Subject: [Asrg] Spam Ecomomics

From: "Hannigan, Martin" <[email-masked]>
Date: Thu, 30 Dec 2004 18:04:27 -0500

I'm not sure how my thoughts earlier this/last week turned into
"pay per", but let me try one last annoying time to clarify.

End User (Ease of Use)

The end user sees no change in the operation of email services
on the Internet. They do see a chance in the service offering 
where they are now allowed to send and receive X number of emails
per month based on the service plan that they have subscribed to
with their provider.

The Provider (Email)

The provider email operations establishes a real cost based on 
the fractional sampling of settlement(IP)data they use to determine
payables or receivables on their peering contracts. They take this
cost, apply it to their product, and determine what the value of 
email is and apply it in the form of "the cap". 

The Provider (Billing)

A chance to the mail receipt and delivery mechanism must be made in
order to generate an acceptable accounting record so that a fair
determinatioin can be made when a user is in overage, and, what the
amount the user will owe. The mechanism for determination is up to 
the provider i.e. counts in SS7 reachable databases, CA dips, or
whatever mechanism is cost effective for them. 

The Provider (Network)

Provider will have to extrapolate the cost of SMTP traffic vs. other
traffic from their peering data. The cost is then in turn broken out
by customer. In the case of 'always connected' customers, they too are
alloted a specific amount of SMTP b/w and are charged for overage based
on normal usage patterns i.e. 95th percentile, etc. This is doable today.

The Spammer (Inclusive)

The spammer is now just an end user and they too will pay. Since they 
don't spam from their own connections, it has little impact on the,m.

The End User (cost)

End users incurs no additional cost unless they violate their
plan. In the case of "stolen" SMTP traffic, the end user pays
since  they didn't "do the right thing".

Rational: Does anyone mount a dialup line on the outside of their
          home and label it "DIALUP LINE"

          Does anyone leave their cell phone in a bar with a label that
          says "USE ME" on it?

If your kids pickup the phone and start calling 900 numbers, who's fault
is that? The telco? The CLEC? The government?

The End Result

Spammers incentive is rapidly decreased. It now becomes a hard job.
This drives up rental costs. This discourages some. The costs rise
as time goes on until the spammers start collapsing and "going out
of business" [ Remember, the spammers are now NOT the originator, 
someone else gets paid to do the spamming ]

Best case, the spammers return to their old methods of using their own
hosts and trying to find places to run them. Fine, but they are paying
or  driving up the ISP's cost and they are charged accordingly. It is
un-profitable.

The spammer dies a painful and noisy death, deprived of the income he was
once enjoying due to reversal of SPAM economics and the SPAM sponsors
(botnet
customers) have little recourse. 

The Big Picture

We can then move on to signing emails, authentication, etc. things that
are very important but because SPAM destroys all hope for the future of 
email, are not taken as a priority by the majority.

SPAM EcoNomIc Model "SPAMEMIM" (Like "Eminem")

  NSP       -- LAYER 4  IMPORTANT
  ISP       -- LAYER 3  
  SPAMMER   -- LAYER 2
  ENDUSER   -- LAYER 1  LESS IMPORTANT

At layer 3 and 4, economic attack. 
At layer 3 and 1, technology attack.

Relationship Matrix

Layer 3 and 4
Layer 3 and 1

There's never a relationship top Layer 2 i.e. noone spends
time on "getting" the spammer, the efforts are focusing on 
fixing the user.

-M<

--
Martin Hannigan                         (c) 617-388-2663
VeriSign, Inc.                          (w) 703-948-7018
Network Engineer IV                       Operations & Infrastructure
[email-masked]

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: James Lick <[email-masked]>
Date: Fri, 31 Dec 2004 13:51:49 +0800

>per month based on the service plan that they have subscribed to

I think your plan has potential, but once you have a cap in place you 
can just make that a hard limit and don't have the charge anything at 
all.   If the cap is generous enough to cover even a power user's 
legitimate email volume, the end user should never even be aware of it 
unless they get 0wn3d.  At that point cutting off their outgoing email 
until they clean up, while annoying, is much more palatable than getting 
surprised with a fat bill at the end of the month.  You also risk 
annoying consumer protection agencies and government officials by 
charging consumers for fraudulent activity.  (Note that in the US 
consumers don't need to pay more than $50 in fraudulent credit card 
charges unless the credit card company can prove the credit card holder 
was negligent.)  In summary, I still don't see what benefit the overage 
charges have over just making it a hard limit.

-- 
James Lick -- 黎建溥 -- [email-masked] -- http://jameslick.com/

---

From: Gadi Evron <[email-masked]>
Date: Fri, 31 Dec 2004 09:18:56 +0200

> time on "getting" the spammer, the efforts are focusing on 

Hi Martin. I really enjoyed your email. However, if I understood it 
right, you are saying spam costs ISP's and is not beneficial?

 From your own text I'd have concluded the opposite [if I understood you 
right].

Beginning in people paying for bigger tubes, through people paying for 
spam solutions all the way to paying for spam email solutions at the ISP.

	Gadi.

---

From: Jim Whitescarver <[email-masked]>
Date: Fri, 31 Dec 2004 11:16:01 -0500

While I agree with the economics presented here generally.  I believe we 
can go one step further and only inflict payments for those that want to 
pay for insurance they will not be blacklisted.

The worse the spam crises becomes, the more valuable whitelisting is.  
In effect, advertisers are paying for the delivery costs so that they 
will not be blocked.

If for example, any of the over 4 million IP addresses I am now blocking 
would pay a tenth of a cent for each email, I would be happy to unblock 
them.  All that is missing is a standard for them to discover what 
payment I will accept, and how to make payment.

This fully decentralizes the process down to the individual email 
server.  It requires setting not standards for what is spam or how many 
email anyone can send or receive.  It lets each provider set their own 
standards.

Providers can restrict emailing activities of their users and pay not 
whitelisting fees, or they can pay for whitelisting.

While every advertiser paying every server could become rather huge, it 
is more likely SMTP relays would pay servers on behalf of all the 
advertisers they provide SMTP servise for.  In any case the transaction 
volume would be small compared to the spam traffic.

It is the end user is who is ultimately important, and the end user can 
filter or block anything they wish.  The end user should also be allowed 
to charge for whitelisting advertisers, independently from their email 
server and network server whitelists.  I expect many advertisers would 
be willing to pay the end user as well, if they could be reasonably 
assured the email is actually received.  Free internet could be a 
reality for those willing to accept targeted free advertising in a free 
and open global market.

My spam policy, "Spam me once, sham on you, spam me twice shame on me.", 
is a hard line against spam, not by choice, but by necessity.  With a 
whitelist payment standard advertisers have a choice, they can be 
blocked, or they can pay. Currently, the spam crises means that all 
advertising on the net must suffer because there is no way to pay your 
way.  Advertising should pay the bill for our public networks.  
Whitelisting fee payment standards could provide a means for them to do 
so voluntarily without regulatory restrictions in a free market.

Jim
(i copied my prior thoughts below as supporting material)

>time on "getting" the spammer, the efforts are focusing on 
It is unfair that a few network abusers consume much of the bandwidth.  
But we want profitable use of the network.  Those that use an obscene 
excess of our shared resources should pay.

My comments are more of the philosophical and PERSONAL MOTIVATION side, 
on how should spam be paid for in a free market.

I block IP addresses after just one spam.  I block groups of 256 IP 
addresses with 3 or more offending IP addresses.

I punish them to protect my systems from overload.  But it they would 
pay me, I be happy to unblock them.

It would be good, in principle, for those who used an excesses of our 
resources would pay those using less than their share. In the spirit of 
commercial television, the advertisers could pay for the whole system

We all have the power to block or unblock, but there is no standard for 
payment for unblocking.

Many advertisers now balking at email advertising may use it if they 
could be assured they will not be blocked or sued.  There is a social 
cost to spam, our time, our computing resources and networks.  
Advertising on the Internet saves money and resources.  An added cost of 
a penny for an add the recipient actually received, for example, would 
still be a small fraction of printing and postage costs.

What does it cost?  The only reasonable choice is free market value.  I 
am currently blocking over four million IP addresses from reaching about 
400 real email accounts.   I have no choice really, except to upgrade my 
email server.  If I were to open the flood gates, my server will become 
overloaded by spam filters and crash.  Everyone we get to this point if 
spam continues to grow exponentially.

I doubt many of the IP addresses I block are legitimately following the 
can spam requirements and should be blocked.  But some of them, and many 
other businesses wanting to reach our users pay to get theory message 
across.  To make the system scalable they must pay for the resources 
they utilize.

I could handle about four times as much email with about a $500 per 
month upgrade.  That come out to about 3/10 of a cent per added email.  
Your millage may vary, but unless these economics are provided for the 
system will fail.  Scalable economics will promote growth and 
stability.  We all have the power to block and unblock, and do so 
profitable for advertisers and networks collaboratively.  There should 
be a standard, but it will be the marketplace that decides ultimately.  
Some system like this must emerge so that our networks can sustain growth.

Jim

---

From: Barry Shein <[email-masked]>
Date: Fri, 31 Dec 2004 16:42:54 -0500

I think once we're debating the relative merits of blocking on a hard
cap versus charging for overage we're well into policy rather than
mechanism and groups like these (IETF) tend to be more successful in
pushing mechanism forward than policy tho plenty of exceptions of
course exist (BCP et al.)

But worse, I think at that point we're into marketing, really.

One ISP charges for overage, the other stops you to protect you from
yourself. Ok, I could easily imagine either being attractive to
different sorts of customers.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*