Subject: RE: [Asrg] draft-irtf-asrg-bcp-blacklists-00

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 5 May 2004 08:41:19 -0700

The point I am making here is that any BCP that is issued should
ensure that any blacklist following the practices described would
be operating in compliance with existing criminal and civil law.

Not only do I doubt this is the case, I don't think that there is
the expertise in this group to know whether or not it is the case.
The only lawyer in the group does have relevant expertise and is 
currently attempting to set up a whitelist.

Worst of all, I don't think that there is the intention on the part
of the blacklist operators to operate within the law. The idea behind
this BCP appears to be to provide a safe harbor for their existing
practices without the need to change any of the practices that are
likely torts.

> It is to desireable and to be expected that courts will in 
> due course rely
> on industry practices and standards in adjudicating acceptable
> behavior.    We should not be shy of it but instead encourage it.
> Approved and deprecated practices are what we need to encourage
> and eventually get into the judicial system.  Every industry does this
> and it is long past time for ours.   It is nothing to fear.

I agree with the sentiment, but this is not the pace to do that.

I do not beleive that this group is equiped to decide on what best
industry practices are. It does not have a mandate from the industry.

I agree with Barry that someone who wanted to sue a blacklist could
certainly use the BCP draft as evidence of malpractice. I do not agree
that a blacklist could claim that compliance with the BCP provided
a safe harbor. This group is simply not representative of the parties
who are harmed by incompetent, vindictive or outright malicious
blacklists.

In addition the statements made on this list would be admissible if
there was any attempt to rely on the BCP as safe harbor. I think it
is amply clear that this does not constitute a good faith effort to
describe best practices that protect the interests of all the parties.

> Regarding 'collateral damage': while the reality of its usefulness is
> clear, this discussion usefully points to the possible 
> injurious emotive
> overtones.    A more useful phraseology might be that employed
> (with a long legal history) in the environmental pollution field.   
> Stringent measures against polluters (which is what spam-enablers
> are) are well received in public and legally sanctioned.  (See 
> some possible wording at <http://www.camblab.com/misc/univ_std.txt>).

The term was coined by Vixie to describe listing a known innocent
party in order to apply pressure on another party.

I don't think you will find a legitimate analogy for this, certainly
not the environmental one you cite where the real analogy would be 
for private parties to organize measures against customers of the
polluters who had no part in the pollution. Attempting to compare
the actions of blacklists who wont give their names to court actions
does not work.

The reason you will not find a legitimate analogy is that collateral
damage is very clearly a tortious interference with contract. If you
doubt me on this look at the cases where MAPS has been taken to court
on this one, they have settled every single time. In the cases where
we know what the terms were MAPS clearly surrendered.

> Please let everyone be clear that a blacklist does not prevent anyone 
> from receiving service.  

That is not the case at all.

>  A blacklist USER prevents service.  

An ISP using a blacklist prevents service, it is not the decision of the
end user.

> A blacklist author is not injuring anyone.  

The cases against MAPS clearly show that the courts did not accept this
argument. Publishing information with the intention that it be used to
block mail can constitute a tort.

> This extremely important
> legal point may have to be highlighted in our documentation.  It
> is one reason (among others) why the author of a blacklist
> standard is not vulnerable to a claim for damages.

If you think that it is an important legal point perhaps you could cite
a case where a court has made a favorable decision? The cases I have
read lead me to the opposite conclusion.

In the US you can be vulnerable for a claim for damages for walking down
the street. In this case it is the claim alone that would result in 
crippling legal fees.

There are certainly ways that a blacklist can be operated within the 
boundaries of the criminal and civil law. In the antiphishing WG we
are actually discussing what it would take to set up a blacklist to
block out phishing capture sites. It will surprise many here probably
to know that I originated that idea.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: der Mouse <[email-masked]>
Date: Wed, 5 May 2004 13:32:59 -0400 (EDT)

> ensure that any blacklist following the practices described would be
> operating in compliance with existing criminal and civil law.

This - importing legal restrictions into the BCP - is not really
practical.

We, the group generating the BCP, cannot know what the legal
restrictions are.  There are so many jurisdictions around that
researching the various laws is too large a task.  And besides, even as
slow as legislative progress typically is, given the number of
jurisdictions, it's a dead cinch that someone's legal climate will
change during the BCP publication process, never mind between
publication and use.

Even if you just stick to, say, USA/Canada/EU/Australia, I think it
would be a very bad idea to enshrine the current law of any of those in
our document - especially given how fast (in legislative terms) the
legal climate is changing.

>> [..."collateral damage"...]
> polluters who had no part in the pollution.

And what's wrong with that?  I can organize - or more precisely try to
organize - boycotts against anyone I please for any reason I please
(with a few specific exceptions in many jurisdictions, none of which
are relevant here), from people who wear black socks to people who
can't spell to people who buy from Exxon - to (say) people who get net
connectivity through Verizon.

> damage is very clearly a tortious interference with contract.
> [...case law, notably MAPS...]

As you ought to know, the MAPS cases were brought in the USA, where the
merits of a case have comparatively little to do with how it ends; in
MAPS cases I heard of, it was a question of who was willing to throw
more money at lawyers.

> The cases against MAPS clearly show that the courts did not accept
> this argument.

As you yourself pointed out (in text I cut), the MAPS cases were
settled out of court; the court did not have a chance to accept or
reject the argument in question.

> In the US you can be vulnerable for a claim for damages for walking
> down the street.  In this case it is the claim alone that would
> result in crippling legal fees.

True.  Perhaps the BCP should say "do not run the list under USA legal
jurisdiction"; that's certainly the lesson _I_ find in your examples.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

---

From: Bill Cole <[email-masked]>
Date: Wed, 5 May 2004 22:36:41 -0400

At 8:41 AM -0700 5/5/04, Hallam-Baker, Phillip wrote:

[...]
>argument.

The cases against MAPS say essentially nothing about what any court 
accepted except at the vaguest sort of level. No court decided 
anything beyond pre-trial matters in any of the suits against MAPS. 
All those cases proved is that it is a bad idea to beg to be sued by 
companies that might do so with no intention of ever going to trial.

>Publishing information with the intention that it be used to

Do you have any useful legal citation for that? Such as an actual 
instance of a court ruling so, rather than just ruling (e.g. in a 
preliminary stage) that it's not a facially absurd argument?

-- 
Bill Cole
[email-masked]

---

From: Barry Shein <[email-masked]>
Date: Wed, 5 May 2004 22:30:57 -0400

A few quick points:

1. Although both sides are right regarding "collateral damage" the
underlying problem right now is that the law (I'll talk about the US
tho I suspect these comments are so vague as to apply more broadly)
provides virtually no protection or even any effective process for
dealing with spam.

So some of the comments might be better pre-fixed with phrasing like
"in a civilized circumstance..." (we would do this, or we would do
that.)

Unfortunately the current circumstances aren't civilized and when you
get your 12 billionth spam from some 218.*.0.0 net and can't really
find anything non-spam coming from that /16 you just block it all
rather than having to accept one or more spams from each of its
apparent 16,000+ zombies before blocking them all in one fell swoop.

2. With all due respect (not much) I think this repeated argument that
BL's can't ("shouldn't" of course is in the realm of opium dens and
children's stories) be held liable is just nutso.

Repeating over and over and over that the only possible liable party
is the person/org using the blacklist is just happy horse****.

Imagine if I put up a web site with a list with your name and picture
on it under the heading "Known Pedophiles".

Why do you think we have slander, libel, incitement to riot, etc laws?
What about shouting fire in a crowded movie theater (that's not on
fire)?

C'mon, inducement, presenting yourself as some sort of authority on a
subject (who the spammers are) and giving out advice about others
(blacklists), can all have liability exposures so let's stop repeating
this embarrassingly naive idiocy as if repetition will make it
otherwise.

3. In a similar sense, I know because I was once involved in a case
revolving around this, that there is such a thing as an illegal
business boycott.

You can personally boycott any business you want, of course, who would
know. But when businesses boycott other business in a provably
organized way then anti-trust laws can come to bear. For example, I
(as an ISP) can't urge my supermarket to refuse to sell food to a
known spammer in the hope that he'll starve to death, that kind of
thing, it's illegal.

4. All that said I think it's all kinda hopeless when technical people
begin discussing the law, it quickly goes off into la-la-land; unlike
their code or math or things they know something about they don't even
know how to tell a good answer from a bad one and just begin shouting
louder hoping that'll save the day.

5. But you can rely on the fact that I'm always right.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*

---

From: "Chris Lewis" <[email-masked]>
Date: Wed, 05 May 2004 23:38:28 -0400

> on it under the heading "Known Pedophiles".

Been there, done that, have the T-shirt.

 > libel defamation etc. etc. etc.

Yet... yet... the news media and the police do it all the time.

Obviously there's a way do to this.

Nothing can bullet proof anybody, particularly in the US legal climate.

But being transparent and honest about listing criteria can do a lot to 
shift most of the onus on the list _user_ who has made a conscious 
choice to use it and accept responsibility for it.

After all, if Seth published a "random number BL", announced it exactly 
as such with big red "you're an idiot to use this" banner all over the 
web pages, just how successful do you think someone [sh|w]ould be suing him?

---

From: "Dr. Jeffrey Race" <[email-masked]>
Date: Thu, 06 May 2004 08:38:35 -0400

On Wed, 5 May 2004 22:30:57 -0400, Barry Shein wrote:

>Why do you think we have slander, libel,

The result would depend on the truthfulness of the statement and the
jurisdiction's privacy laws.

> incitement to riot, etc laws?

These issues relate to public safety and are irrelevant to the issue of
evidence-based statements about the behavior of those responsible
for certain IP addresses.

>this embarrassingly naive idiocy as if repetition will make it

Let us not repeat any idiocies but let us also realize that legal systems,
after extensive levels of review, produce generally reasonable 
results.    A well-thought-out practice can enhance outcomes for
our industry.   Lack of same leaves it up to others to determine what
is acceptable.   Working together now can prevent others from making
decisions we ought to make.

Jeffrey Race

---

From: "Alan DeKok" <[email-masked]>
Date: Thu, 06 May 2004 10:30:29 -0400

"Dr. Jeffrey Race" <[email-masked]> wrote:
> our industry.

  My suggestion for a BCP would be to recommend that blacklists have a
CBL-style page for de-listing addresses.  But rather than de-listing
them entirely, the addresses can be moved to an associated "grey
list", which is published as "addresses under dispute".  If the
blacklist verification process passes the address, it can be removed
from the greylist.  Otherwise, it can be moved back to the blacklist.
We can call this process "provisional de-listing".

  The problem this method attacks is the liability of listing an
address in the blacklist while it's under dispute.  We also shouldn't
ignore the emotions people feel when their requests to be de-listed
are ignored (so they see), because the blacklist is following a
process they don't understand.  Lowering the strength of the emotions
involved in a dispute can have dampening effects on the potential for
litigation in any jurisdiction.

  Section 2.7 of the draft addresses this issue, without going into
the reasons why it's useful.

  Also, tabloids (National Enquirer, etc) have an interesting model
for dealing with legal issues.  They don't claim something, they quote
someone else claiming it.  This practice has demonstratably limited
their liability.

  For blacklists, the tying of IP address reporting with IP address
publication means that the blacklist maintainers are probably
significantly more liable than if the processes were
separate. (requisite IANAL).

  Alan DeKok.

---

From: Barry Shein <[email-masked]>
Date: Thu, 6 May 2004 16:01:23 -0400

> Obviously there's a way do to this.

Well, for the news media it involves having a 1st amendment to the
United States Constitution which mentions your profession by name.

And a judiciary which has generally agreed that the need of the people
to get their news in a timely manner, even with some errors, overrides
damage done by honest or even mildly careless errors.

Of course news orgs have been sued anyhow and have sometimes even lost
because the item wasn't considered newsworthy or of a timely urgency
(e.g., gossip columns), or maliciousness or gross negligence of some
sort was claimed.

The police also have some amount of legal protection from reasonable
errors, but they (or their employers) get sued all the time and
sometimes even lose.

>choice to use it and accept responsibility for it.

I think that's a convenient fantasy.

At any rate, I'd certainly consult an atty before putting my own
assets at risk in such a venture. Giving others advice isn't always
defensible by "well they were dumb enough to listen to me!"

But, of course, if one is jugement-proof then it may not make much
difference.

-- 
        -Barry Shein

---

From: Barry Shein <[email-masked]>
Date: Thu, 6 May 2004 16:11:13 -0400

> for certain IP addresses.

The point is the law recognizes the general concept of liability for
inducing another to act.

Claiming it was their decision to listen to you isn't a blanket
defense.

-- 
        -Barry Shein

---

From: "Dr. Jeffrey Race" <[email-masked]>
Date: Thu, 06 May 2004 16:34:20 -0400

>The point is the law recognizes the general concept of liability for

The law recognizes the _specific_ case of public safety in the case you
cited ("no right to shout fire in a crowded theater").    Don't read any
more in to it.

Anyway  I repeat that this is irrelevant to the prospect of litigation against
a blacklist or any organization which legitimizes blacklists for purposes of
public convenience.     A blacklist does not _induce_ anyone to do anything (in a legal
sense which means to offer an incentive).   A blacklist just publishes
facts (presumptively).    If they are not facts, and someone is injured,
then that is actionable as it should be.   It has nothing to do with us.

Jeffrey Race

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 06 May 2004 20:01:53 -0400

> then that is actionable as it should be.   It has nothing to do with us.

Allow me to give another example. There is a proposal in SMTP-VERIFY 
subgroup floated about a month ago by Mark Baugher. It proposes a 
standard set of formats and protocols for letting an MTA publish 
statistical information about other MTAs it knows, similar to what 
SenderBase does today. This would enable an ISP like AOL or The World 
publish statistical information about the MTAs that exchange mail with 
it such as average volume per day, how long it had been known, etc. This 
data can be used in the filtering process - e.g. if the MTA is well 
known, it is less likely that it is a zombie.

Would you say that publishing such data puts the MTA operator at a legal 
liability just because others would use it?

Yakov
--
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"And this too shall come to pass"

---

From: Barry Shein <[email-masked]>
Date: Thu, 6 May 2004 21:20:54 -0400

> liability just because others would use it?

IANAL.

But off-hand it reminds me of how they used to announce the winners in
the illegal numbers racket in NYC. The last 3 digits of the day's
parimutuel betting at Belmont, published with the race results in the
daily papers, would be the winning numbers.

Now, I doubt Belmont racetrack could be held liable for aiding and
abetting the numbers racket, tho I believe they voluntarily agreed to
just round off to zeros to stop the practice.

So it would seem to me to make a difference that in one case the
information is clearly being published soas to create a blacklist, and
is being represented as such. While in the other case it could be
generally useful information used in all sorts of ways. It's not like
telephone directories invite phone harrassment.

I think my best advice is that if I were to run a public spam
blacklist I'd bounce it around with an atty if I had assets to
protect, unless I were operating in a country where litigation by
spammers for something like tortious interference isn't a realistic
concern.

My concern was only that a blacklist BCP document could provide fodder
for the wrong people in an already charged and potentially litigious
atmosphere.

That doesn't necessarily argue for or against the document's
existence, it may just be a fact (or an observation anyhow.)

-- 
        -Barry Shein

---

From: "Alan DeKok" <[email-masked]>
Date: Fri, 07 May 2004 11:23:34 -0400

> liability just because others would use it?

  My understanding is that in some jurisdictions, the answer is "Yes."

  In Canada, it's legal to give a reference for an ex-employee which
says "he showed up at work drunk and naked, so we fired him".  In
other countries, it may not be legal to say that, even if it's true.

  There is a way around the legal issues.  Have a "de-list me" page,
just like the CBL does.  The key is that rather than pretending the
rentry under dispute doesn't exist, you mark it "de-listed at owners
request."

  Recipients can then choose what to do.

  Alan DeKok.

---

From: Seth Breidbart <[email-masked]>
Date: Fri, 7 May 2004 14:36:02 -0400 (EDT)

> other countries, it may not be legal to say that, even if it's true.

In the US, it's legal to say that.  He might sue, of course; but if
it's true, he won't win.

>  Recipients can then choose what to do.

Then someone listed and marked that way, who gets blocked, can still
sue over the original listing.

Seth

---

From: "Alan DeKok" <[email-masked]>
Date: Fri, 07 May 2004 15:11:51 -0400

> sue over the original listing.

  ... which may (or may not) have been negatively listed.

  The original listing can be positive, negative, or a request to "not
list me".  The key is to ensure that the entries which are "not-listed
at owners request" are *not* always originally a negative listing.
This means that when someone sees those entries, there is no automatic
assumption that the owner was behaving poorly.

  e.g. Blacklists can list whole swaths of unallocated addresses as
"not listed at owners request".

  The blocks 29/8, 30/8 are still unallocated, I think.  Blacklist
maintainers can use the public statement that those addresses are
unallocated as a request to NOT have them in the list.  There's no
reason to blacklist them, as no one should be using them, right?

  Alan DeKok.