Subject: [Asrg] Opt-out lists and legislation

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 10 Mar 2003 12:56:05 -0800

This is one of the issues that I think needs to be addressed if legislation
against spam is enacted.

A review of the Nixon vs Blastfax decision suggests that even the current
anti-junk-fax laws might not survive supreme court review (particularly with
this shower). In particular there is an argument to be made that a blanket
ban on unsolicited faxes is not the most narrowly tailored remedy. I
consider the court's other opinions to be spurious but I suspect that even
if the narrowness issue works for junk fax it is unlikely to work for junk
email.

There are currently two camps, anti-spam campaigners wanting a blanket ban
with no opt-out list and the DMA which wants to kill the competition from
spam but not by setting a precedent that could affect their members.

The problem with opt-in for anti-spam campaigners is that the spam senders
get a ready made list of people to spam. So the legislative trick to finesse
this is to have an opt-out list that can be used to check to see if someone
has opted out but not to see how to email them.

This requirement is met by a one-way function, as I have previously observed
(and published in a very prior-art sense) in 1995 or so. There are a bunk of
tweaks that can be applied to make processing more efficient but the upshot
is that anyone can check against the list without the list being a source of
spam addresses.

My view on the legislative issue is like the view of everyone else on this
list, completely irrelevant. If congress decides to take the issue up they
will. There are very good law enforcement reasons for taking action on spam,
precisely because the activity it is supporting is already largely illegal.
It makes sense to criminalize their accomplices too.

Another effect that legislation can have is to provide safe harbor against
vexatious injunctions intended to keep a spamhaus in business a few weeks
longer while they try to get a new feed.

One side effect of a canonical opt-out list would be that it would expose
the false nature of the click here to opt out links.

		Phill

> -----Original Message-----
> From: Justin Mason [mailto:[email-masked]]
> Sent: Monday, March 10, 2003 2:42 PM
> To: Vernon Schryver
> Cc: [email-masked]
> Subject: Re: [Asrg] Lets Fix Mailing Lists
> 
> 
> On Mon, Mar 10, 2003 at 11:05:03AM -0700, Vernon Schryver wrote:
> > > From: Kee Hinckley <[email-masked]>
> > I've repeatedly pointed out reasons why that is not just 
> possible but
> > quite likely.  Contrary to spammer fighter religious dogma, many
> > (but certainly not all) spammers care very much about receiving
> > "bounces" and "removes."  Many spammers honestly think that letting
> > their targets opt-out is the right thing to do.
> 
> In that case, things have changed a lot since April 2002. 
> 
> 	http://www.ftc.gov/opa/2002/04/spam.htm:
> 	In another initiative, Netforce partners tested whether "remove
> 	me" or "unsubscribe" options in spam were being honored. From
> 	e-mail forwarded to the FTC's database, the agencies culled
> 	more than 200 e-mails that purported to allow recipients to
> 	remove their name from a spam list. The agencies set up dummy
> 	e-mail accounts to test the pledges, but discovered that the
> 	vast majority of addresses to which they sent the requests
> 	were invalid. Most of the "remove me" requests did not get
> 	through. Based on information gathered by the Netforce, the FTC
> 	has sent more than 75 letters warning spammers that deceptive
> 	"removal" claims in unsolicited e-mail are illegal.
> 
> --j.
> _______________________________________________
> Asrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/asrg
> 
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Jason Hihn <[email-masked]>
Date: Mon, 10 Mar 2003 17:03:43 -0500

Legislation is futile. The spammers will go off-shore if not already.
The only solution is a technical one that crosses political borders.

You're thinking to highly of spammers.

But I would feel more confident giving my email to a US based company.

Unfortunately, most of my spam seems to be from self-promoters.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf Of
Hallam-Baker, Phillip
Sent: Monday, March 10, 2003 3:56 PM
Cc: [email-masked]
Subject: [Asrg] Opt-out lists and legislation

		Phill

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 10 Mar 2003 16:42:25 -0700 (MST)

> From: Jason Hihn <[email-masked]>

> ...
> ...

If that were true, the people who make Rolex watches and print CDROMs
software or DVDs with movies would have no hope fighting offshore
pirates.  In fact, contrary to the hoary old chestnut about legistation
being useless because of offshore spam, laws including trade agreements
and sanctions are reasonably effective.  They don't and can't stop
all spam, knock-off Rolexes, or pirate CDROMS or DVDs, but they can
stop enough of it to be worthwhile.

Besides, in the long run the real offshore spammers (no matter which
are your shores) will largely stop spamming you, just to save their
own bandwidth, time, and effort.  Most spam is domestic, even if it
happens to use offshore relays or ISPs.  Almost all spam includes
contact information for domestic outfits that can be whacked by domestic
legislation.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked]
Date: Sun, 16 Mar 2003 21:43:43 +0000

On Mon, Mar 10, 2003 at 12:56:05PM -0800, Hallam-Baker, Phillip wrote:

<Some stuff snipped>
> is that anyone can check against the list without the list being a source of
<Some more stuff snipped>

While such a list would not provide email addresses, it would allow email
addresses to be validated.

If I am a spammer in Elbonia with a 1,000,000 email address CD, then I
could submit each address in turn to the Opt-Out list.

Is [email-masked] in the Opt-Out list?  Yes
Is [email-masked] in the Opt-Out list?  No
Is [email-masked] in the Opt-Out list?  Yes

[email-masked] and [email-masked] must be valid email addresses, so
I'll send them some spam.

This is why one does not respond to Opt-Out requests in spam; it
validates the email address to the spammer.  This system would allow
them to do this automatically.

-- 
Richard Laysell <[email-masked]>
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Michael Ellis <[email-masked]>
Date: Mon, 17 Mar 2003 09:49:35 -0500

> them to do this automatically.

I was at the IAPP conference a few weeks ago and there the FTC revealed that there
unsubscribe test campaign resulted in no increase in spam to those addresses at
all.

Which was amusing to here since the TRUSTe rep just before him said never do this
as you will get more spam

--
Michael Ellis
Privacy Manager
Date.com
  Phone   (416) 306-0022 ext 620
  Fax     (416) 306-0023

Date.com - "The New Way To Date"

---

From: "Chris Lewis" <[email-masked]>
Date: Mon, 17 Mar 2003 10:42:24 -0500

> unsubscribe test campaign resulted in no increase in spam to those addresses at

There have been other tests of this that show the opposite.