Subject: Re: [Asrg] Implicit Consent (was: Another criteria for "what is spam"...)

From: Bill Cole <[email-masked]>
Date: Thu, 5 Jun 2003 10:21:24 -0400

At 8:37 AM -0400 6/5/03, Dave Aronson wrote:
>"Peter Kay" <[email-masked]> wrote:
>
>  > A recipient implicitly approves of receiving email from a given
>  > sender if the recipient has previously sent email to the sender
>  > and the recipient has not explicitly requested to not receive
>  > further email from the sender.
>
>Nope.  X spams Y.  Y, recalling advice never to contact a spammer
>directly, reports it to ISP(X) for punishment and ISP(Y) for blocking,
>but does NOT request removal.  X has certainly NOT thus implicitly
>consented to X's next spam-run!

I think you have your X's and Y's mixed up.

In your example, Mr. Kay's axiom would imply that X has implicitly 
given permission for Y to mail him.

I think that's sound.

-- 
Bill Cole
[email-masked]

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 5 Jun 2003 09:39:57 -0600 (MDT)

> From: Bill Cole <[email-masked]>

> I think you have your X's and Y's mixed up.

the mistake I made.

> given permission for Y to mail him.

Are you sure of that?  Thinking about it some more, I think those
words not only confuse some of us but are dangerous.

Y surely already has permission to send non-bulk mail to X if Y has
legitimate possession of X's address (e.g. found somewhere open like
the archives for this list instead of bad means such as dictionary
attacks).
Saying that X's mail somehow gives more permission suggests that Y
has permission to do more.  
Would sending a message to Verisign asking about the real owners of
an odd certificate owned supposedly by "Microsoft Corporation" give
Verisign permission to flood your mailbox with their familiar stream
of messages about Verisign products?

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Dave Aronson <[email-masked]>
Date: Thu, 5 Jun 2003 12:18:24 -0400

Bill Cole <[email-masked]> wrote:
 > > directly, reports it to ISP(X) for punishment and ISP(Y) for
 > > blocking, but does NOT request removal.  X has certainly NOT thus
 > > implicitly consented to X's next spam-run!
 >

Oops, yes, you're right, sorry, mea culpa, etc.  Too much blood in the 
coffee stream indeed....

-- 
David J. Aronson, Unemployed Software Engineer near Washington DC
See http://destined.to/program/ for online resume, and other info

---

From: "Richard Johnson" <[email-masked]>
Date: Thu, 5 Jun 2003 13:19:36 -0600

> given permission for Y to mail him.

It's sound only when given a sunset provision.

If I request a quote from a vendor, they should respond with a quote.
However, they may -not- add me to their newsletter (or any other continuing
stream of marketing jive) just because I requested a quote. [1]

The implicit permission has to be limited by the context of the initial
exchange, or we end up with just another excuse for Y spamming X.

Richard

[1] Example: I requested a PKI CA quote from Verisign, via telephone, and
gave my email address to an engineer only after instructing him to keep it
out of the hands of marketing.  They slammed me into their newsletter
anyway (repeatedly -- one of the RISKs of grepping /var/log/maillog is that
you pick up those complaining and re-add them).  They lost the $50k+renewal
as a result.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Troy Rollo <[email-masked]>
Date: Fri, 06 Jun 2003 06:24:27 +1000

>>  > further email from the sender.

This over-simplifies matters. You can't simply ask if there is implied 
consent to receive email generally - you have to ask if there is implied 
consent to receive a particular message with all the attributes of the 
particular message received.

This brings us back to the example of an open store. There is implied 
consent to enter for the purpose of browsing or buying, but if you enter 
for the purpose of robbing, then your entry is legally a trespass. If you 
enter wearing a sandwich-board advertising a nearby competitor, your entry 
is a trespass.

Generally, sending somebody a message isn't generally not going to create 
new implied consent for a message that was not already within the scope of 
the implied consent that arises just by having an accessible email address.
--
Troy Rollo				Chairman, CAUBE.AU
[email-masked]			Executive Director, iCAUCE