to any minor.

). 

The cost of such scrubbing and monitoring can be substantial for legitimate marketers 

who are gcncra1ly unlikely to use email to target minors for products they are prohibited from 

purchasing.59 Marketers of certain types of products, such as sexua1ly explicit content, are 

already subject to substantial legal penalties if they do not comply with laws that protect minors 

(and adults who do not wish to view such content).60 Spammers are unlikely to honor any such 

registry of prohibited contacts and may, in fact, misuse such a list to spam the children on it. The 

costs of complying with SB 2200, in addition to the potential for substantial criminal and civil 

liability for indi vidual violations, may cause some legitimate marketers to consider ending mass 

Do Not Email Report supra note 17, at 31 n. 165. 

See, e. BEER INSTITUTE, ADVERTISING AND MARKETING CODE 1 (2006), 

available at 

http://www . beerinstitute.orgleerInsti tute/files/ccLi brarFiles/Filename/0000000003 84/2006AD 

CODE.pdf (stating that brewers should not market to underage persons, and that " (t)hese 

guidelines apply to a1l brewer marketing materials, including Internet and other cyberspace 

media. ); DISTILLED SPIRITS COUNCIL OF THE UNITED STATES, CODE OF RESPONSIBLE 

PRACTICES FOR BEVERAGE ALCOHOL ADVERTISING AND MARKETING (2006), available at 

http://www. discus.orglindustry/code/code.htm (stating that alcoholic beverages should not be 

marketed to underage persons, and that " (t)he provisions of the Code apply to every type of print 

and electronic media, including the Internet and any other on-line communications, used to 

advertise or market beverage alcohol."); and FRE THE GRAPES! , WINE INUSTRY CODE FOR 

DIRCT SHIPPING (2006), available at 
 http://www.freethegrapes.orglwineries.html#code 

(specifying that wineries may direct ship wine to adults only in states where it is legal to do so; 

must request the birth date of the purchaser to verify he/she is over 21 years of age before 

completing any transaction; and must conspicuously label shipments with a minimum 

notification "signature of person age 21 or older required for delivery See also 
 FTC

CIGARTTE REpORT FOR 2003 8-9 (2005), available at 

http://www.ftc. govlreports/cigarette05/050809cigrt.pdf (noting that in 2003, besides creating a 

company website, cigarette "companies reported no expenditures on any other Internet 

advertising (e. banner ads on third party sites and direct mail advertising using -email).

60 For example, under the FTC' s recent "Label for E-mail Messages Containing 

Sexually Oriented Material" Final Rule, adopted pursuant to the CAN-SPAM Act, commercial 

email messages containing sexua1ly oriented materials must " (e)xclude sexually oriented 

materials from the subject heading for the electronic mail message and include in the subject 

heading the phrase ' SEXUALLY-EXPLICIT: ' in capital letters " and include the electronic 

equivalent of a "brown paper wrapper" in the body of the message. 16 C.P.R. g 316.4. Thus, the 

Rule protects minors (and adults who do not wish to inadvertently view sexually explicit content) 

by requiring that the sender prevent recipients from viewing such material without a recipient 

affirmative decision to do so. Courts can award up to $11 000 in penalties per violation of the 

CAN-SPAM Act, including a violation ofthe Rule. 15 U.S.c. g 7706(a); 15 U.S.C. g 7(a)(I)(B); 

15 U. C. g 45(m)(I)(A), as modified by 28 U. C. g 2461 , as amended and implemented by 16 

P.R. g 1.98(d). 
, 




cmaij campaigns altogether. The aggregate effect of SB 2200 might be to close off the 

legitimate emaij marketing of those products and services that it would cover, throughout the 

United Statcs, not just for Hawaii residents, and for all consumers, not just minors.62 Thus, SB 

2200 would likely have a greater effect on sellers that rely on email contact points in lieu of a 

physical prcsencc in order to conduct business, such as a stand-alone Internet company. As noted 

in the FTC staff report Possible Anticompetitive Barriers to E- Commerce: Wine Internet 

merchants often provide consumers with lower prices, more choices, and better quality products 

and services. The extra burden that SB 2200 would place on Internet sellers may, therefore 

hamper a paricularly competitive segment of merchants in those industries covered by SB 2200 

curtailing the benefits of such competition to consumers. 

61 Id. See also 
 Jon Swartz Anti-Porn Spam Laws to Shield Kids Backfire USA

TODAY, Aug. 21 2005 at Bl available at 

http://www .usatoday.comltech/news/computersecurity/2005-08-21-email-children htm. 

62 If email marketers do ilegally sell products to underage persons, they are still 

subject to state criminal statutes. Thus, email marketers must structure their activities so that 

they do not violate state laws already in place.

63 See FTC STAFF, POSSIBLE ANTICOMPETITIVE BARRIERS TO E-COMMERCE: 

WINE 1 (July 2003), available at 
 http://www.ftc.gov/os/2003/07/winereport2.pdf. ld. atl. 3 14­

26. For example (t)he staff. . . concludes that online wine sales give consumers the 

opportunity to save money and to choose from a much greater varety of wines. Id. at 14. See

also FTC STAF, POSSIBLE ANTICOMPETITIVE BARIERS TO E-COMMERCE: CONTACT LENSES 

(Mar. 2004), available at 
 http://www.ftc.gov/os/2004/03/040329c1reportfinal.pdf. 

is 64 For example, it is likely that some consumers would no longer receive 

information that they value and, in some cases, that they have specifically requested, such as a 

monthly email newsletter advertising current prices for covered goods or services. This not to 

suggest, however, that the FTC is unconcerned about the marketing of age-inappropriate products 

and materials to minors , such as entertainment having violent content. See FTC , MARKETING 

VIOLENT ENTERTAINMENT TO CHILDREN: A REVIEW OF SELF-REGULATION AND INDUSTRY 

PRACTICES IN THE MOTION PICTUR, MUSIC RECORDING & ELECTRONIC GAM INDUSTRIES 

(2000), available at http://www.ftc.govlreports/violence/vioreport.pdf (recommending that the 

motion picture, music recording, and electronic game industries continue to improve compliance 

with existing ad placement guidelines and rating information practices, avoid advertising venues 

with under- 17 audiences , and enhance efforts to prevent minors from purchasing ageinappropriate content). The Commission also has a toll-free consumer complaint line and 

Internet complaint form available for consumer complaints about the marketing of media 

violence to children. FTC , FTC ACCEPTING COMPLAINTS ABOUT VIOLENT ENTERTAINMENT 

MARKETED TO KIDS (2004), available at 

http://www.ftc.gov/bcp/conline/pubs/alerts/mediavioalrt.htm. In addition, as noted above, the 

FTC has also urged consumers to consider using filtering technologies in their personal email 

accounts that allow users to sort, delete, or block unwanted commercial email that may contain 

age-inappropriate content. See supra note 16. 
Conclusion 

Hawaii SB 2200 appears to be designed to protect children from unwanted commercial 

messages that advertise products or services they are prohibited from purchasing or contain adult 

advertising or links to adult content. By compiling a list of children s contact points that cannot 

be effectively monitored for abuse, however, SB 2200 may provide pedophiles and other 

dangerous persons with a list of contact points for Hawaii children and may actually increase the 

amount of spam sent to those addresses, including adult content. The extra burden that SB 2200 

would place on legitimate Internet sellers may also hamper a particularly competitive segment of 

merchants in those industries covered by SB 2200, curtail the benefits of such competition to 

consumers, and cause consumers to no longer receive information that they value. 

Sincerely, 

Maureen K. Ohlhausen, Director 

Christopher M. Grengs, Attorney Advisor 

Office of Policy Planning 

B. 

Lydia B. Parnes , Director 

Daniel R. Salsburg, Attorney 

Bureau of Consumer Protection 

Michael A. Salinger, Director 

Louis Silversin , Economist 

Bureau of Economics