While the federal CAN-SPAM law that was enacted two years ago has allowed prosecutors to put some big-name spammers behind bars, the law has also caused significant headaches for legitimate marketers who are trying to stay compliant, according to one attorney.

The Federal Trade Commission (FTC) reports that there have been more than fifty actions taken by federal and state prosecutors, as well as ISPs, since the law was enacted in January of 2004, said Jon Praed, a founding partner of the Internet Law Group, a law firm that represents large corporations such as AOL in Internet-related disputes, who spoke at the MIT Spam Conference in Cambridge, Mass., on Tuesday.

“The law is effective because it has encouraged adoption of best practices by legitimate [organizations] and has provided an additional tool for ISPs in law enforcement,” said Praed, referring to the law’s provision that lets ISPs file suit against spammers. “But that first benefit comes at a signification cost” and still spammers are not complying.

Spammers are able to skirt complaints brought up under CAN-SPAM by a practice called microbranding, Praed explained. This is where spammers create a shell company with so many small brands that each appears too insignificant to file a complaint against. “They disperse complaints across so many entities that anyone who wants to come after you thinks you’re so small that it’s not worth the time, when in fact you have hundreds of companies,” he explained.

Therefore, legitimate e-mailers are spending large sums of money on complying with the law, while the amount of spam isn’t declining, he said. “We are spending far more on CAN-SPAM compliance than we are getting for the bang.”

What would improve the situation would be finding a way to get a “hard ID” on the spammers, Praed said.

One way to do that would be is to establish a “custodian of record” practice. This practice comes from the pornography industry and requires all sources of illicit photographs to appoint a person the custodian of the models’ names and proof of age. The name of that custodian must be made publicly available. “This is extremely powerful if you’re trying to find out who is responsible for the porn on those Web sites, [the custodian] can tell you who produced all those photos.”

Applying this model to spam would work because “spammers hide, legitimate e-mailers don’t,” said Praed, therefore any e-mail without custodian of record information in the header would automatically be spam.

“Consumers should control their inboxes. We should shift the legal burden to the sender to establish they had some consent from the recipient in deciding to send the e-mail, and require the sender to stand up and identify himself in the e-mail,” Praed said. “That will quickly bankrupt spammers.”