Subject: [Asrg] 6. Proposals - Legal - US Congress to vote on federal anti-spam bill

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 21 Nov 2003 14:22:28 -0500

See the following article:

http://news.com.com/2100-1024_3-5110622.html

----------------------
"Congress has reached an agreement on antispam legislation and could 
vote on it as early as Friday afternoon, a move that would end more than 
six years of failed attempts to enact a federal law restricting 
unsolicited commercial e-mail."

"The broad outline of the legislation, however, shows that it is a 
modest compromise and not as far-reaching as some antispam advocates had 
urged. It establishes a "do not spam" registry to be run by the Federal 
Trade Commission, makes it a crime punishable by up to five years in 
prison to send fraudulent spam, and imposes an "opt out" standard 
instead of a more stringent "opt in" requirement. Unsolicited bulk 
e-mail from nonprofit groups, politicians, and charities would not be 
regulated.

Still unclear is whether the bill would pre-empt more restrictive state 
laws such as one enacted in September by California. That law 
establishes an opt-in standard and is scheduled to take effect on Jan. 1."
----------------------

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Denny Figuerres" <[email-masked]>
Date: Sat, 22 Nov 2003 13:53:04 -0500

Funny.... This goes back to some of my first comments on this list....

IMHO laws to stop/reduce/lessen SPAM without *Accountablity* and the removal
of *forged* email headers is like trying to use a paper towel as an
umbrella.... It may for for a short time but in the end is *DOOMED*

I would urge anyone who speaks to or communicates with the legal side to get
them to see that spam is mostly a "Side effect" of an email system that
allows email headers to be fake.

Can anyone tell me what good a US law will be in stoping a SPAM sender who
is say in sweeden that sends fake headers to a mail server in korea and then
to a mail server in say russia and then to the usa?
If the email can not be traced back to the sender ..... And crosses 2 or
more international borders in the process then who do you go after? At what
cost? In which contry? Based on who's legal system? 

This is one of the reasons why I originaly mentioned a model somewhat like
international mail.

Unless we have some form of UN/Global legaly sactioned body the spamers will
just keep sending us more junk but now with new disclaimers about how they
are complying with the law based on ......

To quote an old Issac Asimov book title: "Against stupidity, the gods
themselves contend in vain." 
Or another way: "Against SPAM, the congressmen themselves contend in vain." 

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Yakov Shafranovich
> Sent: Friday, November 21, 2003 2:22 PM
> To: ASRG
> Subject: [Asrg] 6. Proposals - Legal - US Congress to vote on 
> federal anti-spam bill
> 
> "Congress has reached an agreement on antispam legislation 
> and could vote on it as early as Friday afternoon, a move 
> that would end more than six years of failed attempts to 
> enact a federal law restricting unsolicited commercial e-mail."
> 
> "The broad outline of the legislation, however, shows that it 
> is a modest compromise and not as far-reaching as some 
> antispam advocates had urged. It establishes a "do not spam" 
> registry to be run by the Federal Trade Commission, makes it 
> a crime punishable by up to five years in prison to send 
> fraudulent spam, and imposes an "opt out" standard instead of 
> a more stringent "opt in" requirement. Unsolicited bulk 
> e-mail from nonprofit groups, politicians, and charities 
> would not be regulated.
> 
> Still unclear is whether the bill would pre-empt more 
> restrictive state laws such as one enacted in September by 
> California. That law establishes an opt-in standard and is 
> scheduled to take effect on Jan. 1."
> ----------------------
> 
> 
>

---

From: "Jon Kyme" <[email-masked]>
Date: Sat, 22 Nov 2003 20:27:55 +0000

> cost? In which contry? Based on who's legal system? 

I don't know about you Danny, but most of the spam I receive advertises
products or services from the USA. Most of it *seems* to originate in the
USA. I can't believe that it's beyond the wit of man to track down and
prosecute the criminals (as they'll be) in these cases. Rokso
( http://www.spamhaus.org/rokso/ ) seem to do fairly well.

> themselves contend in vain." 

That's Schiller, I think. Asimov was quoting.

--

---

From: "Denny Figuerres" <[email-masked]>
Date: Sun, 23 Nov 2003 21:25:36 -0500

> From: Jon Kyme [mailto:[email-masked]] 
> Sent: Saturday, November 22, 2003 3:28 PM
> To: [email-masked]
> Cc: ASRG
> Subject: Re: RE: [Asrg] 6. Proposals - Legal - US Congress to 
> vote on federal anti-spam bill
> 
> > 
> > Can anyone tell me what good a US law will be in stoping a 
> SPAM sender 
> > who is say in sweeden that sends fake headers to a mail server in 
> > korea and then to a mail server in say russia and then to the usa?
> > If the email can not be traced back to the sender ..... And 
> crosses 2 
> > or more international borders in the process then who do 
> you go after? 
> > At what cost? In which contry? Based on who's legal system?
> > 
> 
> I don't know about you Danny, but most of the spam I receive 
Denny -- with an 'e' please ;-)
> advertises products or services from the USA. Most of it 
> *seems* to originate in the USA. I can't believe that it's 
> beyond the wit of man to track down and prosecute the 
> criminals (as they'll be) in these cases. Rokso ( 
> http://www.spamhaus.org/rokso/ ) seem to do fairly well.
>
I'm sure they can be found for the most part....
But if you want to for example make them pay damages or take them to court
and so on you have to be able to prove you got the right person
Or company.... Ok so maby more is from the US than from abroad... That's not
the point in my statement.
Lets change the example:
You have a SPAM with email headers that point to ISP "X" IP 1.2.3.4 but it
also has headers showing say 3 other IP's / domains with some of them
showing forged domain names in conflict with the IP's
And the from [email-masked] does not match any of the headers.
And the Opt Out line uses a closed / fake email and or web site.
And all the other crud they do....

So unless you have a *MAJOR* case how are you going after them? Where to
start?
Even if you can show damages how much manpower will be used just finding the
real sender and not taking some granny to cort for having a hacked win98
box?

My prior experiances with cops and with lawyers tends to be that if all you
have are some text files with numbers you may be SOL on getting them to
court unless you can lift data from the PC they used that proves they did
it....

Any decent lawyer can come up with a whole slew of ways to make the email
you got worthless unless you can find it on the accused's disks or
printouts.
IMHO if I was a spamer I'd be wiping disks often and even selling my drives
and buying new ones all the time just for that resason.

Perhaps I am over-stating it.... But perhaps the spamers will keep beeing a
"Moving target" just as long as we let them.

Given the current state of things if I were a spamer I'd just keep spamming
and laugh at our laws, and send more spam on how to stop spam.

That's my concern....

> That's Schiller, I think. Asimov was quoting.
Yes it was... :-)

---

From: "Jon Kyme" <[email-masked]>
Date: Mon, 24 Nov 2003 09:43:31 +0000

> Denny -- with an 'e' please ;-)

Apologies.

> real sender and not taking some granny to cort for having a hacked win98

I'm sure that we're all aware of the deceptions that spammers practice.
I expect that it will be *difficult* to get successful prosecutions.

Your position (I hope I've got this right) is that laws like this are
difficult or expensive to enforce? Yes, of course. I'm not sure that it
follows that these laws won't (can't) be enforced. I expect that it will
depend on how much political pressure is put on prosecutors, law
enforcement.

It may be an interesting test of one of those things commonly asserted -
that much spam comes from a small number of US based spammers. Shut down
those operations and see what happens :-)

--