Subject: RE: [Asrg] Another criteria for "what is spam"...

From: "Peter Kay" <[email-masked]>
Date: Tue, 3 Jun 2003 15:30:04 -1000

This is good. I can see we will have several definitions of spam and we
need to. Spam is many things and certain technologies will have
strengths and weaknesses against each of those definitions. Once we have
a list of definitions we feel good about it will be much easier to
evaluate the the solutions.

Here's mine:

Spam is transmission of mass email without the prior explicit
authorization of the recipient.  

> -----Original Message-----
> From: Eric Brunner-Williams in Portland Maine 
> [mailto:[email-masked]] 
> Sent: Tuesday, June 03, 2003 1:53 PM
> To: Barry Shein
> Cc: [email-masked]; [email-masked]
> Subject: Re: [Asrg] Another criteria for "what is spam"... 
> 
> 
> Barry,
> 
> This doesn't (yet) identify the economic issue(s).
> 
> If the definition doesn't make the DMA scream, it should.
> 
> It is also source-centric (and we know that sources "twinkle").
> 
> Eric
> _______________________________________________
> Asrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/asrg
> 
> 
> 

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 04 Jun 2003 12:31:00 -0400

At 03:30 PM 6/3/2003 -1000, Peter Kay wrote:

>[..]
>[..]

 From the charter (http://www.irtf.org/charters/asrg.html):

"The definition of spam messages is not clear and is not consistent across 
different individuals or organizations. Therefore, we generalize the 
problem into "consent-based communication". This means that an individual 
or organization should be able to express consent or lack of consent for 
certain communication and have the architecture support those desires."

Yakov

---

From: Bill Cole <[email-masked]>
Date: Wed, 4 Jun 2003 14:53:14 -0400

At 10:16 AM -0700 6/4/03, Hallam-Baker, Phillip  imposed structure on 
a stream of electrons, yielding:
>>  >>The student sends the same query for assistance to each of
>>  these people.
>>  BC> Oh, you mean survey spam?
>>
>>  No, this is nothing like a survey. A survey is a formal, structured
>>  measurement instrument.
>
>Actually that raises a point here, we want to allow reasonable surveys (for
>some definition of reasonable)

Yes.
I have a sneaking suspicion that your definition of reasonableness is 
quite different from mine. I would define a reasonable survey as one 
where the respondent has verifiably asked to be sent surveys from the 
surveying party.

The perfect example of this problem is Harris. They used to spam to 
conduct their polls. They claim (and indeed seem) to have ceased 
using spam, even though the result is that they are now polling 
people who choose to be polled.

>but you want to ban push polls where there is
>no actual interest in soliciting opinion, the purpose is to spread
>information or a political position "Do you believe that the tax cut that
>gives 99% of its benefits to rich Texas oilmen is fair or unfairly benefits
>the rich"
>
>There is no way for the end recipient to know the difference.

Which points out again that it is a bad idea to try to view spam as a 
content issue instead of a simple consent issue.

>>  I'm talking about someone trying to chat up some folk about a topic of
>>  interest.
>
>I think it is reasonable to poll larger groups, provided that there number
>of surveys sent is no more than is necessary for reasonable statistical
>accuracy and the subject is something the recipients are at least likely to
>not object to.

I feel no guilt for having damaged the academic careers of at least 2 
onetime PhD candidates clueless enough to have tried that bit of 
stupidity.

>I don't see why we should stop classes of high school kids doing Internet
>surveys for class projects. But there is no reason each high school should
>poll the entire net.

I like the simple reason that high school students should not be 
taught to use intrinsically flawed research methods which have 
built-in validity problems and steal resources from every potential 
respondent, even the ones who do not want to participate.

[...]>
>Also a jury of spam monitors could give a verdict on the conduct of an
>alleged spam sender and revoke a credential on the basis of that definition.
>
>
>[ObDisclosure, VeriSign Inc. has pending patent claims that may cover
>certain implementations of such a scheme]
>[ObFact, Filing a patent claim is empirically the only way to prevent the
>USPTO granting a patent to another party, so don't get tweaked yet]

My disclosure: I do no business with Verisign and regularly recommend 
that others do no business with Verisign.

Care to guess why?

The concept of Verisign running any sort of anti-spam system is mind-boggling.
-- 
Bill Cole
[email-masked]

---

From: [email-masked]
Date: Wed, 4 Jun 2003 18:03:31 -0700

On Wed, Jun 04, 2003 at 03:57:28PM -0700, Hallam-Baker, Phillip wrote:
> The problem I have is the fact I get 300 spams a day. The fact that those
> spams are also sent to 10 million or so others is not relevant to me. My
> problem is the fact that *I* am getting the messages. I would have exactly
> the same problem if I was the only person who got that quantity of messages.

Reality is that you get that quantity of messages because of the fact of
bulk mailings, and hence bulk mailings are relevant -- at least to the
extent that reality is relevant.  :-)

To put it another way, if bulk mailing was eliminated, your spam
problem, along with everyone else's, would be eliminated.

Kent

-- 
Kent Crispin                               "Be good, and you will be
Manager of Technical Operations, ICANN      lonesome."
[email-masked],[email-masked]                    -- Mark Twain
               p: +1 310 823 9358  f: +1 310 823 8649
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Eric D. Williams" <[email-masked]>
Date: Wed, 4 Jun 2003 22:44:01 -0400

> certain communication and have the architecture support those desires."

Yes, that is the issue.  The ability 'to express consent or lack of consent for 
certain communication and that the architecture support those desires'.  To me 
that is a sort of 'policy enforcement mechanism,' the over-arching question/s 
is/are:

- can such a policy mechanism be architected?
- how is such a 'policy mechanism' described in technical terms, e.g. that can 
be expressed within an 'architecture'?
- what are the essential components of the policy decision?
- what are the essential technical aspects of the 'policy decision engine'?
- what is the placement of the 'policy decision engine' - core vs. edge?
- what are the user definable aspects for instantiating policy decisions?
- what are the measured attributes for determining policy conformance or 
violation?

IMHO the rest are implementation specific decisions, I have left some of the 
research areas out, that is intended.  I have included some that are personal 
preferences, that is also intended.  I feel that this can be cast as an 
engineering problem, but it currently does not have a consensus driver for all 
of the involved players, essentially the target community for compliance review 
are 'rouge players' and demonstrate adaptability designed to be contrary to the 
policy decisions which we are attempting to fix upon their activity.  That is 
the significant issue.

There is perhaps a additional track here concerning the 'fuzziness' approach 
that Vernon mentioned in the decision processes for 'making a determination'. 
 Such an approach requires a collaborative approach for components in the 
'decision engine'.  No one part can do it all, IMHO.

-e

---

From: "Peter Kay" <[email-masked]>
Date: Wed, 4 Jun 2003 20:53:20 -1000

I didn't define the explicit side as that's pretty easy to define. It's
the implicit definition that I felt was difficult. 

> From: Barry Shein [mailto:[email-masked]]
> Sent: Wednesday, June 04, 2003 5:10 PM
> To: Peter Kay
> Cc: Barry Shein; [email-masked]; Hallam-Baker, Phillip;
[email-masked]
> Subject: RE: [Asrg] Another criteria for "what is spam"...
> 
> 
> Ok, and if you get overloaded with spam then it's only because you're
> too poor and unimportant to have a secretary sort through your mail
> for you.
> 
> Anyhow, you ignored the part about defining what a legitimate
> solicitation is, is buying an airline ticket sufficient? etc.
> 
> 	     -b
> 
> On June 4, 2003 at 16:43 [email-masked] (Peter Kay) wrote:
>  > What you say may be true but its way out of scope here. If your
>  > subscribers sign up for email solicitations and that overloads your
>  > infrastructure, you've definitely got some cost recovery to deal
with
>  > but we don't have a UBE problem.
>  >
>  > > From: Barry Shein [mailto:[email-masked]]
>  > > Sent: Wednesday, June 04, 2003 4:39 PM
>  > > To: Peter Kay
>  > > Cc: [email-masked]; Hallam-Baker, Phillip; [email-masked]
>  > > Subject: RE: [Asrg] Another criteria for "what is spam"...
>  > >
>  > >
>  > >
>  > > On June 4, 2003 at 15:53 [email-masked] (Peter Kay)
>  > > wrote:  > Yes but we can't define bulk mailing as spamming.
>  > > But we CAN define that  > UNSOLICITED bulk email is spamming.
>  > >
>  > > Actually, I'm not that uncomfortable with defining any "bulk
>  > > mailing" as spamming.
>  > >
>  > > I realize I won't get consensus on that here.
>  > >
>  > > But then again few of you are ISPs expected to just come up
>  > > with the money for resources for every blitz by every fortune
>  > > 1,000,000 company who decides to unload on their (let's say
>  > > for argument's sake) legitimate mailing list hourly.
>  > >
>  > > Special fares at United Airlines? Delta? Wham! Here comes
>  > > 10,000 msgs you frequent flyers!
>  > >
>  > > Campbell's has a new recipe they want to share? Open wide!
>  > >
>  > > NY Times, Wall St Journal, Motley Fool, Salon, etc want to
>  > > send their daily headlines and advertising payload? K'POW!
>  > >
>  > > And don't tell me subscriber fees are supposed to cover this.
>  > > There's almost total disconnect as marketeers get savvier
>  > > about exploiting this medium.
>  > >
>  > > That's like wishing your property taxes covered the postage
>  > > for junk paper mail. What a stupid idea that would be! Or
>  > > that there should be no postage paid by magazines because you
>  > > subscribed to them.
>  > >
>  > > This exercise is kinda like watching legislators make law,
>  > > the OTHER guy's use of tax money is a waste, but MY use of
>  > > tax money is essential to civilization!
>  > >
>  > > Replace "tax money" with "ISP's resources" and you've got my
>  > > point of view.
>  > >
>  > > This is why, without per-message fees, this system is doomed.
>  > > It's just a matter of time.
>  > >
>  > > What we're doing here might postpone doom for a while by
>  > > freeing up resources for blessed floods of bull****, and
>  > > those are mostly my (and
>  > > kindred) resources being freed so I have an interest in that
>  > > happening. But in my opinion not too far in the future the
>  > > current e-mail architecture will just collapse.
>  > >
>  > > One reason why is because the day you stop or minimize spam
>  > > the so-called "legitimate" marketers from those fortune
>  > > 1,000,000 companies will realize that their message will now
>  > > get through and will no longer be confused with those of
>  > > total con-men and scams.
>  > >
>  > > And those marketeers actually have money to spend. P&G spends
>  > > $3B a year on advertising, etc. Need I go on?
>  > >
>  > > They're just waiting on the sidelines for you to build a
>  > > nice, level road for them to drive on, for free.
>  > >
>  > >
>  > > --
>  > >         -Barry Shein
>  > >
>  > > Software Tool & Die    | [email-masked]           |
>  > > http://www.TheWorld.com
>  > > Purveyors to the Trade | Voice:
>  > > 617-739-0202        | Login: 617-739-WRLD
>  > > The World              | Public Access Internet     | Since
>  > > 1989     *oo*
>  > >
>  > >
>  > >
>  >
>  >
> 
> --
>         -Barry Shein
> 
> Software Tool & Die    | [email-masked]           |
http://www.TheWorld.com
> Purveyors to the Trade | Voice: 617-739-0202        | Login:
617-739-WRLD
> The World              | Public Access Internet     | Since 1989
*oo*

---

From: Bill Cole <[email-masked]>
Date: Thu, 5 Jun 2003 10:21:54 -0400

At 11:09 PM -0600 6/4/03, Vernon Schryver wrote:
>>  From: "Peter Kay" <[email-masked]>
>
>>  ...
>>  Spam is defined as unsolicited bulk email
>>
>>  Bulk email is defined as the transmission of 2 or more emails via a
>>  primarily automated process.
>>
>>  Unsolicited email is defined as email where the recipient has not
>>  implicitly or explicitly approved of receiving email from the sender.
>>
>>  Sender can mean an individual or an organization.
>>
>>  A recipient implicitly approves of receiving email from a given sender
>>  if the recipient has previously sent email to the sender and the
>>  recipient has not explicitly requested to not receive further email from
>>  the sender.
>
>
>I'm sorry, but I find that last paragraph very wrong.  Silence in the
>face of spam is never consent to more spam!

I don't think that's what Mr. Kay's axiom says.

I am not sure that what he did say there is really universally 
applicable, since it might imply that I am subscribing to Verisign's 
spam by mailing one of their employees, but for most cases involving 
individuals it is sound.
-- 
Bill Cole
[email-masked]

---

From: "Beadles, Mark A" <[email-masked]>
Date: Fri, 6 Jun 2003 14:46:26 -0000

>From: "Peter Kay" <[email-masked]>

Amplifying on Vernon's comments, and an observation of my own concerning
"intent" as an element of a spam definition.

> primarily automated process.

This definition would include any use of Cc: (or indeed 2 or more To:
recipients) as "bulk email".  Use of multiple recipients or cc: results in
the transmission of 2 or more emails, one to each recipient, through a
primarily automated process.    The problem is the fuzziness of the noun
"email".   How do you "count" emails?  From a sender's point of view, one
email is sent.  From the recipients' aggregate points of view, multiple
emails are received.  

Any definition of spam that would include a normal message cc'ed to one
other person is broken.

> Spam is defined as unsolicited bulk email

Also, regarding "unsolicited":  there are shades of gray there. A government
representative/parliament member/etc. may by default be assumed to have
solicited emails from any member of his/her consistuency (without having to
individually consent to/solicit transmissions from each consistuent).  This
does not mean they also have by default solicited advertisements for growth
creams.  

Similar examples would be a newspaper editorial desk or a commercial
complaints department.  These recipients could be assumed to have solicited
email from any sender, and in the case of the editorial desk, on any
subject, but again, this does not mean that all emails whatsoever have been
solicited.

*****

A good criteria for "what is spam" would seem in my opinion to be based on
the _intent_ of the sender.  This is of course an elusive thing to measure
via protocol or filtering rules.  Intent is often measured by other
non-human systems using techniques such as:

* Heuristics (which could be implemented at sender, relay, or recipient)
which gauge intent and apply filtering, marking or classification
* Improved human-computer interaction at the sender, which measures intent
of the sender interactively
* Imposing some form of cost (not necessarily financial) upon the sender,
causing the sender to self-impose heuristics related to intent

One issue with the above techniques is that access to raw SMTP allows some
of the above to be bypassed (notably any measures taken within the sender's
client).  However, measures implemented within the relay or at the recipient
end, as well as certain cost-based measures, could still be quite effective
at measuring intent.

+ Mark Anthony Beadles  + [email-masked] +
+       Chief Architect + SmartPipes, Inc.        +
+   Vox 614.923.5657    +     Fax 614.923.6299    +