First published: 22nd November 2013
Under the UEMO, generating electronic addresses by automated processes to send a commercial electronic message is an offence punishable by up to 5 years jail and a fine of up to HK$1,000,000. However, it is not easy to detect. How do you establish that a company has an automated process? The results are indistinguishable from manual collection methods, unless the addresses generated have never been used.
On 1st March 2013, Yui Kee's mailserver received over thirty messages, all advertising the services of "BL Consultants Company Limited", sent to different addresses. Most of the messages were sent to admin or enquiry at a .com.hk domain that Yui Kee administers, the rest were sent to other addresses in the yuikee.com.hk domain. The domains where the admin and enquiry mailboxes were targeted are used for websites, and are defined with a domain mailbox. Thus, the email addresses that were targeted had never been published or used. It appeared likely that the sender had taken two common mailbox names, admin and enquiry, and merged them with a list of .com.hk domain names.
The messages were reported to the Office of the Communications Authority (OFCA) as contravening the Unsolicited Electronic Messaging Ordinance, which prohibits generating electronic addresses by automated processes to send a commercial electronic message.
On 27th September 2013, OFCA reported its findings:
We have approached the sender concerned for investigation. The sender replied that your 19 email addresses in question were manually collected from public websites by its staff during the past years. Meanwhile, we do not have sufficient evidence to prove the allegation that the sender had used automated means to generate electronic addresses that contravened Part 3 of the Ordinance.
Yui Kee responded:
You report that the sender concerned in the captioned cases claimed to have collected the addresses from public websites. Please note that most of the addresses, all those with the 'admin' and 'enquiry' username, have NEVER been published anywhere.
...
The sender concerned is therefore lying, and you should ask them to show you the public websites where they found those addresses. I hope that you take a very serious view on senders lying to you to avoid the provisions of the UEMO.
On 18th October, OFCA replied:
As explained in our letter dated 27 Sep 2013, we do not have sufficient evidence to substantiate the allegation that the sender has used automated means to generate electronic addresses that contravened Part 3 of the UEMO. In this regard, we could not proceed further on the case.
Yui Kee responded:
As for evidence, you have the statement of a Hong Kong resident, myself, that most of the addresses have not published. Against this, you say you have a statement from the sender that they collected the addresses manually online. Investigators, of course, do not merely wait for evidence to drop into their laps, they actively make enquiries to gather further evidence. You have not indicated that you have investigated to corroborate or disprove those statements. Two obvious routes for investigation would be to ask the sender for details of where the addresses were found, or the process used by their staff to find addresses, and to search for the addresses yourself.
Yui Kee also asked some questions, OFCA replied, making reference to a document available on the OFCA website, Enforcement Statistics of UEMO. The questions, answers and statistics are combined here in a readable form:
Have you conducted enquires to corroborate or disprove the statements by myself and the sender? What were they?
We will enforce the UEMO in accordance with a due process and we do not have sufficient evidence to substantiate the allegations.
What, in your view, would be sufficient evidence to substantiate a claim of address generation?
We will enforce the UEMO in accordance with a due process and we do not have sufficient evidence to substantiate the allegations.
Since the introduction of the UEMO, in how many cases was address generation alleged?
Please note that we do not have statistics for a particular allegation, such as address generation.
What are your standard procedures for investigation when address generation is alleged?
We will enforce the UEMO in accordance with a due process and we do not have sufficient evidence to substantiate the allegations.
How many cases of address generation have been prosecuted?
Zero. Since the UEMO fully commenced on 22 December 2007, there have been no prosecutions for any offence it defines.
What other statistics or information can you provide to demonstrate your effectiveness in enforcing the UEMO?
Enforcement Statistics of UEMO. In the 12 months from November 2012 to October 2013, OFCA has dealt with 2540 reports, issuing 87 warning letters and 8 enforcement notices.
Allan Dyer, Yui Kee's Chief Consultant, commented, "The receipt of the same message at multiple email addresses that have never been used is the Smoking Gun for the offence of automated address generation. OFCA should be following up with detailed questioning of the sender and recipient, to establish the veracity of the conflicting claims, and searching for electronic evidence. Instead, OFCA claims it is using 'a due process' without explaining what that process is."