Spammers are making the leap from e-mail to Facebook

It's called "phishing," and it's how Adam Guerbuez of Montreal was able to gain access to Facebook users' accounts and bombard the social network with sexually explicit spam messages. But were Mr. Guerbuez to do the same within Canadian borders, an affected company would have no legal recourse.

In a landmark ruling Monday, U.S. federal Judge Jeremy Fogel awarded Facebook $873-million (U.S.) in damages after finding Mr. Guerbuez was in violation of the CAN-SPAM Act (Controlling the Assault of Non-Solicited Pornography and Marketing) which prohibits the distribution of mass e-mail messages that contain false or misleading information.

Facebook spokesman Barry Schnitt said it is unlikely Mr. Geurbez will honour what Facebook says is the largest ruling in the history of the CAN-SPAM Act.

"It's certainly beyond his resources, and we have no illusions about getting all of the money," Mr. Schnitt said.

"We're going to get whatever we can. To the extent that he has resources, we're going to try and seize them."

Mr. Schnitt said he mainly hopes the case will act as a deterrent. "[The ruling]sends a message to spammers and would-be spammers," he said.

"We hope this demonstrates the extent to which we're going to expend resources and pursue people to protect users from spam."

Still, Mr. Guerbuez was able to send some four million messages before Facebook shut him down. The company is under "constant attack" from spammers, Mr. Schnitt said.

"Spam has gone Web 2.0," said David Poellhuber, president of Montreal-based Zero Spam.

"The social networks are really the new spammers playground. … Tech savvy young people are new, fresh targets for spammers."

But Mr. Guerbuez gained the usernames and passwords of a number of Facebook accounts through more traditional means: He spammed countless e-mail accounts with a message purporting to be from Facebook that requested the recipient follow a link and then enter their login information. It's one of the oldest tricks in the spammer's book.

After Mr. Guerbuez gained access to users' personal profiles, he used computer programs to send out more than four million messages promoting a variety of products, including marijuana and penis enlargement products, during March and April of this year, Facebook said.

According to Mr. Poellhuber, preventing this kind of spam boils down to simple user education. Internet users should be skeptical of any e-mail that asks for confidential information, be it banking data or Facebook logins.

This is especially important for Canadians, as Mr. Poellhuber notes that our government doesn't have any similar anti-spamming laws.

"It's awkward that this Canadian guy gets hit by a U.S. law. If it happened to a Canadian company, they wouldn't even have a law to pursue."

Ottawa law professor Michael Geist echoed this on his blog Monday. "There are Canadian-based spamming organizations, yet no effective law in Canada to address the issue," Mr. Geist wrote.

"Years after the National Task Force on Spam recommended legislation for Canada, no government has introduced anti-spam legislation, forcing organizations like Facebook to turn to U.S. courts to deal with a problem that originates in Canada."

Facebook uses what Mr. Schnitt calls "statistic anomaly analysis" in order to track down and eliminate spammers. The technology looks for users who send messages or make wall posts at timed or unnaturally fast intervals. They can then then track those posts across the site, allowing messages to be deleted sometimes before users see them.

If Facebook is unsure about a user's authenticity, they can also ask the user to fill in a "captcha," a now-ubiquitous verification tool that asks the reader to input a set of characters displayed in an image.

Efforts to reach Mr. Guerbuez for comment have been unsuccessful; court records indicate the alleged spammer has been difficult to find since Facebook sued him four months ago.

The victory, sealed with a judge's order issued last Friday, probably won't yield a windfall for privately held Facebook Inc., whose revenue this year is expected to range between $250-million to $300-million.

With a report from the Associated Press