This is an archived article that was published on sltrib.com in 2006, and information in the article may be outdated. It is provided only for personal research purposes and may not be reprinted.
The Utah agency in charge of policing Web-based purveyors of pornography, alcohol, tobacco and gambling told some parents Thursday it divulged the e-mail addresses of their children - information the state is supposed to safeguard.
The breach of Utah's Child Protection Registry program is a major faux pas for the Utah Division of Consumer Protection. It also could pose a credibility problem for Unspam Technologies Inc., the private company that created the system and is pushing other states to adopt it.
Utah Department of Commerce Director Francine Giani said Thursday that a new consumer protection employee neglected to redact four e-mail addresses from citations obtained through a routine open-records request. Giani learned of the mistake, which occurred Oct. 3, from court papers filed Thursday by a California adult-industry trade group challenging the constitutionality of the controversial registry.
"A fair amount of trust has been placed with us and this is not a good thing," Giani said. "I'm sick about it."
Giani emphasized her department, not Unspam, was responsible.
But that didn't stop the Free Speech Coalition from arguing the entire program is far from foolproof. The breach underscores one of the issues the Federal Trade Commission highlighted in its review of e-mail registries - that the benefits are outweighed by the risk of compromise, said coalition attorney Jerome Mooney.
"It's a substantial failure of a program that's barely one year old," Mooney said. "And it's not like anyone was probing the system to look for weaknesses."
The breach involves citations issued last month to four companies for violating a new law that requires adult-oriented Web sites to screen out the e-mail addresses of minors who appear on the state registry.
Named in the citations were DOS Media Now, an Encinitas, Calif., online gambling site; Golden Arch Casinos, of Overland Park, Kan.; Smoothbeer.com, a United Kingdom beer company; and SoftestGirls.com, a Singapore company that sent pornographic e-mails to Utah minors.
After reports of the crackdown appeared in the media, Justin Weiss of the E-mail Service Provider Coalition requested copies of the citations. The state promptly complied but neglected to redact the e-mail addresses of the children in question.
Weiss, whose trade group is supporting the coalition's legal challenge, alerted state officials to the security breach Oct. 3 and urged them to inform the individuals whose personal information was compromised, according to court filings.
Just two weeks earlier, Matthew Prince, president and CEO of UnSpam, claimed it was impossible for anyone to get their hands on the e-mail addresses on the registry.
"Even if ordered by a court or held at gunpoint, there is no feasible way that I, any Unspam employee, or any state official could provide you even a single address that has been submitted for compliance by any sender," Prince said in an affidavit.
That a state employee got the names and divulged them makes a mockery of Prince's comments, the Free Speech Coalition suggests in court papers. But Brent Hatch, an attorney for Unspam, points out that Prince was speaking only of e-mail lists submitted to his company. The state got the e-mails it divulged from parents who complained that their children were receiving illegal solicitations.
"This has nothing to do with the registry. The registry is completely secure," Hatch said. "The Free Speech Coalition got it flat wrong. We stand behind Mr. Prince's statement."
Utah and Michigan are the only states to adopt the registry created by Unspam. The company charges a half-cent for each address that is removed. The registry is free for schools, parents and other guardians of minors to use.
Commercial e-mailers argue that the registry's time and cost are an unfair burden. U.S. District Judge Dale Kimball has set a Nov. 9 hearing on the coalition's motion for an injunction, and the state's request to dismiss the coalition's lawsuit.