Subject: RE: [Asrg] SMTP over SSL

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 2 Apr 2003 08:38:07 -0800

> > From: "Hallam-Baker, Phillip" <[email-masked]>
> 
> > ...
> > No try, "The owner of this server has undertaken not to spam and
> > if they do not you can serve papers at this address"
> 
> We already have as much of that as is possible without legislation
> in domain name and IP address whois records.  

No we don't. Look at the number of people who entered the 
Network Solutions address into WHOIS as their contact details.
At least we know those addresses are fake, there are lots
more that are fake. [And you should hear the complaints from
people who enter fake data when they lose their domain
because they did not get their renewal notice.]

According to WHOIS, VeriSign and Network Solutions have registered
a remarkable number of addresses at competing registrars.

The terms of the ICANN contract with the registrars does not 
require that any authentication be performed on the contact
addresses. Furthermore a lot of the registrars provide proxy
registration services that hide the name of the company
they are issued to.

If the process required true authentication the cost of 
domain names would have to be much higher. True authentication
is not necessary for the purpose of preventing domain name
squatting.

> Take the IP address
> of the SMTP client delivering the spam to your SMTP server, 
> find the responsible party, and launch lawyers....or serve papers
> on the post office for the owner of the advertised post office box,
> the HTTP hosting bureau for the advertised URL, or the telco for 
> advertised phone number.

As the AOL lawyer pointed out, that takes too long, the data
is often gone by the time they get there, if indeed they can.

		Phill
 
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 2 Apr 2003 14:24:03 -0700 (MST)

> more that are fake. ...

When the domain name whois records are false, whois records for the
IP address are never fake.  Even when a SWIPEd record is bogus, you
can *always* treat the issuing ISP as responsible for the spam and
serve papers on it, naming it as the party responsible for the spam.
If the ISP cannot provide a creditable name and address of a customer,
then it is at fault and should be on the hook for damages and fines.

In theory you can get a telephone number under an assumed name and
proceed to violate the TCPA.  You can also program your FAX blasting
equipment to omit or lie in the FAX source tag and use a PBX to generat
a fake or no CID.  However, in practice those are not and have not
been sufficient to shield you from anyone determined to use the TCPA
against you.  An IP address and spam are very much like a telephone
number an illegal telemarking or fax calls.  The reasons the TCPA has
had only limited, but significant success have nothing to do with the
fact that telemarketing calls and junk faxes lack digital signatures.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg