Subject: RE: [Asrg] 6. Proposals - Legal - US Congress to vote on federal anti-spam bill

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 21 Nov 2003 11:53:36 -0800

Some comments:

1) We should push to make sure that the do not spam registry is maintained
using the one-way digest technique. [My original publication on this is now
eight years old and we can be as sure as is possible it is not encumbered].

2) I am not particularly concerned about pre-empting state statutes that the
states are failing to enforce. I would much rather see a weak federal
statute being enforced than a strong state statute that is ignored.

3) I am still an advocate of having the Postal Inspectorate, the wing of the
justice dept that investigates mail frauds take responsibility for
investigating spam frauds. The FTC has been doing some useful work here, but
it is a civil agency and cannot apply for criminal sanctions. The mail
inspectorate can and does.

4) Legislative action is not a substitute for fixing the email protocols. We
need to consider how we can change the email protocols to make enforcement
of anti-spam laws more effective.

5) The do not spam registry is unlikely to reduce the effectiveness and will
significantly reduce the first ammendment uncertainty in connection with the
act.

		Phill

> -----Original Message-----
> From: Yakov Shafranovich [mailto:[email-masked]]
> Sent: Friday, November 21, 2003 2:22 PM
> To: ASRG
> Subject: [Asrg] 6. Proposals - Legal - US Congress to vote on federal
> anti-spam bill
> 
> 
> See the following article:
> 
> http://news.com.com/2100-1024_3-5110622.html
> 
> ----------------------
> "Congress has reached an agreement on antispam legislation and could 
> vote on it as early as Friday afternoon, a move that would 
> end more than 
> six years of failed attempts to enact a federal law restricting 
> unsolicited commercial e-mail."
> 
> "The broad outline of the legislation, however, shows that it is a 
> modest compromise and not as far-reaching as some antispam 
> advocates had 
> urged. It establishes a "do not spam" registry to be run by 
> the Federal 
> Trade Commission, makes it a crime punishable by up to five years in 
> prison to send fraudulent spam, and imposes an "opt out" standard 
> instead of a more stringent "opt in" requirement. Unsolicited bulk 
> e-mail from nonprofit groups, politicians, and charities would not be 
> regulated.
> 
> Still unclear is whether the bill would pre-empt more 
> restrictive state 
> laws such as one enacted in September by California. That law 
> establishes an opt-in standard and is scheduled to take 
> effect on Jan. 1."
> ----------------------
> 
> 
> 
> _______________________________________________
> Asrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/asrg
> 

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 21 Nov 2003 16:00:39 -0500

>significantly reduce the first ammendment uncertainty in connection with the

I'm looking forward to seeing how I'm supposed to add 40,000 
non-existent somewhere.com addresses to a do-not-email registry.
-- 
Kee Hinckley
http://www.messagefire.com/         Next Generation Spam Defense
http://commons.somewhere.com/buzz/  Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.

---

From: Richard Welty <[email-masked]>
Date: Fri, 21 Nov 2003 17:09:20 -0500 (EST)

> non-existent somewhere.com addresses to a do-not-email registry.

last i heard, domain wide opt-out was part of the do-not-spam list, so
[email-masked] should do nicely for most purposes.

i sure hope domain wide opt-out is still in there, it's the only thing that
can even remotely make the bill tolerable.

richard
-- 
Richard Welty                                         [email-masked]
Averill Park Networking                                         518-573-7592
    Java, PHP, PostgreSQL, Unix, Linux, IP Network Engineering, Security

---

From: Walter Dnes <[email-masked]>
Date: Sat, 22 Nov 2003 19:53:23 -0500

I'm a Canadian, so I write from a foreign perspective.  This law will
probably affect me just like S1618 did.

On Fri, Nov 21, 2003 at 11:53:36AM -0800, Hallam-Baker, Phillip wrote

> 3) I am still an advocate of having the Postal Inspectorate, the wing
> of the justice dept that investigates mail frauds take responsibility
> for investigating spam frauds. The FTC has been doing some useful
> work here, but it is a civil agency and cannot apply for criminal
> sanctions. The mail inspectorate can and does.

  One worrisome aspect of this approach is that it begins the
"slippery slope" towards "email == electronic version of postal mail".
This would eventually result in spamfilters being declared illegal, just
like any other interference with postal mail.

> 4) Legislative action is not a substitute for fixing the email
> protocols. We need to consider how we can change the email protocols
> to make enforcement of anti-spam laws more effective.

  The root cause is even deeper.  There are millions of compromised, aka
"0wn3d", home machines out there, under the control of organized crime,
being rented to anyone who'll pay for them.  The current payers are
spammers.  They could just as easily include Al Qaeda.  Consider these
machines just like guns stolen by criminals, to allow them to commit
crimes without being traced.  As long as home machines have proxies
and/or keyloggers, any authentication process can be subverted.
Securing these machines will cut off the majority of current spam.

-- 
Walter Dnes <[email-masked]>
Email users are divided into two classes;
1) Those who have effective spam-blocking
2) Those who wish they did