Everybody knows spammers are bad, and the only people who are worse than spammers are the uneducated goobers who help make the spam problem worse, and you would NEVER go into business with a spammer, right?

(The correct answer here is "Right!" in case you're unsure.)

Well, not so fast. Where are you getting your business leads from? We're not even talking about rogue affiliates but lead-generation services whose collection practices might not stand up even in the weak glare of CAN-SPAM.

<a href="http://www.chicagotribune.com/news/local/chi-0407180201jul18,1,7360459.story">A story in Sunday's Chicago Tribune </a>outlined the business practices of Ryan Pitylak, 22, of Austin, Texas, who apparently is responsible for a big chunk of those emails offering to refinance your mortgage, sell you health insurance or a burglar alarm or extend your car's warranty.

Instead of actually doing the deal, though, the emails from any of over 200 shell companies Pitylak and a partner set up directed clickers to a form that collected name, address, household income and other identifying data.

Pitylak and his partner then sold the information as leads for $3 to $7 each. Companies the Trib ID'd as buying the information include IndyMac Bank, ADT Security and MEGA Life and Health Insurance.

Although the Trib couldn't get Pitylak on the record to talk about his business, one of his clients had no problems discussing it.

"'I just buy them from the lead companies,' said Kathy Mobley, regional director for MEGA Life and Health, based in North Richland Hills, Texas. 'I don't know how they get them. And I don't care. As independent contractors, we can market our business however we want to by legal means.'"

Legal? Maybe. But the practice definitely creates a murky permission trail, since nowhere in the Trib story does it say that the emails notify the respondents about the companies that will be getting their personal information.