Subject: Re: [Asrg] It's not spam, it's ooga-booga... Was: 5c. Message Status

From: Kee Hinckley <[email-masked]>
Date: Thu, 3 Apr 2003 15:31:49 -0500

At 10:36 PM -0500 3/30/03, [email-masked] wrote:
>And if e-marketers adopted *OPT-IN*, we wouldn't have today's problems.

How do you define opt-in?  Paper mail, fax, phone, web-site, email 
message or any of the above with confirmation via any of the above?
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Thu, 3 Apr 2003 15:39:49 -0500

At 8:33 PM -0800 3/29/03, Brad Templeton wrote:
>So because consent would be incredibly difficult to define, and it's 
>a bad idea
>to bring it into the spam definition, I respectfully submit that other
>courses should be followed.

I think it follows from this argument that the appropriate definition 
of spam is  very simple.  Harassment.  That's why I asked a while 
back on this list whether harassment law and restraining orders (both 
of which are based to a certain degree on the perceptions of the 
recipient) might not be the best model.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: matthew richards <[email-masked]>
Date: Thu, 3 Apr 2003 13:52:25 -0800

sounds like a good place to start (harassment law and restraining 
orders) but keep in mind that this type of legislation has been 
abused- it's very easy to accuse someone of harassment, even if they 
are innocent. what it amounts to is social blacklisting and i'd hate 
to see something like that happen to email. i favor a more passive 
approach, control can be a good thing but wouldn't it be better if 
there was a way to eliminate the possibility of a harassment 
situation to begin with?

harassment:
To irritate or torment persistently.
To wear out; exhaust.
To impede and exhaust (an enemy) by repeated attacks or raids.

haha! if that isn't spam then i don't know what is! good call Kee.

>>So because consent would be incredibly difficult to define, and 
>>it's a bad idea
>I think it follows from this argument that the appropriate 
>definition of spam is  very simple.  Harassment.  That's why I asked 
>a while back on this list whether harassment law and restraining 
>orders (both of which are based to a certain degree on the 
>perceptions of the recipient) might not be the best model.
>--
>Kee Hinckley

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 3 Apr 2003 16:48:16 -0700 (MST)

> From: Kee Hinckley <[email-masked]>

> recipient) might not be the best model.

Doesn't harassment require some sort of repetition and some kind of
obnoxiousness, threat, or other objectionable quality? 
http://www.m-w.com/cgi-bin/dictionary?va=harassment says
it means "to annoy persistently."  
http://www.safetyed.org/help/stalking/stalkusa.html and the rest of
http://www.google.com/search?q=harassment+legal
seem to suggest some notion of repetition is involved.

Would one polite, short, unsolicited bulk email message every 6 months
be seen as harassment by a court or other sane authority?--I doubt it. 

How many individuals and organizations in the world might reasonably
send you an annual reminder of their existence and request for
permission to send more mail?  How many bulk unsolicited non-harresmment
email messages would you like in your mailbox daily?

It is counter-productive to take with interesting connotations and
then pretend that their definitions are whatever is convenient.  This
is as true of calling the use of surprising mail return addresses
"forgery" as would be of squeezing "spam" into a "harrassment" box.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Thu, 3 Apr 2003 20:38:13 -0500

>be seen as harassment by a court or other sane authority?--I doubt it.

Point taken.  The harassment solution might work well against bulk 
spammers.  But it doesn't solve the opt-in vs. opt-out problem. 
However... it might be a better tool for going after spammers than 
the $500/spam solutions.  Maybe.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: [email-masked]
Date: Fri, 4 Apr 2003 01:35:09 -0500

On Thu, Apr 03, 2003 at 03:31:49PM -0500, Kee Hinckley wrote
> message or any of the above with confirmation via any of the above?

  For a mailing-list, email seems logical...

  - Original contact by would-be subscriber via email or web-form
  - List-owner sends confirmation request via e-mail stating which list
    is being checked for subscription confirmation.  Should include a
    random-string/key/token which would not be guessable.  Date-time
    and IP address of the original request would also be nice.
  - The would-be subscriber replies, including token.  (Would MS Outlook
    "out-of-office" messages auto-confirm you?)

  I can tell when a marketer writes a column about opt-in; he does one
short paragraph about confirmed opt-in (see above) and then spends the
rest of a long article tap-dancing to find ways to extend the definition
to include sending stuff to people who didn't ask for it.

-- 
Walter Dnes <[email-masked]>
An infinite number of monkeys pounding away on keyboards will
eventually produce a report showing that Windows is more secure,
and has a lower TCO, than linux.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Troy Rollo <[email-masked]>
Date: Fri, 04 Apr 2003 23:38:48 +1000

At 11:39 30/03/03 -0800, Brad Templeton wrote:
>...so let me drop to the other problem
>I pointed out with consent issues, which is the difficult technical
>challenge of finding a way to figure out consent when we have all sorts
>of vague definitions of implied consent

I don't think it's correct to say that there are many definitions of 
implied consent - rather that there is some grey area in which it is not 
necessarily clear if particular conduct comes within the scope of implied 
consent.

On the other hand, there are areas where it is clear - person to person is 
within, bulk is outside.

>, and so many different preferences
>among individuals as to what consents they wish to give.

This is a separate issue of expressing explicit consent. Explicit consent 
what BMPP (and to a lesser extent BMTP) aim to facilitate. Implied consent 
has nothing to do with the actual preferences of the recipient.

>..many people express different views over what they think... they have 
>implicitly consented to receive. Just this week we've debated the 
>suggestion that if you post to a mailing list you consent to replies to 
>your messages from others, but not to automatic replies from broken bots, 
>and possibly not to off-topic replies -- for example most would say that 
>posting here doesn't allow me to reply to them to offer them cheap blue 
>sex pills.

 From a legal perspective (and since consent is really a legal concept the 
legal perspective is the relevant one), none of these questions involves 
implied consent. What they do involve is an attempt to imply terms into 
some contract. Leaving aside the question of whether signing up to a 
mailing list can amount to a contract (which is doubtful in itself), 
implying terms into a contract is something that the law is reluctant to do 
unless it is necessary to do so to give effect to the contract. Thus the 
mailing list really doesn't come into the question when analysing consent 
in those situations.

>I see it as intractable to define a mechanism for definition of advance
>consent.

Well yes, an attempt to cover the whole field of explicit consent in a 
protocol is doomed to failure, however limiting scope to things that are 
towards the "no implied consent" side of the line make this easier. The "NO 
UCE/NO UCE" banners have such limited scope. BMTP has a slightly wider 
scope, and BMPP wider still. In each case, however, the domain in which 
they attempt to deal with consent is such that it does become possible to 
cover the domain. I would venture to say that BMPP goes as far as you can 
reasonably go when the domain is "Bulk".

> > that SMTP as a protocol demonstrates a design centred on person to person
> > messages and another protocol (NNTP) demonstrates a design centred on
> > broadcast messages (even having substantially the same message format)
>
>...I can't escape the conclusion that bulk mail is considered one of the 
>legitimate uses of mail.

The nature of the protocol is relevant for a consideration of implied 
consent. A mailing list such as this one involves explicit consent. The 
reason that the orientation of the protocols becomes relevant is that it 
suggests that unsolicited bulk email is not "necessary" (there being an 
alternative mechanism for broadcast messaging), it may be relevant to what 
is accepted, and it is also relevant to what can be implied from the user's 
actions (don't read news == probably don't want broadcast messaging, so if 
somebody does want bulk messaging the applicable mechanism should be used).

> > [one-to-one messaging on the basis of a referral] is clearly
> > within the scope of implied consent, because it is (a)
> > necessary, (b) accepted, and (c) reasonably inferred by the actions in
> > putting up a web site.
>
>Unfortunately it is not so "clear" as there are many court cases about this,
>about issues such as deep linking, inlining and spidering in various forms.
>People want to give consent to some (google) but not to others (shopping bots
>or deep linkers) and so on.

Every court case I am aware of (except perhaps the recent Verio/Ralsky one, 
although I think that settled anyway) that was taken to judgement so far 
has involved an explicit withdrawal of implied consent - or at least an 
explicit notice that the traffic was unwelcome, which amounts to the same 
thing.

> > Person to person email is clearly within the scope of implied consent and
> > testing against the three criteria clearly indicates that this would be so.
>
>I thinks so but again, I have seen many in the anti-spam community offer
>extreme definitions which include person to person mail.  CAUCE, a fairly
>major organization in the anti-spam community, has pushed its lobbying
>efforts around single e-mails from the start, and so have many others.

CAUCE's efforts were focused in this way for practical reasons, and this is 
no longer the CAUCE position. CAUCE has shifted the focus back to bulk. It 
may be that the focus goes back to (bulk && commercial), but that's a 
matter for the CAUCE (USA) board.

> > [notes on the bordeline status of implied consent in
> > person-to-person flames]
>
>I think you aptly demonstrate the technological impossiblity of making a
>protocol based way to define advance consent.

As noted, I agree that it is impossible to define a protocol to 
exhaustively cover the domain of explicit consent. The only domain I see as 
relevant to such mechanisms is bulk.

______________________________________________________________________________
[email-masked]		IANALY,TINLA		  Troy Rollo, Sydney, Australia
       Fight spam in Australia - Join CAUBE.AU - http://www.caube.org.au/

---

From: matthew richards <[email-masked]>
Date: Fri, 4 Apr 2003 09:26:25 -0800

if spammers were only spamming once very six months i doubt the ASRG 
would exist, i doubt the term SPAM would exist.

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 4 Apr 2003 14:18:16 -0500

>would exist, i doubt the term SPAM would exist.

The point was that we need to be careful not to solve one problem and 
create another.  In particular, we don't want to legitimize sending 
unsolicited bulk email, even if it isn't done frequently.  Right now 
we're being nailed by a large number of messages from a few people. 
The opposite situation is actually far harder to control.  And 
legitimizing unsolicited bulk mail (with or without opt-out) could 
easily create it.

Or to put it in a slightly more flip way.  It's possible that the 
fact that spammers make legitimate bulk email senders look bad is a 
good thing.  The only thing holding them back is that they'd get 
grouped with the slime.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Brad Spencer <[email-masked]>
Date: Fri, 04 Apr 2003 13:55:43 -0600

At 02:18 PM 4/4/2003 -0500, you wrote:

>Or to put it in a slightly more flip way.  It's possible that the fact 
>that spammers make legitimate bulk email senders look bad is a good 
>thing.  The only thing holding them back is that they'd get grouped with 
>the slime.

I agree.  The DMA-types still believe in the legitimacy of first-contact 
email.  They probably want to restrict that to targeted lists rather than 
the spam-everyone approach of the current abusive spammers (and claim that 
"targeted" first-contact email isn't spam - they'll gladly remove the 
unwilling from THAT list.)  The DMA-type spam is, ultimately, the bigger 
threat, and legitimatizing it is greatly to be avoided.

It is still very worthwhile to end the abusive spam.  Stopping the DMA-type 
spam is a more complex problem - they surely have legislators convinced 
that they are innovative ethical businesspeople.