Subject: Re: [Asrg] Proposal for Opt-Out

From: Kee Hinckley <[email-masked]>
Date: Thu, 27 Mar 2003 20:45:50 -0500

I'd like to back up a second here on opt-out.

I don't believe this group should recommend a global opt-out 
solution.  I believe that opt-out is 100% the wrong way to manage 
bulk mailings.  It is fundamentally flawed, and it will make the 
current spam situation far worse than it currently is.

First of all.  Look at the world as it is.  Who sends you bulk email?

1. People whom you told to send you email.
2. People to whom you gave your email address to (e.g. product 
registrations, online purchases) but didn't specifically tell them 
they could send you email.
3. Affiliates of #1 or #2.
4. People who bought your address from #1 or #2.
5. People who bought the assets of #1 or #2.
6. People who snarfed your address off the web or from another 
location which did not carry any implied consent for bulk email.
7. People who bought from #6.

This is how I think most people feel about each of those. I'm sure 
there's a range, and it's not like I've gone out and done a survey. 
But I think it's roughly like this.  Please don't get picky if your 
personal moral slider moves it in one direction or the other.

1. Fine if I can opt-out
2. Iffy, depending on content, but okay if I can opt-out
3. More iffy, but okay if I can a) stop the spread and b) opt-out
4. Probably crossing the line (no way to stop the spread)
5. Wrong, but the courts say it's okay, hopefully can opt-out
6. Wrong
7. Wrong

Now, let's consider an opt-out list.  Who will it impact?

1. No
2. No
3. Possibly, but probably not
4. Yes
5. Possibly
6. No (they'll ignore it)
7. No (they'll ignore it)

So.  An opt-out list will stop people who bought your list from 
someone you gave your email address to.  You don't *want* it to stop 
the people you explicitly gave permission to.  It might stop people 
who bought the assets of a defunct company.  It probably won't stop 
affiliates of a company (e.g. multiple catalog companies owned by a 
single entity) because they probably had fine print saying that you 
gave permission to all of them (that's certainly what they do now).

It will have zero impact on existing spammers.

That's the good news.  Here's the bad news.

A global opt-out list is a tacit statement that it's okay to spam 
random email addresses.  After all, if you didn't want email, you 
would have put your name on the list, right?  This is exactly the 
*wrong* way to go.  We do not want "100 million email address CDs" to 
become legitimate sales tools just because they were cleaned by the 
opt-out list.  You do *not* want every company in the country 
broadcasting email address to every address they can find.

"But," you say, "If you don't want that, just put your name on the 
opt-out list."

I assert that if we tacitly support opt-out, we will create a mail 
situation so bad that you won't be able to function unless you 
opt-out.  *Everyone* will want to opt out.  And what is the point of 
an opt-out system in which every person in the world is required to 
opt out?  Furthermore, as has been mentioned numerous times.  It's 
not just a question of email addresses, it's a question of domains 
and bounces as well.

Opt-out can work for phone numbers because there are a finite number 
of phone numbers.  There are *not* a finite number of email 
addresses.  It should not be mandatory that every time you reserve a 
domain you have to go and opt-out all possible email addresses in 
that domain.  That makes no sense whatsoever.

To sum it up.

1. Opt-out doesn't affect the majority of the people we are trying to stop.
2. Opt-out will make things worse.
3. There is no point in an opt-out system that everyone has to join.

Even if you don't believe #2, #1 and #3 still stand.  As do my points 
concerning domains and infinite email addresses.

I strongly believe that this group should make absolutely no 
recommendations for a global opt-out system.  I further believe that 
it should recommend that opt-out is, with regards to email, 
fundamentally flawed.

I believe that we could make positive recommendations for opt-in, but 
I want to keep that discussion separate from this one.  The point 
here is simple.  We should not recommend *any* opt-out system.

As an aside; other differences between email and phones.  Email 
addresses change more frequently, causing aging problems.  Many 
people manage more email addresses (sometimes *lots* more) than they 
do phone numbers, making managing opt outs (especially if they 
age-out) far more difficult.  Email addresses reach inside companies, 
where phone numbers often don't.  Phone opt-outs can be verified 
against an address to avoid do-gooders opt-ing out lots of people. 
Email addresses cannot be verified except via confirmation email--and 
that rules out wildcard, bouncing address and domain opt-out 
possibilities.  (I don't personally have a problem with someone 
writing a program that opts out everyone in the world--but I don't 
believe the marketing companies will accept an opt-out system that 
doesn't have verification or other barriers against excessive ease of 
use.)
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Brad Templeton <[email-masked]>
Date: Thu, 27 Mar 2003 18:46:32 -0800

Oh, I think many people feel opt-out systems won't be very effective.

I just presumed members of the group were no doubt free to draft
technical proposals on on such systems (and other unworkable or politically
unacceptable solutions) and seek input on them to prepare something for
the group.  At which point the group can reject it as unworkable.

Of course, if you know in advance that the group is not likely to judge
it as workable, you are probably wasting your time and should work on
something else.

As for opt-out systems, I will say this.  Some of the people pushing for
laws are pushing for laws that (though they may not realize it) call for
changes to protocols.   In fact, there have been several laws which have
respecified the format of the Subject line, demanding that it contain
"ADV:" (some jurisdictions) "Advert:" (some jurisdictions) and other such
tags, plus extra tags like "Adv+Adult:" and so on.

I doubt I have to convince anybody here that the government should not
be writing protocol changes into the law.  Especially incompatible ones.

What that does mean however is that if they insist on drafting laws, the
laws should say, "The appropriate standards body for the E-mail system in
question shall be asked to define a format extension to use to tag the
thing we are naming in this law, and this law shall compell obedience to
that protocol."

So we might be asked to come up with tagging and opt-out systems as
these are among the more popular laws.

I personally oppose them.  The evidence so far is that the current 25 spam
laws do nothing, and I hold no optimism for the success of future ones in
a global net, not on their own.  Plus most of them are unconstitutional
anyway, but that doesn't really matter since they have to work before you
even get to that debate.

However, we may need to be ready for them nonetheless.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked]
Date: Fri, 28 Mar 2003 05:52:16 -0800 (PST)

> someone you gave your email address to.  
Correct

> You don't *want* it to stop 
> the people you explicitly gave permission to.
Opt-out should be specific enough that you could blacklist entire category 
of commercial email but whitelist particular sender. So basicly even if 
you gave them your email to say notify of updates and they are instead 
trying to pitch you new product or service you could stop that depending 
how well opt-out is both technology and laws.

>  It might stop people 
> who bought the assets of a defunct company. 
Correct and I'v had real problems with these companies. It seems my email 
from excite.com was bought by about 100 other companies (it had very 
specific nic and address) and I'v been trying to find way to do global 
opt-out there and even went to court twice to force an issue and find a 
source who's selling my email. But still every week I blacklist at least 
one company that again got my email address and is trying to send me some 
ad (I suspect its all the same companies, whenver I blacklist them they 
begin to use different domain and different company name but it can all be 
the same entity that controls it - too many addresses are in Florida).

> It probably won't stop 
It'll stop it if opt-out is made specific to type of email.

> It will have zero impact on existing spammers.
Partial impact. By that I mean there are some spammers that try to appear 
to operate legally (they send from their own domain and have real address 
or po box, usually in florida), they do not try to sell you fraud or 
snake-oil but instead pitch vacations and credit card offers. These kind 
of spammers the opt-out should stop.

> random email addresses.
I hope I did not make it appear as if that is true!

> After all, if you didn't want email, you 
> opt-out list. 
Technology for opt-out should be good enough to prevent use of the email 
list by anybody but authorized bulk mailer. So spammers would not be able 
to verify your address either one way or another, other means should be 
used to stop those (i.e. technology to stop improper headers and after its 
possible to trace the spammers, legal means to outlaw their activity and 
get them out of business at the same time filters still to be used for 
small period of time when spammer is still able to send emails). Also 
proper laws should stop people like Al Ralsky who operate from US but have 
servers overseas. They should be considered commercial mailers and would 
either have to abide by opt-out laws and actually get your opt-in permission
before sending email or they should have civil/criminal penalties, for any 
email sent from company they control no matter from where the email was 
sent from.

> You do *not* want every company in the country 
I did not understand this.
 
> opt-out.  *Everyone* will want to opt out. 
I do not believe you're right. 

But a lot of people will opt-out and expect a lot less spam, while opt-out 
only help to get rid of unwanted commercial emails that are not generally 
spam. So that is why we need to find solution for real spam before 
starting to implement opt-out.

> And what is the point of 
I Agree.

> 2. Opt-out will make things worse.
I do not agree.

> 3. There is no point in an opt-out system that everyone has to join.
This point can be right or wrong depending on opt-out technology. In what 
I proposed it would be wrong.
 
> recommendations for a global opt-out system. 
If you look at the asrg charter, it specifically says
"Possible components of such a framework may include: 

Consent Expression Component: This involves recipients expressing a policy 
that gives consent or non-consent for certain types of communications"

So it seems we will have to make these "recomendations".

----
William Leibzon
Elan Communications Inc. 
[email-masked]

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 28 Mar 2003 12:08:00 -0500

>how well opt-out is both technology and laws.

That gets pretty complex and subjective.  Nice in concept though.

>I hope I did not make it appear as if that is true!

I don't see how it can be otherwise.  If I put my email address on my 
web site (e.g. [email-masked]), why won't they assume that it's 
okay to send anything to that address so long as it's not on an 
opt-out list?

>to verify your address either one way or another, other means should be

No verification necessary.  Just remove opted-out people from the CD 
and sell it.

>I did not understand this.

Umm. Yes, well it would help if I'd written it in a known language.

What I meant to say was, "You do *not* want every company in the 
country sending email to every address they can find that isn't on 
the opt-out list."

>So it seems we will have to make these "recomendations".

Absolutely.  I'm saying that we should recommend against opt-out as 
means of consent.  There are other, much simpler, ways to define 
consent.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: "Jon Kyme" <[email-masked]>
Date: Fri, 28 Mar 2003 21:54:55 +0000

> means of consent.  There are other, much simpler, ways to define 

I'm not sure that "simpler" is the right word. Some of the possible
applications of consent expression that have been mentioned in the group
include opt-out, configuration of up-stream filters and (I'd add) opt-in.

It's a key problem - I believe an explicit consent expression mechanism
would be a significant *enabling* technology.

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 28 Mar 2003 23:53:42 -0500

>would be a significant *enabling* technology.

The most popular consent mechanism right now is straight opt-in. 
That requires no additional technology, but has serious problems with 
proof (anyone can type a random email address on a web site, and 
anyone often does).

The most popular system mentioned in anti-spam circles is probably 
confirmed opt-in.  That also doesn't require any special technology, 
but I think could be greatly improved by specifying a set of 
conventions.

So let's try.  Here's a first quick pass.

User == person who has (in theory) requested email
Provider == person who will be sending mail

1. User provides email address via some mechanism (phone, web, email...)

2. Provider stores that email address along with documentation of the 
mechanism.  (E.g. date, address and mechanism).

3. Provider sends a brief message to the user stating the following 
(and only the following):
	- what they believe the user has consented too
	- documentation of the initial contact mechanism
	- an optional web address for confirming
	- a contact address (web/email and optionally phone) for complaints
The message is sent From:/Reply-To: a confirmation address.  The 
envelope From is set to a bounce handler.

4. If User does not not confirm by either replying (From/Reply-To) or 
clicking on the confirmation url within 30 days, the Provider does 
one of two things:
a. If this is the only contact from User, they *delete* the email 
address from their database.  (Not mark it as do-not send--but Delete 
it).  (Counter point--maybe they should track it to avoid abuse, in 
which case they'd need to store it (or a hash)).
b. If this is a request from an existing User, they mark that user as 
not wanting any further messages from this list.

5. If the user confirms that they do want the information, they store 
the confirmation.

Possible addition (which requires more software).  This relates to a 
proposal at the Spam Conference (by Praed I believe) that bulk mail 
should always provide a bonded contact where one can obtain proof of 
subscription.  (This is akin to erotica having to have archives 
proofing all models were of legal age.)

I wouldn't call this proposal something that requires "significant" 
technology.  Most of the pieces are already there.  Some list 
software already has the option of storing all confirmations.  What 
it primarily defines is a process.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Vernon Schryver <[email-masked]>
Date: Sat, 29 Mar 2003 00:01:10 -0700 (MST)

> From: Kee Hinckley <[email-masked]>

> ...
> clicking on the confirmation url....

Clicking on confirmation URLs turns out to be a bad idea.  Anything
that reveals the contents of the message can cause confirmation by bad
third parties, or plausibly deniable opt-out pretending to be opt-in.

For example, there is a robot that "clicks" on all URLs seen in
news.admin.net-abuse.sightings with a very few minutes after your NNTP
server transmits.  (If you run an HTTP server, you can check this with
the obvious test.  Except for the IP address, I don't know who or
why.)  A few days ago I received an unsolicited, probably bulk
"confirmation" to some "auction" mailing lists.  I censored at least
some of the confirmation URLs and reported it to NANAS to make a record
in case it was bulk.  A day later I received a "welcome" notice from
the lists and stuff started flowing.  Did I miss one of the URLs in
a perfectly innocent confirmation or was the "confirming" just a
pretense?  You tell me, because I don't know.

If you run a mailing list, there is no substitute for a message in
your logs with trustworthy Received headers pointing to the subscribing
address so that you can defend yourself from idiots crying "SPAM!" to
unsubscribe.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Sat, 29 Mar 2003 04:00:44 -0500

>Clicking on confirmation URLs turns out to be a bad idea.  Anything

Damned if you do, damned if you don't.  I agree that the email reply 
offers more proof.  But then again, I've seen one confirmed-opt-in 
system treated a *bounce* as confirmation (hey, the subject matched 
:-).  And then of course, there's Microsoft's vacation messages, 
which go to the wrong address.  And our challenge/response friend 
from yesterday would apparently have automatically confirmed any list 
anyone sent him a confirmation for.

Also, as has been pointed out to me offlist.  Average users have 
serious problems with the whole email confirmation process.  But 
given a URL you get a chance to hold their hand.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society