Subject: RE: [Asrg] Implicit Consent (was: Another criteria for "what is spam"...)

From: "Peter Kay" <[email-masked]>
Date: Thu, 5 Jun 2003 07:59:36 -1000

I would say that if you sent verisign an email ( and that email was NOT
asking to no longer receive emails) that, yes, there is an implied
consent to communicate with verisign. And yes, if they "flooded" you
with messages about their products, it is NOT UBE (I still may not like
it, and I may even hate it, but its not UBE).

However that also means that if you tell Verisign "stop" and they still
keep sending, its UBE.  If Verisign ever sends you messages about their
products without ever receiving implied or explicit consent from you,
its UBE.

It also means that if, on the signature of your email, you EXPLICITLY
state you do not want to receive any bulk email, and they ignore that
EXPLICIT request, its UBE.

There's a difference between mail we don't want to get, bad practices of
various vendors, and UBE.  If we can keep this thread on defining the U
and B along nice, thick black lines, then we have a clear definition of
UBE. 

We can never claim that people will never receive an email that they
don't like or want,  we can't help ISPs figure out how not to lose money
accepting email, and we can't stop your uncle from sending you stupid
jokes, but we can certainly look at an email and say, "yes, that's UBE"
or "no, that's not UBE".

And then we can make sure our technology solutions are in-line with the
scope of the problem that UBE defines.

Peter

> -----Original Message-----
> From: Vernon Schryver [mailto:[email-masked]] 
> Sent: Thursday, June 05, 2003 5:40 AM
> To: [email-masked]
> Subject: Re: [Asrg] Implicit Consent (was: Another criteria 
> for "what is spam"...)
> 
> 
> > From: Bill Cole <[email-masked]>
> 
> > I think you have your X's and Y's mixed up.
> 
> the mistake I made.
> 
> > In your example, Mr. Kay's axiom would imply that X has implicitly
> > given permission for Y to mail him.
> >
> > I think that's sound.
> 
> Are you sure of that?  Thinking about it some more, I think 
> those words not only confuse some of us but are dangerous.
> 
> Y surely already has permission to send non-bulk mail to X if 
> Y has legitimate possession of X's address (e.g. found 
> somewhere open like the archives for this list instead of bad 
> means such as dictionary attacks). Saying that X's mail 
> somehow gives more permission suggests that Y has permission 
> to do more.  
> Would sending a message to Verisign asking about the real 
> owners of an odd certificate owned supposedly by "Microsoft 
> Corporation" give Verisign permission to flood your mailbox 
> with their familiar stream of messages about Verisign products?
> 
> 
> Vernon Schryver    [email-masked]
> _______________________________________________
> Asrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/asrg
> 
> 
> 

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 5 Jun 2003 12:28:46 -0600 (MDT)

> From: "Peter Kay" <[email-masked]>

> it, and I may even hate it, but its not UBE).

I strongly disagee with that notion.  It is not justified by the
need to make the crime of spam well defined.  Instead, you need
only require that Verisign have evidence that a reasonable person
would agree is a solicitation for bulk mail.  A message saying
"tell me how to use PKI" would probably qualify as a solicitation,
particularly given the educational facade of the Verisign spam.
However, there is no honest justification for treating a message
asking "Is the enclosed cert for Microsoft Corporation for the
organization in Redmond or a repetition of the infamous fraud?" as
a request for Verisign's familiar spam.

> ...

In the real world, absolutely no one wants all bulk mail.  Absolutely
everyone who knew it would be effective would add that phrase to their
signatures.  That is another way of stating the obvious fact that bulk
mail is not implicitedly solicited by any and all communications from
the victim.

> and B along nice, thick black lines, then we have a clear definition of

Again, it is impossible and undesirable to draw thick black lines that
separate spam from non-spam, except for our computers that we know
are too stupid to see the real, fuzzy lines.  Any line thick enough
to be seen by computers will overlap some hard cases and so controversial
cases.  It is impossible to avoid all controversy about whether mail
is spam, just as it is impossible to avoid all controversy and even
injustice about all cases of burglarly and insider trading.  There
will always be gray areas.  Simplistic definitions cannot work and
only give aid and comfort to spammers.

> jokes, but we can certainly look at an email and say, "yes, that's UBE"

Yes, but there will always be fuzzy cases where reasonable people
will disagree, just as with insider trading and burglarly.

> scope of the problem that UBE defines.

That is just as true of technical spam defenses as burglar alarms and
the SEC's insider trading detection systems.  The techncial machinery
can do a good job, but it can never be even as imperfect as we are
(at least not until we have truely thinking and understanding computers).
There will always be cases where the machinery gets it wrong, as well
as cases where we can't agree on what's right.

Insisting that the machinery be absolutely in-line with what we think
is spam is equivalent to the obvious nonsense that false positives
and false negatives will never happen.

---

From: "Richard Johnson" <[email-masked]>
Date: Thu, 5 Jun 2003 13:53:28 -0600

> products without ever receiving implied or explicit consent from you,

I believe there is no way to safely manage "implied consent" for BE
streams.  Consent for such needs to be explicit.

> EXPLICIT request, its UBE.

I think that's where your implicit consent assumption falls apart.
Everyone would put a "no BE" statement in their .sigs if it were going to
work to prevent slamming into BE streams. [1]

The reasonable assumption made when sending email is that responses will be
topical and will not, unless explicitly requested, involve a stream of BE.

"Implied consent" interpreted overly broadly, such as allowing the sender
to assume some kind of signup for BE after receiving any mail, inevitably
leads to spamming.

If I don't explicitly and knowingly sign up for a stream of BE, then it's
UBE regardless of what the -sender- claims.

Richard

[1] For example, the one I include on mail to vendors didn't work against
Verisign, or NetLux, or Thawte-pre-Verisign, or...
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Troy Rollo <[email-masked]>
Date: Fri, 06 Jun 2003 06:53:42 +1000

>streams.  Consent for such needs to be explicit.

I would go further and say that rather than logistical difficulties, there 
is never implied consent for bulk email. The reason for this is that it's 
simply not necessary to have implied consent for bulk email in the cases 
where it is suggested that implied consent might exist. In those cases, 
there is already a 1:1 communication stream underway. This means that the 
potential sender has an opportunity to seek explicit consent. Failure to do 
so is done out of either (a) laziness; or (b) a failure to care about 
whether there really is consent. In fact if you're assuming consent in such 
cases, you know that as part of your operation you will be hitting, people 
who do not consider there to be implicit consent.

As I have mentioned before, consent is a legal concept, and being a legal 
concept there are some broad guidelines for how to determine when consent 
it implied. If you're interested in this in more detail, I would recommend: 
Young P, "The Law of Consent", Law Book Co, Sydney, 1986. Although this 
book is not exhaustive of the concept, it's the closest thing I've found to 
a canonical discussion of the issues of consent.

One survey in 2000 (<http://businessweek.com/2000/00_12/b3673010.htm>, see 
under heading "ONLINE BUYERS DREAD JUNK MAIL") pegged the number of users 
who do not regard a pre-existing relationship as giving consent to 
marketing material at 78%. The figures have increased over time, so the 
position that pre-existing relationships mean implied consent for bulk 
email reflects neither a practical necessity nor the views of the people 
who are receiving the bulk email (and it is their views that matter for the 
question of the existence of implied consent, not the desires of the vendors).

Even if the figures were turned around, you couldn't really claim implied 
consent. Implied consent would only arise where no reasonable person would 
regard the communication as not requiring implied consent. You'd have to 
either get the numbers of people who object to this practice down to 
something under 5%, or demonstrate that there is something in the 
circumstances that makes their view unreasonable. The fact that the 
contrary behaviour is normal practice of vendors does not make the view 
unreasonable.
--
Troy Rollo				Chairman, CAUBE.AU
[email-masked]			Executive Director, iCAUCE