Subject: Re: Spew draft thoughts, safeeps

From: Albert Lunde <[email-masked]>
Date: Fri, 16 Oct 1998 22:42:14 -0500

>2) There's a new web site called www.safeeps.com which was
>created by Rodney Joffe.  Rodney used to own Genuity, and
>he decided that the Direct Marketing Association was going
>to try to create their own opt-out list, and he decided that
>he needed to present them with a fait accompli.  Although
>we all know that opt-out is not the answer, this is a
>reasonable attempt.  It allows domain-level opt-out, and it
>also allows people to opt-in (no, I don't know who would.
>Whoever it is must not get very much email otherwise).
>I also think it's worth a mention.

I've been following the discussion of safeeps on the (private) spam@zorch
list, and at the moment my feeling about the whole idea is that I want to
take a wait-and-see attitude about it. As a result, I'm not sure that we
can make a definitive statement about it.

Also, as I've said in the past, this RFC is primarily a statement about the
ethics of spam.

Let me expand on this a bit:

I think Rodney is hoping both for the de facto, if not official, support of
the DMA or its members, and eventually the support of laws requiring
bulk-e-mailers to "clean" their lists thru a service such as his.

But the situation is still too fluid to predict the outcome.

What distinguishes his service from "remove lists" set up by spammers, is
that it allows domain-wide opt-out, with an option for individual opt-ins,
and because his business model is built on filtering address lists, but not
revealing who is opted in or out directly, it's harder for spammers to
abuse (though there may still be ways to do so).

The scenario involving safeeps that seems most favorable to anti-spammers
would be if it was accepted as a de facto Internet-wide standard, (perhaps
with at most 2 or 3 similar services) _and_ an overwhelming majority of
ISPs opted out, with a significant proportion doing a "soft" opt-out, which
would allow individuals to still opt-in.

In this situation, the system would behave a lot like a pure opt-in
arrangement; in fact under these circumstances it would likely be more
efficient for direct marketers to set up real opt-in lists than to scrap
thousands of addresses of web pages and USENET, and then "clean" the lists.

But if it turns out to be one of, say, a dozen or two dozen competing
services, then the burden on ISPs or users to opt-out via all of them
becomes too large.

And if it's not something that really is accepted as authoritative
world-wide, then we are talking about local laws and regulations, not the
situation on the Internet as a whole.

The idea that the default should be for people to have to opt-out of being
spammed is still ethically wrong, given the economics of the Internet;
safeeps is just a "lesser evil" than some of the dumber ideas to come out
of lawmakers or the DMA and its associates. In the limit case I described,
it could be close enough to real opt-in to be acceptable.

With so many unknown factors, I think right now that its ethical standing
is ambiguous, and it may or may not be a technical and business success,
though I respect the effort and good intentions that seem to have gone into
getting it off the ground.

If we broaden the scope of the RFC there's also things like the Washington
and California laws about spam. But any thing we say about local law is
likely to go out of date quickly, and not be very wide in scope.

I don't know if this inspires anything in you that could be said in a
positive way about safeeps or those laws (rather than just saying why they
are hard to talk about).

I guess my basic stance for evaluating all these legal and regulatory
possibilities is the same as my stance on spam itself: ask "Who bears the
costs, and who gets the benefits?". If there's major cost-shifting going
on, with no reimbursement or compensating benefit, then it is unjust and
unethical, regardless of the approval of law or the blessing of the DMA, or
the lack thereof.

---
    Albert Lunde                      [email-masked]