Subject: RE: [Asrg] Legal Suggestions ....

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sat, 12 Apr 2003 05:02:57 -0700

> One thing that we might be able to do while we are trying to 
> figure out 
> what technical solutions are feasible is to come out with an interrum
> 
> "Guide For Anti-Spam Legislation" which we can provide for 
> legislators who 
> are working on passing or updating anti-spam legislation.

I just completed a revision of my Plan for No Spam which is written
to address this issue. It should go up on the VeriSign web site the
week after next (next week being RSA week).

		Phill
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Jon Kyme" <[email-masked]>
Date: Mon, 14 Apr 2003 10:43:10 +0100

>
>Personaly I think it is the recipients responsability to block their own 
>spam. It upsets me when I hear about legitimate mail being blocked. any 
>"good faith" system using todays weak reasoning will dump some legitimate 
>mail. Ulimately it is the recipients decision about what they want to 
>recieve. I feel that any system to block mail, that is not agreed to by
>the
>recipients, should be illegal. There are substantial penalties for 
>interfering with postal mail. Email should be as protected as postal mail
>is
>from third party interference.

This is weak. Your postal mail is afforded this kind of protection because
you place it in the hands of the state. Are you sure you want do do this
with your email? And besides, the postal service can (and does) do more
with your mail than just deliver it to the intended recipient ("Return to
sender...",
calls police if your package contains a slab of C4).

Making the postal mail / email analogy is troublesome. The two systems 
are based on radically different models. For the post/mail, 
the infrastructure is owned and controlled by the state (or a contractor). 
The email infrastructure is owned by disparate entities who interoperate
by "common consent".

If you must use an analogy, a better one might be that of a carrier not the
state postal service.  Does stuff carried by UPS (say) have this kind of
protection? Are UPS (say) within their rights to refuse to deliver items
that
(after collection) they judge are in violation of their conditions for
carriage?.
Is a consignee at liberty to refuse a delivery for whatever reason? 
Even this analogy is poor, since many 
(but not all) carriers do "end-to-end" transport which is not required in
email.

I agree that a upstream system which blocks mail should be (ideally)
operated with the *consent* of the "recipient", but this is largely 
a matter for the contractual relationship between the provider and 
their customer. The idea of common consent supports a transport entitys 
right to refuse traffic which doesn't fit their consent model 
- that's the way things are.

--

---

From: "Jon Kyme" <[email-masked]>
Date: Tue, 15 Apr 2003 10:08:33 +0100

> 
> What I would propose instead that the filter systems, and hence the
> management and reviewing systems, by made simple enough that even the
> "neo-beginner" user can get thru it and understand to a large extent how
> things work and how to set it up for their own needs, situations, and
> preferences.
> 
> This I believe would be a much more worthwhile project for us to work
> towards. It provides a much more user friendly system to handle a
> somewhat complex task.

This has been proposed in this group before... I think this is a concrete
example of the "consent-expression" problem. This is something that at
least
2 contributors were (are?) working on.  I'm still trying to spec out an
"upstream filter configuration" mechanism.  Once you have that, it should
be relatively easy to slap a nice (web?) interface on it. I'm trying to
sell this to my boss now so that I can expend work time on it.

---

From: "John Fenley" <[email-masked]>
Date: Tue, 15 Apr 2003 15:00:54 -0600

>From: Daniel Feenberg <[email-masked]>
>On Mon, 14 Apr 2003, John Fenley wrote:
>
> >
> > Yes, if the isp does not block messages passing through their system to
> > non-customers. Here in utah there are many isps that advertise that they
> > block adult content, and msn advertises it's spam filtering heavily.
>
>Huh? Why would non-customer mail flow through a system? Is every ISP to be
>required to run an open relay? Or are you saying that an ISP can't filter
>spam for customers of customers? That would just be another way of
>preventing ISPs from purchasing filter services, which would deprive them
>of the most effective method of responding to their customers demands.

I am not going to restate my answer, though I will clarify.
Net traffic can flow across an isp as part of isp level peer to peer 
connections that are there for redundancy. An isp that transfers traffic 
between 2 other isps would be one example of a THIRD party.

John Fenley

_________________________________________________________________
Add photos to your e-mail with MSN 8. Get 2 months FREE*.  
http://join.msn.com/?page=features/featuredemail

---

From: "Eric D. Williams" <[email-masked]>
Date: Thu, 17 Apr 2003 09:34:28 -0400

I agree,

IMHO, continued focus on 'lawyering' is not an appropriate pursuit.  Indeed, we 
should consider the impact of developing a solution and how it may be used to 
leverage legal frameworks or enforcement but if we are attempting to define a 
legal solution, I think that is best left to 'legal' society.  This is a 
technical forum and (as I said, we should consider but...)  we should be 
focused on technical solutions/approaches.

-e

On Wednesday, April 16, 2003 10:30 PM, Vernon Schryver 
[SMTP:[email-masked]] wrote:
>
> 8<...>8
> My suggestion is to leave the lawyering to the lawyers, including the
> familiar controversy over whether DNS blacklists only recommend and
> never block.  Even if we get the lawyering right, the lawyers will
> insist on re-doing it.
>
>
> Vernon Schryver    [email-masked]

---

From: "Eric D. Williams" <[email-masked]>
Date: Thu, 17 Apr 2003 13:20:13 -0400

Any 'legal' measures will --and the thought I have is 'will always'-- be 
subject to the jurisdiction of the legislation. We can not design a solution to 
address that broad a spectrum of contingencies.  Instead, we should focus on 
the technical approach that may be adopted where it can be adopted.  In some 
jurisdictions it may not be possible to adopt methodology #1, but it may be 
possible to adopt methodology #2, etc...

The inherent issue I see in trying to develop something that has such a wide 
gamut of possible legal impediments or supports is that it must work in the 
first instance and be configurable to work within a stipulated legal framework 
in the second.  So I am not saying these issues should not be considered at 
some level but rather that it can not be addressed outside of the technical 
architecture of the solution/methodology, e.g. configurability.  No engineering 
solution to a subjective 'problem' will be purely technical, and as you say 
that may present other problems, however -- this is a technical forum -- we 
should be working on the first instance (the technical solution) prior to 
engaging into debate about how a particular jurisdiction will manage the 
deployment of such a technology.  That is their problem or benefit, so to 
speak, but only if we can develop a viable candidate solution/method.

Concerning the commercial realities involved surely you would agree that 
providing a service for a fee to whomever is 'spamming' would not be in the 
best interest of a 'provider' who would flagged or otherwise technically 
penalized by a viable solution - regardless of it's legalities.  Losing the 
legal case is not going to stop spamming from occurring if in fact it is 
illegal it will become an enforcement issue, if the legal case is won it will 
become a control issue.  Either way technical measures must be employed to 
manage the 'problems' associated with 'it'.

If we approach the technical solutions for enforcement and/or control, we will  
 likely fall right in the middle of any legal framework or jurisprudence 
where that is an issue.

my $.02

-e

On Thursday, April 17, 2003 11:47 AM, Tom Thomson 
[SMTP:[email-masked]] wrote:
> White, Sam wrote on 17 April 2003 15:37
>
> >I also agree.  Legal solutions are already being worked on, but are never
> >going to be sufficient to adequately solve the problem.  The most that a
> >legal solution can do is bring some measure of uniformity to the law,
> making
> >spam easier to address.  The only true, effective solution is going to be a
> >technical one, IMHO.
>
> I think there is an inherent problem in any purely technical approach: if
> something is legal, it may turn out to be illegal to take measures to
> prevent it.  Obviously this is not going to impact filtering by receivers,
> but do we want to waste our time filtering?  Technical activity other than
> by receivers or those acting explicitly as their agents may fall found of
> the law unless it has a clear legal basis.
>
> Surely there are sever problems inherent in any purely technical approach
> that ignores the commercial and legal realities that have given rise to the
> problem?  Shouldn't technical measures be devised bearing in mind the legal
> environment in which they will be deployed, and taking into account also the
> commercial relaities?  While some ISPs are making a lot of money out of
> providing services to spammers, they are not going to adopt technical
> measures against the spammers unless legally or commercially compelled to do
> so (and maybe legal compulsion won't work without commercial penalities on a
> scale that outweighs the profit from spammer-support activities).
>
> In the EU at least, spam is (or will shortly be) illegal.  ISPs to do not
> take action to prevent their systems to be used for spamming will be
> negligently enabling an illegal activity, which in at least some EU
> jurisdictions will itself be an offence and in most if not all will leave
> the ISPs open to civil action by the spammers' victims.  I'm not too sure
> what the state of US law is, but http://www.camblab.com/nugget/spam_03.pdf
> suggests that US law could be used quite effectively to combat US based
> spammers (by compelling ISPs and backbone providers to enforce their
> contracts).
>
>