Subject: [Asrg] RE: 2a. Blacklists, collateral damage and anonymity

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 5 May 2004 11:50:17 -0700

> I get the feeling you're happy with certain blacklists.

I believe it is possible to run a blacklist for certain very narrow
purposes in a legal, useful and acceptable fashion. I do not think
it is remotely possible to stop spam through blacklists.

> It's two issues 
> [*] you feel stuck on: 1) Collateral damage and 2) anonymity. So I'll 
> try to address those.
> 
> Collateral Damage
> -----------------
> 
> This is a really tough issue. There's really only one DNSBL that I 
> support in terms of its collateral damage policy and that is the SBL. 
> They will escalate a listing from the IP addresses sending 
> spam to the 
> corporate mail servers of the ISP in question if they are 
> unable to get 
> action from that ISP in removing the spammer. They do not do this 
> lightly - only after making numerous attempts to contact the ISP both 
> via email and telephone calls. Note the fact that the 
> escalation is not 
> to the entire ISP - just to the corporate mail servers of the ISP.

This is action against the ISP and not a third party. I would have no 
objection to that type of activity, it does not raise the issues of 
contract interference.

There could still be an issue of course if the reason for the listing
was simply malicious but that would be no different from listing the
spammer.

> Anonymity
> ---------
> 
> We did not wish to prevent anonymity in the BCP because it provides 
> useful protection to the people who run these services. This 
> has become 
> necessary not because what they are doing is illegal, but because the 
> cost of even a failed lawsuit in the US is too much for the 
> creators of the blocklists to bear.

I don't believe in anonymous reputation services.

If blacklists are going to demand accountability they must accept
accountability - from all parties they affect, not just the ones they
choose.

I believe in the democratic rule of law, no exceptions. If the legal
system is broken then it has to be fixed. There are plenty of blacklists
that operate in the open. Spamhaus operates in a legal regime wrt libel
that is far more hostile than the US.

I do not believe that it should be legal for a public service ISP to
use any anonymous blacklist service to filter customer's mail.

> Do I wish that these blocklists could all be public facing and not 
> anonymous? Absolutely! But the reality of your litigious society has 
> ensured that this is becoming more and more difficult.

When we started VeriSign nobody else dared to run a public service
CA because they feared the liability issues. Today the liability
issue is considered irrelevant by many CAs and CA customers (heh,
they got a surprise comming). The reason is that VeriSign did such
a good job of anticipating the legal issues and pre-empting them.

The blacklist I am currently looking to establish will probably not
block any spam at all, it will block less than 1% of the web sites 
mentioned in spam, hopefully though it will block 80%+ of a certain
type of fraud.

I want the blacklist to be used near universally, therefore I want 
to make it practically impossible for a false positive to occur -
even though people will clearly attempt to engineer them.

		Phill

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Seth Breidbart <[email-masked]>
Date: Wed, 5 May 2004 15:14:53 -0400 (EDT)

> it is remotely possible to stop spam through blacklists.

It is clearly possible to block a lot of it that way.

Is there a reason you seem to be opposed to such blocking?

> I don't believe in anonymous reputation services.

They exist.  Deal with it.  Or continue to deny it; I don't have to
care.

> accountability - from all parties they affect, not just the ones they

I haven't seen anything about blacklists that "demand accountability";
rather, they just provide information.

If you choose to create a "blacklist of blacklists" that lists the
ones that aren't sufficiently well-identified to satisfy you, go for
it.  I'm sure all those who agree with you will use it appropriately.

> system is broken then it has to be fixed.

What do "opinion servers" and "fact providers" have to do with "the
democratic rule of law"?

> There are plenty of blacklists that operate in the open.

So you have no shortage of ones to use, if you want to.

> use any anonymous blacklist service to filter customer's mail.

The Constitution of the US disagrees with you.  Read up about "freedom
of contract" sometime.

But I'll happily allow you to define the phrase "public service ISP"
not to include those that use anonymous blacklist services; entities
that want to use such services can call themselves "private service
ISPs" or just "ISPs".

> they got a surprise comming).

How much did you lose for that bogus Microsoft certificate?

> The reason is that VeriSign did such

Such as defining contracts to say "we have no liability".  That would
seem like a good thing for blacklists to do as well.

> mentioned in spam, hopefully though it will block 80%+ of a certain

Fine with me.

> I want the blacklist to be used near universally,

That's very unlikely to happen.

Seth

---

From: Matt Sergeant <[email-masked]>
Date: Wed, 5 May 2004 20:46:32 +0100 (BST)

> was simply malicious but that would be no different from listing the

And would be a violation of the BCP. Good, that's progress.

> use any anonymous blacklist service to filter customer's mail.

Spamhaus is a good example here. I'm glad you used it. Steve Linford is
currently suffering massive financial loss because of the fact that
spamhaus are a public resource. We stand to lose spamhaus because of this.  
I do not think that will happen because they will start charging for zone
transfers of the SBL. Something they've talked about doing for a while.
This will cover the costs of being DoS'd out of existance and hopefully
enough to pay a small pitance to the hard working spamhaus helpers (who
currently work for free).

This will not work for all blacklists. Not even all good blacklists.

If the spammers were all nice people I would agree with you whole 
heartedly that all blacklists should be accountable. You should hear some 
of the things that Steve has been sent in the post from these nice 
friendly spammers. I truly believe that his situation would have been made 
impossible had he been living in the US (i.e. where the spammers are). I 
would hate to see the same thing happening to the guy who created the CBL.

> a good job of anticipating the legal issues and pre-empting them.

VeriSign has a lot of money to protect itself. It's certainly not managed 
to keep itself clear of litigation, but can afford to deal with the issue 
when it arises.

> even though people will clearly attempt to engineer them.

That is good. I'm sure it will comply with the concepts raised in this 
BCP.

Matt.

---

From: Devdas Bhagat <[email-masked]>
Date: Thu, 6 May 2004 01:23:22 +0530

> it is remotely possible to stop spam through blacklists.
Let us say I block mail from certain network blocks, depending ov
criteria of my choosing.
This step is definitely not illegal.

I choose to share this information with the world via a DNS based
mechanism.
Not illegal.

The administrator of some third server shares my views and trusts me not
to cause too many false positives for him and hence hooks into my DNSBL.
Not illegal.

Useful and acceptable are issues to be decided by the administrator of
the recipients server and any contracts he may have with his customers.

In any case, I do not see the blacklists as being provably illegal.
<snip>
> I don't believe in anonymous reputation services.
It is not a question of what *you* wish to believe in. Just to clarify a
point, I would trust the anonymous maintainer(s) of SPEWS before I trust
Verisign (ref: the false certificates issued to people claiming to be 
Microsoft). As yet, SPEWS has not given me justification to withdraw my
trust. Verisign has.

> accountability - from all parties they affect, not just the ones they
Given that the service is optional and free, I doubt that accountability
to anyone else is even a question.

> use any anonymous blacklist service to filter customer's mail.
Is there a contract guarantee that email will be delivered? If not, then
the question is simply whether the ISP is allowed to restrict certain
types of traffic. As of today, the network is the ISPs private network
and they choose what traffic flows on it (IIRC, this is supported by US
case law. I am not a lawyer, nor in the US, so please confirm with your
legal department). It would be easy enough for any ISP to simply put in
large blocks on their routers rather than querying DNSBLs, and that is
legal.
<snip>
> mentioned in spam, hopefully though it will block 80%+ of a certain
Heres a hint: We use DNSBLs to stop spam. The content of the spam is
irrelevant. Unsolicited Bulk Email can involve fraud, political
messages, religious matters, charity issues, medical stuff, mortgages,
whatever. The content is irrelevant. The issue is one of consent.

> even though people will clearly attempt to engineer them.
I would not want a false negative in a DNSBL I use.

Devdas Bhagat

---

From: "Dr. Jeffrey Race" <[email-masked]>
Date: Wed, 05 May 2004 15:53:23 -0400

On Wed, 5 May 2004 11:50:17 -0700, Hallam-Baker, Phillip wrote:
> I do not think it is remotely possible to stop spam through blacklists.

If blacklists identify the spam-enabling networks, then spam is stopped for
those who take up the blacklists.   As always, the issue is one of uptake.
An orderly procedure for the operation and use of blacklists might therefore
be a Good Thing.

However history proves that when a pollution enabler is faced with a
definitive connectivity shutdown, the pollution stops in a matter of days
or even hours, despite all previous claims that it was impossible to stop
customers doing this or that etc etc.   For some enablers, only a 
mallet works.

The plain fact is that if blacklists were accurate and agreed to be 
widely adopted at a time certain, well announced in advance,
the spam would stop on that date, because any refractory polluter
would face instant bankruptcy  after said time.   The whole point is that
the  emergent structure (sociology term of art, my apologies but I
want to be precise so you can understand this is an engineering
problem just like integrated circuits) only emerges from the 
mutual expectations of compliance.  Many/most have to jump
at once.

Jeffrey Race