Subject: consent expression (was RE: [Asrg] ASRG next steps)

From: Paul Judge <[email-masked]>
Date: Tue, 4 Mar 2003 18:51:40 -0500

> 
> What is "consent expression"?  

Consent expression means that someone can state which communication they
wish to receive or not to receive. This allows a very granular definition by
each user(individual or organization).

> If it is not a trivial boolean like 
> "I do [not] like spam," how can it not be a magnet for abuse ranging
> from minor privacy violations to more spam to literal visits from
> death squads reducing their political enemies?

trivial boolean? spam can not be expressed as a boolean. We realized that
the definition is inconsistent and people in this community have spent many
years debating "unsolicited bulk" versus "unsolicited commercial bulk"
versus a host of other definitions seeking some form of optimal cover set of
everyone's personal definition. The problem is that while these broad
definitions are good, they are not perfect. There are many messages that
people consider spam that do not fit these definitions (this leads to false
negatives). Likewise there are messages that fall within these definitions
that are not considered spam (this leads to false positives). Spam is in
many cases an individual preference. It is a subjective opinion of unwanted
messages. One approach is to continue to try to confine the definition to
one that covers only the subset of what everyone considers spam without
including anyone's wanted messages. A different approach is to step away
from the binary decision of spam and non-spam and realize that communication
can be more granularly defined. For example, "product offers", "chain
letters", "mailing lists", "newsletters", "greeting cards", "fradulent
offers", "unauthenticated messages", "unverifiable messages", etc. By
developing a robust categorization of messages, we can allow users to
express consent for certain types of communication. This allows the common
lack-of-consent policies to be implemented as close to the source as
possible. From there, we require an architecture that can support these
policies. This architecture may very well be a combination of current and
new approaches.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 4 Mar 2003 17:19:27 -0700 (MST)

> From: Paul Judge <[email-masked]>

> ...

>                                ...  A different approach is to step away

We already have ways to characterize and optionally refuse "unauthenticated
messages" or "unverifiable messages" for various notions of those.
For example, you can tell your SMTP server to reject mail that fails
SMTP-TLS verification or does not use SMTP-AUTH.

I'd be interested in hearing useful notions of the others.  I fear
that legitimate mail doesn't need content identifiers, because its
targets want it regardless of labels, while spam will always have
surprising labels.  Mail that should be tagged "fradulent offers" will
always be marked otherwise as "newsletters" or "greeting cards."  Mail
that should be marked "unsolicited newsletters" will be marked "about
last night."  Of course, legitimate ISPs won't tolerate that, but
legitimate ISPs already don't tolerate spam.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Keith Moore <[email-masked]>
Date: Tue, 4 Mar 2003 20:59:16 -0500

> We realized that the definition is inconsistent and people in this community
> have spent many  years debating "unsolicited bulk" versus "unsolicited
> commercial bulk" versus a host of other definitions seeking some form of
> optimal cover set of everyone's personal definition. 

To a recipient, spam is mail he finds annoying, doesn't want to receive, and
thinks the sender should have known better than to send to him. 
(It's like the famous judge's definition of porn: "I know it when I see it.")

To an ISP, spam is what violates its AUP.  Alternately, it's what customers
complain about loudly enough that the ISP has to spend resources doing
something about it, thus increasing cost and decreasing margin.

To a sender, spam is whatever someone else is doing.  No spammer sees himself
as part of the problem :)

IMHO, it's important to keep these fundamentally different perspectives in
mind. A recipient who receives an annoying message is just as annoyed whether
he is the sole recipient of that message or whether it was sent to millions of
people.  ISPs don't want to deal with every annoying message that someone
receives, and we don't want to penalize every sender who happens to
occasionally annoy someone over email. It makes sense for ISPs to be concerned
about the *volume* of annoying messages that are sent out (hence "bulk") or
whether the messages sent out violate some well-defined criteria (e.g.
"commercial") that can be cited as violations of the sender's contract with
the ISP.  But these criteria should not be viewed as sacrosanct, and
different, or additional, criteria may also be valid.

Keith

---

From: Brad Templeton <[email-masked]>
Date: Tue, 4 Mar 2003 20:00:08 -0800

> To a sender, spam is whatever someone else is doing.  No spammer sees himself

The purpose of a definition of spam is to use legal tactics against
it, typically in contract law, but also possibly in statute.

That's because you must be clear on what it is you're going to punish,
so people should be able to know when they have violated the rule,
or been the subject of it, and so a fair and impartial body can
objectively determine it.

To that end, a legal definition of spam must include nothing but spam,
and will not include all things that you think are spam.

That's because, to get people to agree to enforce it, they do not
wish to be in the position of punishing that which they think is
legitimate mail, nor do those who are creating the system want to
be in the position of chilling legitimate communications.

(In the USA and some other nations, laws are constitutionally required
to block nor chill any legitimate communications, and to be precise,
and to be the least restrictive means possible to solve the problem.)

That least restrictive means test is also a good one to borrow.

Should the global system have a narrower definition, as it must,
this does not preclude private systems from working to stop things
not covered by that definition as best they can.

Thus if a system based on national law, new protocols, or pooling of
MX servers only stops bulk mail above volume X form parties matching
description Y, and you want to add onto it a system which blocks
based on content (Viagara) or intent (advertising) or source (blacklists)
then you are in no way stopped from doing so.   Indeed you can
even make the system big as the population that wants it.

However, for a system to be implemented by the IETF or similar body,
a much narrower concensus is required, as this will be the default
for much of the E-mail system of the world.

That's a pretty heavy burden.   E-mail is all based on private
property, and thus not subject in many cases to 1st amendment and
related protections from private action, but we as architects of
such systems must think of that as a bug, not a feature.  We should
not be glad that we don't have to worry about that pesky first
amendment.

Do people disagree with these principles?  If so, let us know.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Keith Moore <[email-masked]>
Date: Tue, 4 Mar 2003 23:49:28 -0500

On Tue, 4 Mar 2003 20:00:08 -0800
Brad Templeton <[email-masked]> wrote:

> > To an ISP, spam is what violates its AUP.  Alternately, it's what
> > customers To a sender, spam is whatever someone else is doing.  No spammer
> > sees himself
> 
> 

I don't think it's necessary, or particularly useful, for us to try to nail
down "the" definition of spam in objective terms.

I agree (for the reasons you cited, and probably others) that the definition
of spam used in anti-spam laws needs to be different than a recipient's
definition of spam.  The kind of spam that a recipient wants to block, or that
an ISP might want to forbid, might not match the definition of spam in
anti-spam laws.  And it might be useful for a recipient to be able to block
things that don't match the legal definition, and for ISPs to be able to
filter such traffic based on a recipient's instrctions.  If nothing else, such
laws and their definitions of spam will vary from one jurisdiction to
another.

> for much of the E-mail system of the world.

I doubt that it's appropriate for IETF to try to standardize means of blocking
or filtering only what IETF thinks is spam, and I didn't read this IRTF
group's charter as suggesting that kind of approach.  

Keith

---

From: Brad Templeton <[email-masked]>
Date: Tue, 4 Mar 2003 21:18:40 -0800

> group's charter as suggesting that kind of approach.  

Well, if the group is going to consider the question of consent,
then it has to ask "consent to what" and define what mail needs to
even be concerned about the consent of the recipient.

For example, I don't need your consent to send you a person to person
mail, certainly not in advance.  If you want to block the mail of
particular parties sending you person to person mail, that's
best done entirely within your own mail tools since, unless they
are mailing you megabyte images, there are no global concerns.

Nor would we want to have all users of existing mailers need to get
new ones which understand consent protocols etc. unless they are
using them for bulk mail which is unsolicited/from strangers/whatever.

Or is it the hope of this group to research new protocols that would
require all people sending mail to have new tools?
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Mark Delany" <[email-masked]>
Date: 5 Mar 2003 06:14:01 +0000

> require all people sending mail to have new tools?

I don't know about "hope" but is it a tolerable cost if it helps
reduce spam? Maybe. How about a less expensive scenario where all MTAs
have to be upgraded rather than all clients? Is that an acceptable
cost?

If the reports that spam costs USD 8Billion per year are even close to
the truth, it strikes me that imposing an MTA upgrade to avoid much of
that recurring cost is a pretty small price to pay.

Regards.

---

From: Brad Templeton <[email-masked]>
Date: Tue, 4 Mar 2003 23:17:00 -0800

> that recurring cost is a pretty small price to pay.

Well, I would not credit a number like that, but in any event even
if it were larger, there is a question of what is practical.  You
certainly aren't going to get all people to upgrade MUAs.  And I
seriously doubt you will get them to upgrade MTAs.  I mean face it,
people run around with old MTAs and MUAs that expose them to
computer security intrusions and viruses, allowing strange programs
to get into their systems, see all their private files, wipe their
disks and embarasse them in front of friends.   They aren't likley
to upgrade because of an order from high that their old protocol is
obsolete.   People who get lots of spam would want to get new tools
to avoide it, but we're talking about new work for the _sender_ of
E-mail.  Many of which, believe it or not, do not get spam because
they have never exposed their email address, and don't have an
address guessable by dictionary tactics.

However, a far more attainable goal is to require those who host
mailing lists (ie. legitimtae bulk mailers) to get a new MTA.  This
could happen more gradually.   Sites start installing a new MTA,
and whitelisting their existing mailing lists but not all of them.
So most operators of mailing lists start seeing bounces, and want
a new conformant MTA.

While there are many mailing lists, the number of hosts is
manageable.  A large portion are at Topica and eGroups/Yahoo and a
few other hosting sites.  Legit opt-in bulk mailers would upgrade
too to avoid hassles.

A new ESMTP protocol would take many years to get deployed if
you wanted everybody who sends mail to upgrade, and even then
you would see many non-adopters until you started forcing the issue,
which would be quite contentious.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Mark Delany" <[email-masked]>
Date: 5 Mar 2003 08:11:39 +0000

On Tue, Mar 04, 2003 at 11:17:00PM -0800, Brad Templeton allegedly wrote:

> seriously doubt you will get them to upgrade MTAs.

> mailing lists (ie. legitimtae bulk mailers) to get a new MTA.

Okay. You'll need to use small words and short sentences for me. We
don't change MUAs, we don't change the inbound MTAs, we don't change
the ratware used by spammers, yet somehow by changing just the MTAs
used by legit bulk mailers we reduce spam? I've obviously missed
something.

Besides, on the MTA front I think you're way pessimistic. The desire
to reduce spam is real, rampant, intense and user driven.  A lazy
sysadmin may not bother with security updates because his
manager/users don't understand the cost/benefit. Do the users/manager
understand the cost/benefit of a new and effective anti-spam system
they read about in the local paper? Heck yeah. Do they bug their IT
folk for the upgrade? Damn straight!

And this isn't just speculation on my part. I see user surveys from a
major Mail Service Provider and the number of people who bother to
response to surveys that ask about stopping spam is two orders of
magnitude higher than any other survey on any other matter. True!

In short I think we're lucky in that the average Joe, most of the
press and all of the email admins of the world are in total agreement
that spam is a very real problem. If people need to make a change to
thwart spam, my guess is that the response rate will be rapid and
high.

Another besides is that we're not necessarily talking about a lot of
MTAs. If, eg, the major MSPs, such as Yahoo, Hotmail and AOL adopted
this new anti-spam system and the benefits become readily apparent to
the service providers and their users, then you're already pretty
close to a critical mass. The cost of spam is a very strong motivator
for these MSPs.

Regards.

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 05:19:36 -0500

> > I doubt that it's appropriate for IETF to try to standardize means of
> > blocking or filtering only what IETF thinks is spam, and I didn't read
> > this IRTF group's charter as suggesting that kind of approach.  
>
> 

well, I'm uneasy with the term "consent" anyway.  but part of the problem
may be that I don't know what the charter means by that.

one interpretation of "consent" is an opt-out mechanism - recipient can say
"I don't want to receive spam" (assuming that there's some definition of
"spam") and expect that this creates a burden on the sender to not do so.

another interpretation of "consent" would be a direction to the MTS -
"I don't want to receive any message with the following characteristics ..."
(and I specify which characteristics) or "Any mail that comes from a
dubious source should be delayed for N days (by which time we'll know if
he's a spammer) and it can be only text and less than Mk bytes in length"
which would authorize upstream MTAs to discard, bounce, block, delay, etc.
mail intended for me, according to the criteria that I set.

or maybe there's another interpretation I haven't thought of yet...
I don't think the charter is very clearly worded.

(mind you, I can see problems with both meanings of "consent")

> require all people sending mail to have new tools?

surely our immediate task is simply to understand what is feasible, using
the existing mail system and protocols as a starting point.  and I can't
imagine that a proposal that depended on "all users" or "all people" to
upgrade their tools in order to be effective would work. 

actually, since we are a research group, and not a working group, I don't
expect that we are intended to produce a definite answer - but instead try to
increase the understanding of what kinds of measures might be effective, what
their drawbacks are, etc.

Keith

---

From: Roland <[email-masked]>
Date: Wed, 05 Mar 2003 11:12:07 +0000

> "I don't want to receive any message with the following characteristics ..."

This may be a permission given from the user to their isp for
filtering/rejecting mail addressed to him without getting sued.
But thats not the consent we are talking about here.

Any consent has to be given from the receipient to the sender,
and should be non-transferable and revokable at any time.

Such verifiable explicit consent should be mandatory for every
bulkmail sent, and of course for other things like abusing the
address for other content as originally requested, selling the
addresses and any other violations and invasions of privacy.

To be widely usable the 'consent declaration' should have a
standardized format, and replace the usual signup-confirmations.

Such declarations will also protect the senders from accusations
of beeing spammers, the responsible ones will likly adapt any
standard and get their mail deliverd without hassle.

Roland

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 06:27:22 -0500

> But thats not the consent we are talking about here.

I can't tell from the charter what kind of consent they're talking
about, but I'm pretty sure it's not what *you're* talking about.

> and should be non-transferable and revokable at any time.

no, that's clearly unworkable.

Keith

---

From: Roland <[email-masked]>
Date: Wed, 05 Mar 2003 13:32:59 +0000

> no, that's clearly unworkable.

Could you be a bit more specific ?

The only one which can give consent for bulk-mail is the receipient,
and for mail to be sent the sender must have knowledge (even proof)
of this consent.

Thats how you and everybody else got subscribed to this mailing-list
which follows the outline at http://mail-abuse.org/manage.html

The isp (and possibly intermediate relays) will be involved only to
enforce the consent on behalf of the customer, today typically with
the help of blacklists which are not the ideal way.

Roland

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 08:50:43 -0500

> Could you be a bit more specific ?

sigh.  I could, but it's probably just a rathole.

any mechanism has problems and limitations.  I don't think we're going
to find any single mechanism, or even type of mechanism, that satisfies
everyone.  nor do I think it's in scope for this group to try do so.

and at least for the time being I suspect we're better off just trying
to list different mechanisms, and maybe to classify them, than to try to
argue about which of them are better or worse.

so we should put your suggestion on the list along with all the others,
and defer the question of whether any of them is workable.

Keith

---

From: "Chris Lewis" <[email-masked]>
Date: Wed, 05 Mar 2003 12:38:04 -0500

> sigh.  I could, but it's probably just a rathole.

I hope not ;-)

> everyone.  nor do I think it's in scope for this group to try do so.

I don't think, for consent per-se, that we have to find a single 
mechanism or classes of mechanism that works all the time everywhere. 
But at the conceptual level, being able to express and enforce _somehow_:

is critical.

Anything else just means you'll be spammed to death.  Or e-mail dies. 
Or both.

---

From: "Chris Lewis" <[email-masked]>
Date: Wed, 05 Mar 2003 12:32:41 -0500

> it, typically in contract law, but also possibly in statute.

But that's not what we're defining spam _here_ for. Here we merely need 
a rough working definition so that we know what we're talking about.

Here, a rough working definition of "Unsolicited bulk email" is more 
than satisfactory and can help guide potential solutions.  Because 
"unsolicited" and "bulk" is what is causing the problem we're seeing today.

Whether your practise of sending out party invitations is "actionable 
spam" is quibbling about thresholds, and can be deferred to the point 
where we want to talk about "how much bulk" does the law step in at.

Certainly, while it may be difficult for an individual recipient to 
determine the bulkishness of a specific email message, the spammer 
certainly does, and clearing houses (things similar to SpamCop) can, so 
can the law.

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 05 Mar 2003 08:33:33 -0500

> may be that I don't know what the charter means by that.

  I agree completely.  The charter is unclear to me, and I'm not sure
it's even addressing the real issue (as I see it.)

  Some questions:

- Did an ISP consent to have their router/proxy hacked, and used to
  source/relay spam?

- did everyone else on the net consent to accept email from that
  router/proxy?

- why is this sort of behaviour permitted in SMTP?

  Alan DeKok.

---

From: Brad Templeton <[email-masked]>
Date: Wed, 5 Mar 2003 10:16:44 -0800

On Wed, Mar 05, 2003 at 12:32:41PM -0500, Chris Lewis wrote:
> But that's not what we're defining spam _here_ for. Here we merely 
> need a rough working definition so that we know what we're talking 
> about.
> 

So long as any proposed protocol change doesn't have to say things
like, "If it meets our definition of spam, it must be tagged as thus,
or the user's consent must be confirmed."   I agree, and am
happy to move on to the next issue.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 13:44:13 -0500

>    and should be non-transferable and revokable at any time.

no, I think that's a non-starter.  oh I suppose people can impose such
constraints if they wish, but it basically means they'll never get any
mail from somebody they don't know, because they have no way to give
them consent.

at the very least, let's recognize that the kind of consent you are
talking about is different than a recipient giving consent to the mail
system to do filtering on a recipient's behalf.  and as I read the
charter, it's talking about the latter.

Ketih

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 13:58:24 -0500

> than satisfactory 

disagree.

---

From: Adam Back <[email-masked]>
Date: Wed, 5 Mar 2003 19:43:42 +0000

To avoid the trend of people only airing negative opinions, let me say
that I think Brad's narrow content-neutral unsolicited high volume
definition to be spot-on.  We really must avoid solutions which reduce
functionality, reliability and freedoms of email.

I'd also encourage everyone who hasn't to read Brad's principles page:

http://www.templetons.com/brad/spume/prin.html

I'd like to see the group adopt this set of principles as basic
requirements of the "first do no damage" kind, where as we evaluate
technology we hold it up to these principles.

It's easy to notionally fix spam, if one starts out with assumptions
that include damaging reliability and functionality, or could work if
fully deployed but offer no obvious route to deployment.

I think solutions need to provides value to people who upgrade,
without damaging backwards compatibility so that there is incentive to
upgrade.

As one example (not that it hasn't got other problems) on the CAMRAM
list (CAMRAM is a hashcash related proposal) someone proposed using
hashcash to white list to avoid false negatives of Bayesian filters.

This seems good from the above perspective because as a sender you
have an incentive: if you use this system mail you send will not get
falsely filtered by Bayesian filters; and it is backwards compatible
because people who don't use it to send can still send and receive
mail (modulo the false negatives of Bayesian filters).

And as well as slowing spam if it becomes widely deployed, due to the
computational cost of hashcash, it increases reliability as the false
negative problem is reduced for it's users.

That plus signatures as white-lists so that hashcash is only used on
the first email is the basis of the CAMRAM proposal: http://www.camram.org

Adam

---

From: Brad Templeton <[email-masked]>
Date: Wed, 5 Mar 2003 11:45:27 -0800

> used by legit bulk mailers we reduce spam? I've obviously missed

I'm saying that I think getting all the users of the world to get a
new MUA is not possible, except over the course of many years.

I mean even with many companies offering MUAs that block 95% of spam
or more, including free ones, what is the adoption rate?  These are
highly motivated people?

I think even getting all the MTAs upgraded is a major project.  Yes,
desire to get rid of spam is huge.  However, any new protocol asks
the _sender_ to get new software, not the recipient of the spam.

The only way you get the sender to get new software is if the sender
sees all his mail bouncing, which is a pretty dramatic step to take.
To one day get your MTA to say, "Sorry, you don't speak the new
anti-spam ESMTP.  We don't take mail from you until you get a new
MTA!"

As I noted, there are people running old, wide-open versions of
sendmail out there. 

Nonetheless, I think if we came up with a really workable solution
that people could endorse in this fractious community, and a way
to make the changeover take place over a year or more, it could
be done.  It would be hard, but it could be done, and when the
final cutoff came, it would be very very hard, and a lot of
people would be very angry.  Like a million small businesses where
some consultant installed Microsoft Exchange or Sendmail for them,
and they don't have the slightest idea how to upgrade it, and aren't
happy about paying $500 to get another consultant to come in and
do it.   You're not thinking like the joe ordinary computer user,
most of whom are like the above small biz.

Sure, the big ISPs would put in the new MTAs, but that's not the
issue.

My view is, if we do it only for bulk mail, that's OK because that
small business is probably not hosting a mailing list.  If they run
a mailing list the probably host it somewhere else.  I would be
curious about stats on this, though.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 16:23:17 -0500

On Wed, 5 Mar 2003 19:43:42 +0000

> functionality, reliability and freedoms of email.

I don't agree with the spam definition, but am very much in agreement
with the "do no damage" principle.

Keith

---

From: "Mark Delany" <[email-masked]>
Date: 5 Mar 2003 21:29:11 +0000

On Wed, Mar 05, 2003 at 11:45:27AM -0800, Brad Templeton allegedly wrote:

> be done.

I agree and I hope you're right.

> most of whom are like the above small biz.

Don't most of those Joes buy their connectivity from an ISP? Couldn't
the ISP proxy for Joe? Perhaps by intercepting port 25 traffic? Sure,
lot's of special cases, transitional s/w and what not, but helping
most Joes is a possibility.

Heck the ISPs won't mind. After all, won't they have lots of idle
abuse people and anti-spam servers sitting around just waiting for
something to do? (only half joking).

Regards.

---

From: "Chris Lewis" <[email-masked]>
Date: Wed, 05 Mar 2003 16:40:54 -0500

> mail from somebody they don't know, because they have no way to give

The context is bulk, not one-on-one email.  With bulk, of course there 
is a way of giving consent.  Subscribing/confirming to it.

> charter, it's talking about the latter.

 From a definition of spam perspective (see subject line), it's 
definately the former.

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 5 Mar 2003 15:39:47 -0500

>charter, it's talking about the latter.

Is there any help defining this kind of fuzzy problem in the legal 
system?  I'm thinking particularly of how "harassment" gets defined 
in laws.  Does anyone know?

-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Gary Feldman" <[email-masked]>
Date: Wed, 5 Mar 2003 17:59:08 -0500

> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Keith Moore
> Sent: Wednesday, March 05, 2003 1:44 PM

> they'll never get any mail from somebody they don't know, 
> because they have no way to give them consent.

Sounds good to me :-)!
 
> at the very least, let's recognize that the kind of consent 
> you are talking about is different than a recipient giving 
> consent to the mail system to do filtering on a recipient's 
> behalf.  and as I read the charter, it's talking about the latter.

That's not the way I read the charter.  I read the statement on
consent-based communiccations in the charter as being able to build
systems that implement consent policies automatically.  The ability
of the recipient to choose a particular policy is also included (under
"Consent Expression Component"), but that's not how I think the word 
consent is being used.

Gary

---

From: Troy Rollo <[email-masked]>
Date: Thu, 06 Mar 2003 18:32:53 +1100

At 15:39 5/03/03 -0500, Kee Hinckley wrote:
>><issues with the definition of consent deleted>
>
>system?  I'm thinking particularly of how "harassment" gets defined in 
>laws.  Does anyone know?

Consent is a fairly mature concept in law. In fact there's an entire book 
on it. In fact there's probably several, but the one I'm thinking of is by 
a NSW judge (Chief Justice in Equity Young, as he is now) who has had very 
enlightening things to say about consent from the bench.

Having consent means that the person has given another permission to do 
something. Consent can only be given, it can't be assumed, although it may 
be capable of being inferred by some other words or action. For example, if 
a girl leans in and puckers her lips, she's probably consenting to be kissed.

Consent can also be "implied" by circumstances, for example, having an 
electronic mailbox accessible via SMTP implies consent to receive personal 
email, because that's the exact thing SMTP was designed for. This implied 
consent is available to everybody until explicitly revoked.

So Keith's concerns about the impact of Chris's definition of consent 
aren't particularly justified if we look at consent as the law defines it, 
since the circumstances he cites as objections are circumstances where 
implied consent already clearly exists.

There are, however, other potential objections, so I won't deny that in 
isolation the definition is problematic, since Chris also mentioned an 
accompanying definition - a definition of spam as being "unsolicited bulk 
email".

If we are saying that consent of the kind Chris described is required for 
"unsolicited bulk email", we have probably narrowed it down to a level that 
is within the realms of agreeability. Happily, you have also narrowed it 
down to the realms where implied consent no longer exists.

You see, consent - however it arises - only goes to the specific type of 
action that would normally be contemplated in the consent. There is implied 
consent for somebody to use your front garden path to gain access to your 
front door to knock on it, but if the path goes by your bedroom window 
there is no implied consent to use the path for the purpose of peering into 
that window at night. In both cases the act of using the path is the same, 
but in one case there is consent, and in the other case the very use of the 
path is outside of the consent.

Similarly, an open shop door implies consent to enter, but the consent does 
not extend to consent to enter for the purpose of theft - a thief is a 
trespasser even though a person who walked in and followed their exact 
trail is not a trespasser because they were within the scope of consent.

So the commonly expressed view in anti-spam circles is:

         Person to person email does not require consent.
         One to many email does require consent.

The view in legal circles is:

         Person to person email has implied consent.
         One to many email requires active consent.

The intent of the variations is identical - it's just a matter of viewing 
the problem from the perspective of technical disciplines on the one hand, 
and the legal discipline on the other.
--
Troy Rollo				Chairman, CAUBE.AU
[email-masked]			Executive Director, iCAUCE

---

From: Keith Moore <[email-masked]>
Date: Thu, 6 Mar 2003 08:58:10 -0500

> aren't particularly justified if we look at consent as the law defines it, 

well, it's not clear to me what the charter means, and I don't have any
reason to believe that they had this particular context in mind when they
wrote it.

also, it's not that I inherently object to defining consent in one way or
another, but I do think that a system that effectively required prior consent
to send mail, and enforced it, would be unfortunate if whatver solution we
came up with did not provide more flexibility than that.

I also don't believe in treating one-to-many email differently than one-to-one
email, because it's the content of the email that the recipient cares about
rather than the number of recipients. 

Keith

---

From: Kee Hinckley <[email-masked]>
Date: Thu, 6 Mar 2003 10:46:38 -0500

>rather than the number of recipients.

I disagree, and I have several examples.

I received a very nice letter (complete with a .sig of a sleeping 
cat) from someone wishing to subscribe to "your mailing list".  I run 
several mailing lists.  I came very close to replying, but the sender 
had pushed the limits just a little too much.  She included a very 
nice (and perfectly innocent) photo in her mail--that's not a normal 
.sig.  Investigation showed that the URL in her .sig was for a 
soft-porn site.  Other than the picture (and some people *do* send 
email with their picture in the .sig, believe it or not), the only 
thing that distinguished this email from email that I normally get 
was the fact that it was sent to lots of people, not just me.  A fact 
that could not be determined by any information provided in the 
message.

I received an abuse report.  It was a complaint that someone was 
spamming using my domain, and advertising a particular site. Also 
something that I get not infrequently.  The content was perfectly 
normal.  The key was that I received the same report at two 
completely unrelated email addresses.  It was in fact spam for the 
site listed in the abuse report.

Finally, one that came up at the MIT Spam Conference, and I'm sure 
many of us have seen.  You receive a request to participate in a 
private conference.  Sounds like a great opportunity to meet with 
peers working on similar things.  But if you realized that the same 
invitation was sent to 100,000 other people, your opinion of the idea 
very quickly changes.

I believe there are three components to identifying spam.

1. Routing information*
2. Content analysis
3. Bulk identification

Neither 1 nor 2 are completely sufficient without 3.  The fact that a 
message was sent to many people can significantly change its 
interpretation.

My personal belief is that #2 is a bad idea.  Content filtering is 
good when your goal is to filter content.  However it's a lousy way 
to identify spam, because you basically spend all your time trying to 
figure out what the spammers are selling, and trying to distinguish 
how they sell it, from how legit mailers sell it.  Right now this 
isn't as hard as it might be, because the two groups tend to sell 
different things.  But as the two converge, and as spammers continue 
to actively evade countermeasures, it will get harder and harder.

I prefer routing information because it's based on the assumption 
that spammers either a) have a safe-haven and can be blocked, or b) 
are trying to hide where they are coming from.  Detect the lies, and 
you know it's spam.  When you are looking for lies in the routing 
information you spend most of your time dealing with poorly 
configured legitimate mail servers.  It's much easier to deal with 
problems caused by mistakes than trying to deal with people who are 
actively trying to fool you.

* I don't mean a simplistic examination of the Received: headers 
here.  But this isn't the place to go into the details.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Keith Moore <[email-masked]>
Date: Thu, 6 Mar 2003 12:00:50 -0500

On Thu, 6 Mar 2003 10:46:38 -0500
Kee Hinckley <[email-masked]> wrote:

> >I also don't believe in treating one-to-many email differently than
> >one-to-one email, because it's the content of the email that the
> >recipient cares about rather than the number of recipients.
> 

your first two examples support my assertion - they are both based
on content (perhaps on subtlties of content) rather than volume.  as for
your third example (and I've received messages like this also) -
yes, the meaning of the message changes if I can determine whether
the message was sent to lots of people.  but I generally figure if I
have never heard of a conference, and I don't know any of the people
who are supposed to be hosting the conference, then they're probably not
being very selective in inviting me.

> Neither 1 nor 2 are completely sufficient without 3. 

I disagree.  I don't want to receive ads for nigerian money transfer
scams.  I don't care if I'm the only one receiving those ads.

> The fact that a message was sent to many people can significantly
> change its interpretation.

yes, sometimes.  but does the recipient have a right to know how many
people a message was sent to?

let's say I get a message from my boss (or someone higher in the food
chain) telling me that I got a raise (or a pay cut).  should I be able
to determine whether that same message was sent to lots of other people
- i.e. do I have a right to know whether I'm being singled out?

> are trying to hide where they are coming from. 

I think the lies are short-term.  Keeping spammers from lying about
who they are won't stop spam, it will only mean that different people
are spamming.

Keith

---

From: Troy Rollo <[email-masked]>
Date: Fri, 07 Mar 2003 07:46:26 +1100

>rather than the number of recipients.

There are some people that prima facie care about the content, but the 
problem, and what most people care about when you really get down to 
querying them about whether they would find particular spams acceptable, is 
the bulk. Content is just used as a differentiator for reasons of political 
expediency.
--
Troy Rollo				Chairman, CAUBE.AU
[email-masked]			Executive Director, iCAUCE

---

From: Fred Baker <[email-masked]>
Date: Thu, 06 Mar 2003 16:17:59 -0800

>The only one which can give consent for bulk-mail is the receipient,

Look through the header lines on this email, and tell me who is the sender 
and who is the recipient? My system (my PC) very likely never spoke with 
your PC. Rather, it traversed a number of SMTP sessions, going from relay 
to relay, such as (copied out of an email I sent earlier in the week and 
received back on this list):

        My PC -> mira-sjc5-b.cisco.com
              -> sj-core-2.cisco.com
              -> ietf.org
              -> www1.ietf.org
              -> proxy1.cisco.com
              -> sj-msg-av-3.cisco.com
              -> sj-core-2.cisco.com
              -> mira-sjc5-b.cisco.com
        and finally a POP session to my PC.

So to whom do I assert that I am only willing to receive <something>, or 
that I am not willing to receive <something>? And which system is "me"?

I think the relay servers at the IETF are the place where the spammer will 
send; one would like them to reject traffic <somehow> based on the traffic 
being inappropriate for the list. That is essentially what we do when we 
moderate traffic. My company also has servers that inspect the language in 
an email and classify some subset of it as commercial messages, presumably 
unsolicited, with a fairly low false positive rate. The rate is low enough 
that I have elected to tell my Mirapoint server to discard anything that 
SpamAssassin or whatever said process uses has decided is probably spam; 
I'd rather accept the false positives than deal with the trash. My PC, of 
course, has a list of filters that won't quit, partly for spam and partly 
for sorting messages into appropriate mail files.

Even spam that is directed to my personal email address goes through 
several steps. I got an email earlier today (from an airline that 
apparently has very compatible flight attendants) that was sent to

        laptop -> proxy1.cisco.com
               -> sj-msg-av-3.cisco.com
               -> sj-core-2.cisco.com
               -> mira-sjc5-b.cisco.com
        and finally a POP session to my PC.

So I don't think either end user talks with the other, and their direct 
agents (laptops) don't.

We need to sort out what kinds of policies might be applied in different 
places, and how much user control there is. It would be very nice to 
somehow automate the concept of a "moderator", and apply straightforward 
filters - no matter how compatible the flight attendants, I actually might 
have lived without that advertisement...

---

From: Troy Rollo <[email-masked]>
Date: Fri, 07 Mar 2003 13:17:20 +1100

At 04:17 PM 03/06/2003 -0800, Fred Baker wrote:

>        and finally a POP session to my PC.

The Received lines tell you nothing directly about who the sender and who 
is the recipient.

In the case of a mailing list, there are two transactions:

    1. First transaction -

       a. The sender is the person submitting a message to the mailing list.
       b. The recipient is the mailing list system.

    2. Second transaction -

       a. The sender is the mailing list system.
       b. Each person subscribed is a recipient.

The first transaction requires the consent (express, inferred or implied) 
of the operator of the mailing list.

The second transaction requires the consent of each subscriber - this 
consent was given by means of the subscription request.

The fact that a number of systems were involved in the middle has no 
bearing on the matter.

>So I don't think either end user talks with the other, and their direct 

This is only a problem if you insist on using some enhancement to SMTP to 
express consent. Since consent is something communicated by the recipient 
to the sender, for the reasons including those you indicate, enhancing SMTP 
is probably not a good way of expressing consent, at least on an individual 
level. Hence the BMTP and BMPP protocols designed by people from CAUCE and 
CAUBE.AU(*). Those protocols were designed specifically to deal with consent.

(*) To these you would add the SMTP banner specification if you were 
looking to review all of the protocol proposals made by CAUCE groups, but 
that specification only deals with expressing a refusal of consent at the 
domain level.
--
Troy Rollo			Chairmain, CAUBE.AU
[email-masked]		Executive Director, iCAUCE