Subject: RE: 5c. Message Status - Re: [Asrg] ASRG work items

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 26 Mar 2003 12:55:45 -0800

This is why I like the definition of what we want to eliminate to be
'unwanted messages that are sent indiscriminately'.

The weasel word here being indiscriminately, there are a few messages that
could be sent indiscriminately that could be mostly wanted. For example on
9/11 someone could have sent a broadcast to all RIM pagers in the US with
emergency information, I doubt it would have been unwanted in many cases.

The word indiscriminate is of course subjective, just like the term spam.
However a salesperson that sends messages to 10,000 existing customers can
hardly be considered indiscriminate, nor is a salesperson who sends
targetted messages to 100 sales prospects, nor is a message with a CFP for
an anti-spam conference sent to this list.

However sending the message to every IETF list, or to 10,000 sales prospects
etc. is indiscriminate.

		Phill
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Chuq Von Rospach <[email-masked]>
Date: Wed, 26 Mar 2003 13:34:26 -0800

> an anti-spam conference sent to this list.

but I tend to go further: you can be discriminate here, but still not 
have consent.

This is a rewrite of something I just sent to Brad privately that might 
illuminate what I mean. To preface it, I'll note I think people abuse 
the word spam horribly, to the point where it almost has no meaning any 
more, so any attempt to "stop spam" is going to fail because nobody can 
agree how to define it.

going down the rabbit hole of defining this stuff, I make a hard 
delineation between:

1) spam, which in my mind are those idiots that send stuff fraudulently 
with forged return addresses and all that other stuff.

2) legitimate marketing stuff, where the real issue is a consent issue, 
not a fraud issue.

for (1), the root cause is the easy ability to forge spam and the 
difficulty of stopping people. Since I see this kind of crap as 90% of 
the overall problem (or more), finding ways to lock them out of the 
universe is my top priority.

2) where you have real companies doing stupid things, gets lumped in 
with 1, but is really a different problem, and has nothing to do with 
cheap costs or whatever. It has to do with marketing people who ought 
to be kneecapped for being more worried about how many messages got 
sent and not about how many sales were generated...

In both cases, volume is an accelerator to the process, not a cause.

I think the issues of "solving spam" and "dealing with e-marketing 
consent issues" are skew. One is shutting down fraudulent operations, 
the other is regulating legitimate businesses who's practices might or 
might not be up to snuff. But they tend to get lumped together, and 
that adds complexity to the the problem and confuses the issues, and we 
end up going round and round and accomplishing nothing.

They're separate issues, needing separate solutions. I realize there's 
a segment that thinks all e-marketing is by definition spam, but the 
moderate position understands it's not. And no, I'm not excusing badly 
build e-marketing systems, not at all. but the amount of hassle they 
cause is nothing compared to the spam that's fraudulently stuffed down 
out throats every day. And the solutions are different.

but IMHO, you could fix every freaking e-marketer to have perfect 
systems with perfect consent that updates based on telepathy two days 
before the end-user thinks of unsubscribing -- and the typical user 
wouldn't notice because of all the noise and pain caused by the fraud 
spammers. Worse, the e-marketing stuff keeps getting dumped onto the 
same bonfire by the "burn witches! more witches!" crowd, which 
basically derails the process from allowing anyone to focus on solving 
the first, major problem.

I'd like to suggest that we focus on the first, big problem: the group 
of mass mailers that are overtly avoiding allowing users to define 
consent through various fraudulent means. Until that issue is solved, 
nothing else matters. If folks want to start a sub-group to hash out 
issues of consent and try to work with the legitimate e-mailers to 
build a standard, great, but even if that gets resolved to everyone's 
satisfaction, it won't matter if we all wake up to 45 messages every 
morning with pretty pictures of zebras in them.

I keep thinking this group sidetracks itself by being unable to really 
define the problems it's trying to solve (instead, looking for *a* 
problem and defining *a* solution), and not setting priorities among 
them. In all honesty, if we could cut those 45 messages with zebras to 
20 messages with little bluu pills, this group would still be 
considered massive heroes, but there doesn't seem to be any interest or 
motivation towards fixing a chunk of the problem, and instead we turn 
around and chase our tails.

Don't think for a second I think this group's been useless, by the way. 
There are lots of useful things being done and lots of good mixing and 
sharing and considering. But I'm not seeing it moved to the next step, 
and the group itself seems to be somewhat passive about moving itself. 
And I think that's why the frustration level on the group is building, 
because we're tail chasing now, and nobody's defined which rabbit gets 
chased first...

And the reality is, there are a lot of rabbits and a lot of holes, and 
we need to be careful lest we step in a hole and break our ankle -- but 
right now, I feel like we're sitting in the kennel chasing each other.

---

From: [email-masked]
Date: Sat, 29 Mar 2003 20:56:13 -0500

On Wed, Mar 26, 2003 at 12:55:45PM -0800, Hallam-Baker, Phillip wrote

> For example on 9/11 someone could have sent a broadcast to all RIM
> pagers in the US with emergency information, I doubt it would have
> been unwanted in many cases.

  And what would it have accomplished that CNN couldn't ?  Asides from
tying up bandwidth which could've been used by people to let relatives
know they were safe ?

> hardly be considered indiscriminate,

  Except that some of them will quickly become ex-customers.

> nor is a salesperson who sends targetted messages to 100 sales prospects,

  Most participants in this group seem to be male.  Therefore, ads for
penis enlargement, meet-lonely-women, and viagra would definitely be
"targetted messages" by your criteria.

> nor is a message with a CFP for an anti-spam conference sent to
> this list.

  It would be on-topic for this group.

-- 
Walter Dnes <[email-masked]>
An infinite number of monkeys pounding away on keyboards will
eventually produce a report showing that Windows is more secure,
and has a lower TCO, than linux.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked]
Date: Sat, 29 Mar 2003 21:22:50 -0500

On Wed, Mar 26, 2003 at 01:34:26PM -0800, Chuq Von Rospach wrote

> 2) legitimate marketing stuff, where the real issue is a consent issue, 

  I don't consent to 1) and I don't consent to 2).  I do not see any
difference.

> might not be up to snuff. But they tend to get lumped together,

  Waddles like a duck, quacks like a duck, flies like a duck, it *IS* a
duck.  A pearl of wisdom from "The Rules of Spam"...
Sharp's Corollary: Spammers attempt to re-define "spamming" as that
which they do not do.

> out throats every day. And the solutions are different.

  The *ONLY* difference is that the people behind "legitimate marketing
stuff" make campaign contributions, and there's less liklihood of the
"legitimate" spam advertising stuff that's blatantly illegal.  Folks,
it's about *CONSENT* not *CONTENT*.

> Worse, the e-marketing stuff keeps getting dumped onto the same
> bonfire by the "burn witches! more witches!" crowd, which basically
> derails the process from allowing anyone to focus on solving the
> first, major problem.

  It's *ALL* non-consensual e-marketing.  Whether it's a guy in a suit
or a guy in sleazy spamhaus makes no difference.  Fraud-artists at Enron
are really no different from a career criminal kiting cheques.

---

From: [email-masked]
Date: Sat, 29 Mar 2003 19:16:51 -0800

>  I don't consent to 1) and I don't consent to 2).  I do not see any

Ah, but some people *do* consent to 2), and they would like to receive
the weekly cheez-wiz recipes that they've otped into.

>it's about *CONSENT* not *CONTENT*.

False.  The difference is that legitimate email marketers try pretty
hard to only send mail to people who want to receive it.  Just because
you don't want to know what's on sale over at piggly wiggly doesn't
mean that I don't.  In fact, I subscribe to somewhere between one and
two dozen separate email marketing streams right now.

Legitimate honest-to-goodness email marketers exist, and while they aren't
always perfect, they can do a pretty damned good job.  I can count on
one hand the number of unsolicited messages I've received from Digital
Impact in the last few years, for example, and I never got a single
piece from my former employer.  That's not just because I worked there...
none of their clients ever brought in a dirty list that I was on.
I consider that quite remarkable, since my various email addresses have
been well-publicized over the years.

An opt-in email marketer who tries very hard never to send unsolicited
email, and who responds promptly and correctly if there is an
occasional screw-up, is not a spammer.

I will grant you, however, that there's a decent-sized grey area in
between hot-teen-lolitas spammers and the best of the bunch.

-Patti

---

From: Brad Templeton <[email-masked]>
Date: Sat, 29 Mar 2003 20:33:02 -0800

> >it's about *CONSENT* not *CONTENT*.

This phrase may be the crux of one large division in the anti-spam
community.

There are a number of people who do believe it's about consent.  If
they simply meant "explicit consent", it would be something which could
be the subject of debate, but unfortunately when I have seen this used
it is always about a fairly unspecified sort of implicit consent, whose
definition varies from person to person.

Now, that alone would be reason to avoid trying to work in terms of
consent, but there is a much greater fundamental flaw with this concept.

One which will shock some anti-spam folks at first.

In free societies, you don't need advance consent to communicate with
somebody else.   Consent can be rescinded, as in "go away" but it is always
on by default.

And since, on the internet, there is _no_ communication without use of the
private property of the other party to the communication, it means you don't
need advance consent to use somebody else's property to communicate with
them.   We have declared many times we don't have a right to be annoyed, only
a right not be harassed.

To define communication without advance consent as some sort of offence
would turn our definitions of a free society and an open communications system
upside-down.   If somebody gave you a URL, you could not click on it without
knowing if the web host consented to you clicking on it.  If you got a referral
where I told you to e-mail my friend, you could not mail him for fear you did
not have his consent.   And If I want to mail you to flame you about how stupid
the opinion you posted on your web site is, well, who would suspect you give
your consent to be flamed?

In our society you can, by default, go up to somebody on the street and
talk to them.   That is sometimes annoying, but it's a right we actually
fight hard to protect.  You can send them postal mail, without their consent.
It is always assumed to exist in advance.   It can be rescinded -- through
restraining orders, harassment charges, blockages at the post office etc. but
it is always on by default.  People can even come onto your private land to
come to talk to you unless you explicitly mark it no trespassing.

So because consent would be incredibly difficult to define, and it's a bad idea
to bring it into the spam definition, I respectfully submit that other
courses should be followed.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Troy Rollo <[email-masked]>
Date: Sun, 30 Mar 2003 15:26:33 +1000

>somebody else.   Consent can be rescinded, as in "go away" but it is always

This is not entirely accurate. In common law jurisdictions, no amount of 
consent or withdrawal of consent can affect the right to communicate per 
se. If you are in public, somebody can yell at you all they like, subject 
to any statutes to the contrary (such as statutes establishing public order 
offences), and you can't do anything about it. On the other hand, if you 
are on your own land, and somebody is yelling at you in such a way that it 
interferes with your use of the land (complications arise here), then the 
person doing the yelling commits a nuisance, and if they refuse to stop you 
are legally entitled to slap them around until they do stop (of course I 
wouldn't recommend this approach because in an individual case you may be 
mistaken about the extent of their act and the extent of your right to abate).

>them.

Now here you come closer - when you use the private property of another you 
do need consent to use the property, but the consent is implied in the 
cases you appear to be worried about. Elsewhere, YMMV, for example in 
Scotland there appears to be no requirement for consent to merely use 
another person's chattels.

>upside-down.

Well yes, if you mean "all communication", but it's not an "all or nothing" 
rule. Implied consent as understood by the law deals very well with this. 
To determine what is covered by implied consent you look at:

         a. What is necessary for the function of society in
            the circumstances;
         b. What is accepted by society; and
         c. What can reasonably be inferred by the actions of
            the possessor of the property.

These are not necessarily exclusive factors. There may be other relevant 
factors in individual cases, but these factors cover most everyday 
situations, and the factors in individual cases will often be referable 
back to one or more of these. For example, in the case of email, the fact 
that SMTP as a protocol demonstrates a design centred on person to person 
messages and another protocol (NNTP) demonstrates a design centred on 
broadcast messages (even having substantially the same message format) 
would be a relevant factor for determining what is necessary, and what can 
be inferred.

For example, having an open shop front entails implied consent to enter for 
the purpose of shopping, but if you enter for the purpose of shoplifting, 
you enter as a trespasser. If you enter for the purpose of soliciting 
customers to your nearby competing shop, you also enter as a trespasser. 
The implied consent is not an unbounded consent to enter, but is a consent 
limited to the purpose that is in that case necessary, accepted, and 
reasonably inferred.

In the case of a private residence, there is implied consent to enter via a 
marked path to knock on the front door, but if you enter for the purposes 
of breaking in, or if the path goes past the main bedroom window and you 
enter for the purpose of peeping, then you trespass as soon as you set foot 
on the private land.

>    If somebody gave you a URL, you could not click on it without
>knowing if the web host consented to you clicking on it.

This is clearly within the scope of implied consent, because it is (a) 
necessary, (b) accepted, and (c) reasonably inferred by the actions in 
putting up a web site.

>If you got a referral where I told you to e-mail my friend, you could not 
>mail him for fear you did not have his consent.

Person to person email is clearly within the scope of implied consent and 
testing against the three criteria clearly indicates that this would be so.

>    And If I want to mail you to flame you about how stupid

This one is a little more difficult. Arguments on the "necessity" of this 
could go either way. It is probable that inference from conduct would go 
against, since most people don't like to be flamed. The acceptance test 
would suggest that society accepts the need to infer implied consent for 
flames, although this may vary depending on the free speech beliefs of the 
particular society.

I would come down on the side of personal flames being within the scope of 
implied consent, even though the recipient probably doesn't want them.

>come to talk to you unless you explicitly mark it no trespassing.

"No trespassing" is probably insufficient for this purpose. The sign would 
have to make it clear that implied consent is withdrawn, or withdrawn for a 
particular class. For example, "No hawking" clearly withdraws consent for 
door-to-door salespeople, but "No trespassing" per se is redundant, since 
if there is consent (even implied consent) there is no trespass.

>So because consent would be incredibly difficult to define, and it's a bad 
>idea to bring it into the spam definition

If you define spam as "unsolicited bulk", then it fails the necessity, 
acceptance and inference tests.

If you define spam as "unsolicited commercial" (such that an individual 
message is spam), then you are in a less certain area. All three criteria 
can be argued either way, and I suspect acceptance is diminishing over 
time. I would still come down on the side of "unsolicited commercial" but 
"personal" as being within the scope of implied consent.
--
Troy Rollo				Chairman, CAUBE.AU
[email-masked]			Executive Director, iCAUCE

---

From: Chuq Von Rospach <[email-masked]>
Date: Sat, 29 Mar 2003 22:59:13 -0800

mark me down for agreeing with every word Brad says here...

On Saturday, March 29, 2003, at 08:33  PM, Brad Templeton wrote:

---

From: "Jon Kyme" <[email-masked]>
Date: Sun, 30 Mar 2003 10:47:59 +0100

>somebody else. Consent can be rescinded, as in "go away" but it is always

Arrgh - freedom of speech! interesting field - look out for cowpats.

You may not need advance consent to attempt to initiate a communication.

A: "Knock, knock..."

But for the communication to proceed consent is required...

B: "Go away"

>them. We have declared many times we don't have a right to be annoyed,

That's a non sequitur. You might just as easily turn it around: Because you
don't have a right to
use someones private property without their consent, you don't have a right
to communicate with them.

I can't believe that there's anywhere where my right to "free speech" gives
me the right to stage a political demonstration in your kitchen.

This is not a profitable line of argument.

>idea

---

From: Brad Templeton <[email-masked]>
Date: Sun, 30 Mar 2003 11:39:50 -0800

>            the possessor of the property.

You make a number of good points, so let me drop to the other problem
I pointed out with consent issues, which is the difficult technical
challenge of finding a way to figure out consent when we have all sorts
of vague definitions of implied consent, and so many different preferences
among individuals as to what consents they wish to give.

Even in this group we have seen many people express different views over
what they think is spam, vs. mail they think they have implicitly consented
to receive.   Just this week we've debated the suggestion that if you post
to a mailing list you consent to replies to your messages from others, but
not to automatic replies from broken bots, and possibly not to off-topic
replies -- for example most would say that posting here doesn't allow me to
reply to them to offer them cheap blue sex pills.

I see it as intractable to define a mechanism for definition of advance
consent.   As in, "I don't know who you are or what your message is about but
I rescind consent in advance if it meets criteria X."   If we could come up
with a language that workably described all the "X" people are interested
in which could also be handled well by people mailing material that might
meet criteria X, that would be interesting but I don't hold much hope for
such a language.

> broadcast messages (even having substantially the same message format) 

Unfortunately bulk mail has a long history, predating even newsgroups by
many years.  I have gone down this course before, but I can't escape the
conclusion that bulk mail is considered one of the legitimate uses of
mail.  How can we as we discuss it on a mailing list?  However, it is definitely
secondary.
> necessary, (b) accepted, and (c) reasonably inferred by the actions in 

Unfortunately it is not so "clear" as there are many court cases about this,
about issues such as deep linking, inlining and spidering in various forms.
People want to give consent to some (google) but not to others (shopping bots
or deep linkers) and so on.

If only this were clear.
> testing against the three criteria clearly indicates that this would be so.

I thinks so but again, I have seen many in the anti-spam community offer
extreme definitions which include person to person mail.  CAUCE, a fairly
major organization in the anti-spam community, has pushed its lobbying
efforts around single e-mails from the start, and so have many others.

It is alas, not clear.

> flames, although this may vary depending on the free speech beliefs of the 

I think you aptly demonstrate the technological impossiblity of making a
protocol based way to define advance consent.   

Rescinded consent is of course much easer (and implementable at the endpoint)
A blacklist is rescinded consent -- if only blacklists didn't have all their
other problems.
> if there is consent (even implied consent) there is no trespass.

These signs rely on being in human natural languages.  So people have a wide
scope on what they can put on the sign, and it is handled by another natural
intelligence.   No such luck in SMTP.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked]
Date: Sun, 30 Mar 2003 22:36:23 -0500

On Sat, Mar 29, 2003 at 07:16:51PM -0800, [email-masked] wrote
> the weekly cheez-wiz recipes that they've otped into.

  That's the "human-shield effect" that some e-marketers rely on.
Outfits like PennMedia/Shagmail and Topica send newsletters/whatever to
known unconfirmed lists.  Like you said, there are some people who do
subscribe to them, but others who don't want the stuff still end up
getting it.  The sending outfits rely on the fact that the few willing
subscribers will complain if their ISPs blocking them outright.  When you
get *THE SAME CONTENT FROM THE SAME IP ADDRESS* being sent to both willing
and unwilling recipients, it becomes more difficult to block.  This tends
to happen most often with "advertiser-supported" newsletters, where the
number of "subscribers" determines how much the mailing company gets
paid by advertisers.

> two dozen separate email marketing streams right now.

  And I'm sure that you're not interested in a mailing list on the CRUX
distro of linux, plus various other stuff that I subscribe to.  I *OPTED
IN* to those lists, versus havimg to *OPT OUT* of a gazillion others.
And if e-marketers adopted *OPT-IN*, we wouldn't have today's problems.

> Legitimate honest-to-goodness email marketers exist, and while they
> aren't always perfect, they can do a pretty damned good job.

  Unfortunately, they're damn hard to find.  Companies that have a real
product to sell, and do things in-house, tend to be better.  The hired
guns, who get lists of target addresses from customers, aren't in a
position to verify the lists.

> I can count on one hand the number of unsolicited messages I've
> received from Digital Impact in the last few years, for example,

  Does that include all the following aliases?

 merchantmail.net
 m0.net
 digital-impact.com
 digitalimpact.com
 digitalimpact.net
 merchantmail.com
 emailexchange.net
 emarketingscience.com
 responsiblemail.com
 mm3.net
 mm4.net
 mm5.net
 mm6.net
 mm7.net
 mm8.net
 mm9.net

  Now why would they send out their stuff under an assumed name, or
several assumed names?  People are known by the company they keep.
Digital Impact is a member of the ESP ("Email Service Providers")
coalition.  Who are these people?  According to their press release
at http://www.networkadvertising.org/NAIESPRelease.pdf

> Current membership in the ESP Coalition includes all of the major
> companies in the email service provider industry: Digital Impact,
> DoubleClick, Experian, iMakeNews, Aptimus, Avenue A, BlueHornet
> Networks, Britemoon, Cheetahmail, Clickaction, eDialog, Eversave,
> ExactTarget, GotMarketing, MindShare Design, Roving Software, Topica,
> Virtumundo, and Yesmail.

  This is an honour roll of past residents of MAPS RBL, some of whom
have used their money and their lawyers to sue their way out of the RBL.
Not exactly a glowing recommendation.

> occasional screw-up, is not a spammer.

  The problem is that there are tons of opt-out marketers who claim to
be opt-in.  Here is a scenario that has been repeated too many times in
NANAE (news.admin.net-abuse.email)...
CR = Company Representative
NI = NANAE inhabitants

  Company rep comes to NANAE

CR> Wahhhh, wahhh, we've been blacklisted.  Why ?

NI> Because you spam.

Begin loop (repeats several times)

  CR> No we don't.

  NI> Yes you do.

End loop

CR> But, but, but, we're double-opt-in, blah, blah, blah

NI> (A NANAE inhabitant, who happens to be a sysadmin, trots out logs of
    repeated attempts over the years by the company to deliver email ads
    to postmaster@, abuse@, domain admin contact, and a slew of
    non-existant addresses)
    Explain that.

CR> (Comes back a couple of days later) But, but, but, our customer that
    we emailed those out for *SAID* those were double-opt-in addresses

NI> And the National Enquirer says...

CR> (Comes back a couple of days later) But, but, but, the guy who sold
    our customer the list of addresses *SAID* they were double-opt-in

NI> And the National Enquirer says...

  If I sound cynical, yes I am.  I've seen this finger-pointing garbage
as often as a teacher hears "the dog ate my homework".  And I'm just as
likely to believe it.  E-marketers' reputations are badly damaged, and
they will *NOT* get the benefit of the doubt.

> between hot-teen-lolitas spammers and the best of the bunch.

  One more time... it's about *CONSENT*, not *CONTENT*.  I don't care
what the unwanted garbage in my inbox is.

---

From: wayne <[email-masked]>
Date: 30 Mar 2003 23:51:29 -0600

In <[email-masked]> Brad Templeton <[email-masked]> writes:

> There are a number of people who do believe it's about consent.  [... ]
> 

I don't know many people who define spam as mearly "unsolicited
email".  They usually add things like "bulk" or "commercial" to the
requirements.

> fight hard to protect.

There are restrictions on how you can "talk" to people.  You can't
talk in an intimidating way.  You can't use a megaphone.  Political
speech has far more protections than commercial speech.  You can't
yell "fire" in a crowded theater.

The nature of email is that it is extremely cheap to send.  In order
to preserve the usefulness of email, people can only receive a certain
number of emails per day and that means there has to be some
prioritizing.

Even if there is a legal right to send UBE and/or UCE, people are
still going to try hard to filter it out.  They have to.  There are
just so many minutes in the day.

-wayne