Subject: [Asrg] Giving Public Notice ....

From: Art Pollard <[email-masked]>
Date: Mon, 17 Mar 2003 12:06:10 -0700

One thing that would probably go a long way for many of the state anti-spam 
laws would be a way that one could give public notice that the people at a 
company / organization / ISP do or do not want spam.  The use of the file 
as a "public notice" file would go a long way towards allowing people to 
collect via the courts.

Of course, we all know the answer to whether they do or not.  However, 
there currently exists no method for a company to say that they do or do 
not want spam for a certain set or subset of users.

What I would like to see is something akin to the robots.txt that is 
available on every website.  The spammer could be required (perhaps by law) 
to download this file and to use it to check against the addresses in their 
mailing list.

To hide the user's identity, the e-mail addresses could be hashed to say an 
8 byte hash value.  This way the list could be checked against the e-mail 
addresses in the spammer's mailing list without divulging any one address.

Furthermore, there could be a price specified per e-mail that is sent to 
that address.    For example, the following could be a line from the file:

0x4348C54233AB4D9C,n,$25U.S.,$500U.S., <Keywords>

0x4348C54233AB4D9C: Hash of the e-mail address
n -- This person does not want unsolicited e-mail.
$25U.S If spam is sent that is relevant (in the opinion of the reader) to 
their job, the spam will be assessed at a price of: $25 U.S.
$500U.S If the spam is sent and it is _not_ relevant (in the opinion of the 
recipient) to their job then the price of $500 U.S. is assessed.
<Keywords>Keywords and phrases of things that the user is interested in 
receiving e-mail regarding. (For most, this would simply be left empty.)

If there were a standard way to give public notice that spam is or is not 
wanted at a specific address, it makes it much easier to go to the courts 
and make the claim that you gave public notice that you would collect for 
all e-mail sent to a given address.

-Art

-- 
Art Pollard
http://www.lextek.com/
Suppliers of High Performance Text Retrieval Engines.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Hadmut Danisch <[email-masked]>
Date: Mon, 17 Mar 2003 11:25:03 -0800

On Mon, Mar 17, 2003 at 12:06:10PM -0700, Art Pollard wrote:
> company / organization / ISP do or do not want spam.

This is only good if such a flag contains some entropy, 
i.e. there are some flags set to "I want" and some to "I don't want".

Do you really believe that anyone would set the flag to 
"I want spam"?

And I really don't believe that a significant number of spam
senders will care about such a flag.

Hadmut

---

From: John Morris <[email-masked]>
Date: Mon, 17 Mar 2003 11:52:04 -0800

At 11:25 AM 3/17/03 -0800, Hadmut Danisch wrote:
><snip>

But that truth does not necessarily negate the value of such a notice 
system.  Look at the telephone "do not call" list situation in the U.S.  A 
bunch of states (and now the federal FTC) have developed or are developing 
"do not call" lists -- usually self developed and not interoperable.  If 
there were a pre-existing sound and secure system for opting out of phone 
calls, states could have simply referenced that method (as they have in 
fact have done with the DMS opt out list, which many feel is lacking).

If the Internet community develops a scalable, secure public notice method, 
it could end up being the method (or a method) adopted by governments that 
choose to legislate against spam.  And even in the absence of legislation, 
a clear notice in a standardized format and place can greatly help private 
legal actions.

So the fact that (a) spammers would not care about such a system, and (b) 
in year two of implementation such a system might in fact have little 
impact on spam, does not mean the proposal lacks value.

John Morris

---

From: Jason Hihn <[email-masked]>
Date: Mon, 17 Mar 2003 15:02:49 -0500

Lol. This seems damn simple and right under our noses!
What about re-drafting 'finger' for this use?
It sounds something like a .plan file...

However I don't understand how/why you can hide their address. Besides
what's the point if they are already querying for you (they know it
already)?

And it seems to me that you'd want to be able to prove that indeed you asked
NOT to be sent mail, and obfuscating your address would run counter to that.
(IANAL, but it legally it looks like you're engaging in questionable
conduct)

-J
> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of Art
> Pollard
> Sent: Monday, March 17, 2003 2:06 PM
> To: [email-masked]
> Subject: [Asrg] Giving Public Notice ....
>
>
>

---

From: Hadmut Danisch <[email-masked]>
Date: Mon, 17 Mar 2003 12:45:32 -0800

On Mon, Mar 17, 2003 at 11:52:04AM -0800, John Morris wrote:
> "do not call" lists -- usually self developed and not interoperable.

Since I live in Europe, I'm not familiar with that "do not call"
list. However, what works with phone calls doesn't work with spam.

Calling someone by phone causes real costs, because of the phone
costs, the employee, and the time. For an advertising phone caller
it is an advantage to have such a list which allows him to save
that money he would have spent to call someone who'd just say 
"get off". And phone callers usually have to take care of the
companies public credit. How often did you get an annoying phone
call asking you to visit a porn website? And phone callers usually
call from within the same country, i.e. from within the same
legislation.

In contrast, a spammer doesn't have any advantage in paying attention 
to such a list. Checking such a list is more expensive than just 
drop and forget an email. 

Hadmut

---

From: Jason Hihn <[email-masked]>
Date: Mon, 17 Mar 2003 15:48:30 -0500

Agreed.

Though he does have a 'good' idea. Could we send across the wire and
agreement to pay the recipient $50,000 if the message is unsolicited.

Specifically, I am thinking after the RCPT-TO: you could post
"RECEIVER allows this message to be delivered under the following
conditions:
1) This message is not unsolicited; as the sender and receiver have a
verifiable pre-existing relationship or receiver has expressed interest in
starting a relationship
or
2) This message is unsolicited and will be accompanied by payment of $50,000
US within 14 days."

out over the SMTP socket. I don't know what this would break though. IANAL,
but I'd like to think it was binding. I think the problem though would be
who would it be binding to? The remote outgoing network (AOL-TW in the
advent of it coming from an aol server?) or the sender? Either way it's
good, but I like it if the network (AOL) is liable. It'll make them make
sure no spam leaves their domain.

Technically it's useless, and will do nothing to stop the flow of spam, but
I could help grow my bank account! Just a thought...

> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> Hadmut Danisch
> Sent: Monday, March 17, 2003 2:25 PM
> To: Art Pollard
> Cc: [email-masked]
> Subject: Re: [Asrg] Giving Public Notice ....
>
>

---

From: "Chris Lewis" <[email-masked]>
Date: Mon, 17 Mar 2003 15:59:33 -0500

Art Pollard wrote:
> 
> One thing that would probably go a long way for many of the state 
> anti-spam laws would be a way that one could give public notice that the 
> people at a company / organization / ISP do or do not want spam.  The 
> use of the file as a "public notice" file would go a long way towards 
> allowing people to collect via the courts.

Please examine Paul Hoffman and John Levine's SMTP banner proposal which 
does exactly what you want.  Trivial to implement.  Our mail servers are 
already doing it.

Search for John's messages here.  He described the whole thing in a very 
recent message to ASRG.

---

From: [email-masked]
Date: Mon, 17 Mar 2003 16:00:20 -0500

> sure no spam leaves their domain.

I'm not sure you could possibly make it binding - the only thing that usually
looks at SMTP replies are SMTP client software.  So unless you create an RFC
describing the format so it can be *parsed* by software, it's the ones-and-zeros
equivalent of urinating into the wind.

Backward compatibility becomes an issue - what happens if the sender's SMTP
doesn't have support for the extension and the parsing it involves?

And given that the spam probably came in through an open proxy server, it's
basically a lost cause - if the proxy site couldn't afford to hire a sysadmin
with enough clue to close the proxy, they're probably effectively judgment proof.
Kinda like suing somebody for $3M when they live in a tar paper shack and can't
afford a telephone or running water.

I suppose if you made it like a click-through EULA, it would be OK.. except
for the minor detail that almost all our outbound mail is gatewayed through
a machine that won't be able to click.... ;)

---

From: Jason Hihn <[email-masked]>
Date: Mon, 17 Mar 2003 16:22:12 -0500

My points exactly! It would be cool and could be made to work, but in the
end, it's futile/pointless/a lost cause.

> From: [email-masked] [mailto:[email-masked]]
> Sent: Monday, March 17, 2003 4:00 PM
> To: Jason Hihn
> Cc: [email-masked]

---

From: [email-masked]
Date: Mon, 17 Mar 2003 16:39:12 -0500

> end, it's futile/pointless/a lost cause.

I didn't say it was a lost cause.. ;)

I pointed out that there were problems - many of which are fixable.

For instance, *IF* you have a technically workable SMTP extension, you could
then conceivably codify that "a UCE sender must check the extension and pay
any indemnification as a result".

The nice thing there is that if you don't send any UCE, you can just ignore
the extension and nothing changes. ;)

Yes, this does require some coding, some RFCs, and some legal tapdancing
similar to what's already in 17 USC 512 for an ISP safe-harbor, so if one
of our users does something stupid and relays it through our server, it's
their problem not mine.  But not anything fundamentally  not fixable.

---

From: Jason Hihn <[email-masked]>
Date: Mon, 17 Mar 2003 17:04:43 -0500

Well, I prefer tech to legal-ese.. It's just my nature. I don't doubt that
you could make things scary and binding enough (legally speaking), but I
want it backed up with technical measures. I want sender tracability incase
they do send spam anyway. Then you get in a whole  new can of worms working
out ways on how you can verify the sender is legit and traceable. Then you
have to be able to make that determination in real-time while you still have
them on a socket, before you accept the message.

Otherwise I'll lie about who I am, and that my message is not spam. Or I'll
agree to the $50,000 spam fee and poof! disappear.

Those are the measures whose defense must be built in as well.

Remember: "Locks only keep honest people honest." Most spammers are not
honest. I doubt Amber is horny for me, wants me to see her naked, or even
that she knows who I am. I bet it's really Frank, who looks like the
uni-bomber that's really typing that in and inviting me over!

Until we eliminate (much less discover) the ways around it, we only create
more work for everyone.

> Sent: Monday, March 17, 2003 4:39 PM
> To: Jason Hihn
> Cc: [email-masked]

---

From: [email-masked]
Date: Mon, 17 Mar 2003 17:13:39 -0500

> them on a socket, before you accept the message.

The guys at cluelessmailers estimated that some 90% of the problem is the
result of only 100 to 150 people.  Now if we took up a collection of $500 from
every ISP that has a inbound spam problem, and hired a few "enforcers" from
any one of several ethnically-based entrepreneur organizations that work somewhat
outside conventional legality, and had them "explain our position" to the
offenders, I'd not be surprised if a lot of spammers took the hint

Or we could just hire a few RIAA lawyers - *THEY* don't seem to have *ANY*
trouble in tracking down miscreants....

Some days, I can't tell which of the two solutions is which... ;)

---

From: "John Rumpelein" <[email-masked]>
Date: Mon, 17 Mar 2003 14:36:44 -0800

> "RECEIVER allows this message to be delivered under the following

I'm no lawyer, but it is hard to understand how a message which no human
will ever see could be considered binding on the people who operate the
company.

-J

---

From: Hadmut Danisch <[email-masked]>
Date: Mon, 17 Mar 2003 14:51:28 -0800

> will ever see could be considered binding on the people who operate the

Even if it did, of what use could it be? Do you want to 
sue every single sender of spam? How do you sue the sender if
you don't know his identity? How do you sue a spammer
sending from a random country?

In which language would you like to post the message? What if 
the spammer claims to not understand english? 

What should I post? German? English? Turkish? 

If I receive spam from US, which law should apply on the agreement?
German law? US law? 

Hadmut

---

From: mathew <[email-masked]>
Date: Mon, 17 Mar 2003 18:56:00 -0500

On Monday, Mar 17, 2003, at 17:13 US/Eastern, [email-masked] 
wrote:
> trouble in tracking down miscreants...

Funny you should mention that. Just this morning I got spam from some 
guy selling CD recordings of obscure music recorded from rare vinyl LPs 
and other sources. He had his name and address right in the e-mail.

I forwarded it to the RIAA piracy hotline.

I feel dirty... but it feels so good...

mathew

---

From: John Morris <[email-masked]>
Date: Mon, 17 Mar 2003 16:12:11 -0800

>If I receive spam from US, which law should apply on the agreement?

Let's step back and recognize that there are at least two possible distinct 
technology research and design goals:

1.  Create technology that, by itself and independent of any legal norm or 
law, is (a) effective in stopping spam, (b) scalable, and (c) likely 
actually to get widely deployed.

2.  Create technology that can be used in conjunction with existing or 
proposed legal norms or laws to reduce or stop spam.

Obviously it would be wonderful if this RG can accomplish goal 1, and I 
assume there will be lots of effort toward that goal.  But I for one think 
that a robust solution to spam will likely require existing or new laws, 
and so I think there is value in considering goal 2 as well, even if the 
technology itself would not be self-enforcing.

John

---

From: Hadmut Danisch <[email-masked]>
Date: Mon, 17 Mar 2003 20:29:16 -0800

Another question:

In most legislations, you can conclude a legally binding 
contract only after you reached full age. 

Such a solution (w|c)ould not cover spam sent from youngsters.

Hadmut

---

From: "Jon Kyme" <[email-masked]>
Date: Tue, 18 Mar 2003 08:55:13 +0000

> anti-spam

Strangely, I get occasional complaints from my users saying things like
"Why aren't you sending me free offers etc."

Also, end users may not trust the classification (spam/not spam) made at
some upstream point and therefore may choose to publish a "wide-open"
consent.

> senders will care about such a flag.

No, probably not, but the suggestion was that this would support
legislation, which seems reasonable.

---

From: "Chris Lewis" <[email-masked]>
Date: Tue, 18 Mar 2003 11:28:55 -0500

> contract only after you reached full age. 

In many jurisdictions, the parents of the child become legally liable 
for contracts made by the child (where the type of contract is 
explicitly permitted for children, or the other party acted in good faith).

> Such a solution (w|c)ould not cover spam sent from youngsters.

You cannot make anywhere near this strong a blanket statement.

---

From: [email-masked] (John R. Levine)
Date: 18 Mar 2003 11:27:23 -0500

>as a "public notice" file would go a long way towards allowing people to 

Yes indeed.  Didn't anyone read the message about NO UCE banners that
I posted here a couple of days ago?  They're already well defined and
at least two states have put them or are thinking about putting them
into anti-spam laws.

---

From: Hadmut Danisch <[email-masked]>
Date: Tue, 18 Mar 2003 09:41:51 -0800

> explicitly permitted for children, or the other party acted in good

No. At least in Germany (and as far as I am informed in most
european countries) a contract made by children is just 
not valid (unless explicitely confirmed by parents or by
a judge). Parents cannot be liable for a non-valid contract.

Parents can be held liable for any harm caused by children,
but that's a completely different thing.

> You cannot make anywhere near this strong a blanket statement.

Sure I can. 

In Germany, children under age of 14 cannot be prosecuted. 
Some of them commit crime in knowledge of their immunity.
This could be abused for sending spam. There are hackers
under the age of 14, so why shouldn't there be spammers as well?

Hadmut

---

From: "Chris Lewis" <[email-masked]>
Date: Tue, 18 Mar 2003 13:06:33 -0500

> In Germany, children under age of 14 cannot be prosecuted.

That's Germany.  The law in the US and Canada is different.  Different 
age limits, different caveats and exceptions.  Like I said, you can't 
make that strong a blanket statement.

As for "prosecution".  Well, certainly, a 4 year old can't be 
"prosecuted for murder" either, but they could certainly be put in state 
care or otherwise stopped from doing it again.  [I won't go into the 
minimum age for capital punishment in the US other than to say it's been 
less than 14.]

Ie: what if a child of 8 years old was "caught" spamming pornography 
ads?  Don't suggest that the law has no recourse - the child may well be 
taken into custody by "Children's Aid"/"Foster care" (or local 
equivalent), or the courts may refuse to accept the child is doing it on 
their own, and promptly charge the person who talked the child into 
doing it.

You can't use "the computer did it, not me" as a defence.  You can't use 
"the 14 month old pushed the enter key" defence either.

---

From: Hadmut Danisch <[email-masked]>
Date: Tue, 18 Mar 2003 10:24:20 -0800

On Tue, Mar 18, 2003 at 01:06:33PM -0500, Chris Lewis wrote:
> 
> That's Germany.  The law in the US and Canada is different.

I know. Are we searching for solutions that work in USA and
Canada, or for solutions that work anywhere?

> their own, and promptly charge the person who talked the child into 

The porn example is a little bit harsh. Let's take an example a 
little bit closer to reality. Have a 13 year old boy sending tons 
of spam complaining about his teachers, ads for some shop or whatever.

That child would definitely not taken into any custody, since the
german constitution protects the family. This would be a severe
violation of the child's constitutional rights. And it would be 
disproportional, which also violates german constitution.

I am aware that such things are handled differently in the US.
In european eyes it is absolutely ridiculous how US laws/courts
treat children and youngsters. But that's far off-topic. 

We should be aware that we cannot use anti-spam methods that
depend on the US law or the US way of interpreting human rights.
Anti-Spam methods must work everywhere on the world. So try
to not limit your view on the USA.

Hadmut

---

From: "Chris Lewis" <[email-masked]>
Date: Tue, 18 Mar 2003 14:29:32 -0500

> Canada, or for solutions that work anywhere?

Legislative solutions, as are contracts, are of necessity national 
rather than international in scope. However, that doesn't mean that 
legislative solutions are useless or impossible.  Indeed, a US-centric 
law enacted in the US would be of considerable use because the vast 
majority of spam is US-originated. They can also form a model for other 
countries to adapt or adopt.

> disproportional, which also violates german constitution.

I don't think you understand your own laws that well.  German law 
wouldn't just pat the child on the head, and leave them free to repeat 
committing an offense.  The german laws simply make it clear that young 
offenders aren't treated the same way as adults.  Ditto our Young 
Offenders Act.

A child that say, breaks a neighbor's windows may get off the first time 
with a warning and confiscation of "proceeds" instead of being fined or 
incarcerated.  But repeats _will_ result in different reactions, such as 
holding the parents liable for restitution, mandatory counselling, and 
up to taking custody of the child and putting them under foster care.

[At this level, perhaps the primary difference between US law and many 
others is simply that the child will often not get away with the "first 
time", and the age thresholds are lower.]

The German constitution, as does ours, "protects the child". 
"Protecting the child" doesn't mean that the child gets to do anything 
they want to as often as they want.  It just means that the state uses 
gentler persuasion than immediate punitive measures.  Repeated 
violations of the law, or fraud, or harrassment or whatever _do_ get 
handled - through forcing parental responsibility or other things, as it 
becomes necessary.  _That_ is protecting the child - trying to guide 
them away from the bad, and towards the good.  But if that doesn't work, 
the state still has other remedies.

> treat children and youngsters. But that's far off-topic.

Yes it is.  But you're making a big mistake...

> to not limit your view on the USA.

What makes you think my view is US-oriented?  Hint: I'm not American and 
I'm not in the USA.  The YOA is not a US law. The YOA is considered one 
of the most progressive laws on this subject in the world.