Subject: [Asrg] Another criteria for "what is spam"...

From: Barry Shein <[email-masked]>
Date: Tue, 3 Jun 2003 19:33:28 -0400 (EDT)

I've been thinking about the various definitions of "spam" and thought
of another criteria which isn't necessarily mutually exclusive but
captures something important:

  Spam is e-mail from a source which is hard to impossible for
  the recipient to stop and/or reasonably prevent from receiving.

I think the loss of control is very much at the heart of spam and many
other attempts at definition dance around this somewhat.

We could add the usual unwanted, unauthorized qualifications to that
(I may not want to hear from my sysadmin but s/he's authorized, etc.)
but it would just make this note much longer and I think it's enough
to toss out the basic idea.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Tue, 03 Jun 2003 19:52:39 -0400

Barry,

This doesn't (yet) identify the economic issue(s).

If the definition doesn't make the DMA scream, it should.

It is also source-centric (and we know that sources "twinkle").

Eric

---

From: Bill Cole <[email-masked]>
Date: Tue, 3 Jun 2003 21:51:20 -0400

>   the recipient to stop and/or reasonably prevent from receiving.

Ungrammatical definitions provide no utility whatsoever.

If you are trying to say what I think you are trying to say, it's 
also neither necessary nor sufficient.

Spam is email which is sent without a well-founded belief on the part 
of the sender that he has the specific permission of the recipient to 
send that mail and which is substantially identical form to mail sent 
to multiple recipients.

In short: unsolicited bulk email.

I do not see why it needs redefining.
-- 
Bill Cole
[email-masked]

---

From: Dave Crocker <[email-masked]>
Date: Tue, 3 Jun 2003 23:47:22 -0700

Bill,

BC> Spam is email which is sent without a well-founded belief on the part
BC> of the sender that he has the specific permission of the recipient to
BC> send that mail and which is substantially identical form to mail sent
BC> to multiple recipients.

Imagine a student who is researching a paper and hears about a number of
different people who might have relevant knowledge.

The student does not know any of these people. The means by which the
student obtains the names (and email addresses) of these people is not
through "mutual friends", nor public rendezvous mechanisms (such as web
pages listing addresses), nor anything else that might be construed as
giving permission, explicit or otherwise...

The student sends the same query for assistance to each of these people.
It does not matter whether the student sends a different copy (with the
same text) to each recipient or puts all of the recipients into the
address list of the same.

And there are many reasonable examples of scenarios, like this, which
qualify as spam, according to your definition, but would not qualify as
spam to the general community of email users.

d/
--
 Dave Crocker <mailto:[email-masked]>
 Brandenburg InternetWorking <http://www.brandenburg.com>
 Sunnyvale, CA  USA <tel:+1.408.246.8253>, <fax:+1.866.358.5301>

---

From: Dave Crocker <[email-masked]>
Date: Tue, 3 Jun 2003 23:52:19 -0700

Folks,

Given the direction of this thread, here is a note I posted on the ietf
list's discussion of spam.

We really need to start appreciating the social impact that simplistic
definitions will have:

TH>  Spam
TH> is a social problem, not an engineering one. I contend that is why we
TH> already have a research group dealing with it (social problems are
TH> inherently difficult for engineers, thus requiring research to figure
TH> out). Focus the group on a tangible engineering problem, deployable
TH> authenticated email. Or as Vixie labeled the more generic, interpersonal
TH> batch communication system. 

The example of theft vs. locks provides a good perspective on both the
truth of your observation and the necessity that we take (appropriate)
action.

The key insight that comes from saying "social problem" is not that we
should do nothing, but that we need to have a shared agreement on the
details of the problem and the level of protection required.  And we
need to respond to it with appropriate, but limited, changes.

We are all quite comfortable making a distinction between the protection
needed for a home vs. protection for a facility holding a nuclear bomb.
We even are reasonably comfortable distinguishing what is needed for a
home in a idyllic "safe" environment versus one in a strife-torn
hell-hole.

No one believes that a house lock keeps out all intruders, and indeed
some do get in. But we *do* believe that house locks reduce the threat
to a socially acceptable level.

We have no such clarity or consensus about spam.

Worse, we *all* are seriously ignorant about solutions. Anyone who says
that they know the magic fix is blowing smoke.

First of all, there is not yet any existence proof for the reduction of
spam. Some interventions have reduced some aspects of spam, but the
total size of the beast has only been growing, and rapidly. There is a
key lesson here and it is mostly missed. The lesson is that spammers are
adaptable and -- as is true for all security threats -- raising the bar
keeps out the riff-raff but the truly serious attackers will develop a
different technique. In the case of spam, those serious attackers have
disproportionate leverage, because their software can be used by
less-serious drones.

More importantly, by saying "social problem" we are correctly implying
social *complexity*. Messaging touches core aspects of social processes.

No one knows how to "engineer" one property of a complex social process
without accidentally impacting others. And they key import of the word
"accidentally" is that these unintended consequences are typically
undesired.

This does not mean we should do nothing. Nor does it mean that there
should be no technical interventions.

It *does* mean that we need to treat this as an incremental systems
change process.

It *does* mean that we will need multiple types of changes, not just one
cure-all.

It *does* mean that we should approach those changes very cautiously,
even experimentally.

The place to start is with a modest, objective, operationalizable
definition of the thing we all agree needs to be handled differently.
So, let's not worry about the all-encompassing definition of spam. Let's
just -- hah! "just" he said -- target a single type of spam that is
massive and is massively offensive.

My personal favorite definition, these days, is

   Unsolicited Bulk Mail (UBE)
   
("Commercial" is too constrained, for me. I do not care whether the
message asks me for money, my vote, my religious affiliation, or simply
wants to share a bit of personal silliness with me.  In other words, the
detail of the content is irrelevant to me.  It does not even need to be
soliciting.)

Not all unsolicited mail is bad.  Not all bulk mail is bad.  But the
combination is universally reviled.

So we then need to define unsolicited properly. We must make sure to
permit me to make contact with someone for the first time. Not all cold
calls are bad; in fact they are essential to many desirable aspects of
social intercourse. We need to make sure that we define "permission"
properly -- as a kind of opposite to unsolicited -- and so we can then
enjoy wonderful debates about details such as double opt-in. And so on.
Still, I think the question of "unsolicited" is well-enough understood
to make it possible to get community rough consensus on a technical
definition that the engineering community can work with.

And we need to define bulk properly. This will be difficult. If I send
an unsolicited message to 2 people, does it qualify? What about 10
people, 100, 1000? Why? Why not?

The problem, here, is that I believe the qualifier "bulk" captures an
essential aspect of the problematic mail, so we can't simply drop the
term or say "anything greater than one".  Worse, the instant we choose a
number, the spammers will simply send batches that are one addressee
fewer than that maximum.

For that matter, the number of addressees per message might not be a
useful attribute, as marketeers have become good at tailoring content to
individual recipients, thereby producing one addressee per message. So
"bulk" requires considering behavior across multiple postings. Oh boy...

And that's why this is a research topic, no matter how essential it is
to to engineer some mechanisms sooner rather than latter. Let's do the
engineering and deployment, and let's do it quickly, but let's
appreciate that it is really research.

d/

---

From: Dave Aronson <[email-masked]>
Date: Wed, 4 Jun 2003 07:50:22 -0400

>   the recipient to stop and/or reasonably prevent from receiving.

Nope.  Even spammers who honor remove requests, and can be easily 
filtered out (e.g., they start Subjects with ADV), are still spammers.  
Methinks the best definition is still simply UBE.

-- 
David J. Aronson, Unemployed Software Engineer near Washington DC
See http://destined.to/program/ for online resume, and other info

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Wed, 04 Jun 2003 08:20:27 -0400

Not to pick on anyone in particular, but an in-reply-to is useful ...

	acquisition of addresses (e.g., harvesting, sale)
	acquisition of delivery platforms (e.g., robo-hosts)
	acquisition of address blocks (e.g., /24 blocks)
	acquisition of journaling devices (1x1 gif references)
	...

None of these puts a byte in an inbox, yet.

Eric

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 4 Jun 2003 08:02:08 -0600 (MDT)

> From: Dave Crocker <[email-masked]>

> spam to the general community of email users.

The error in that is common.  You are construing "unsolicited bulk email"
as if it were an aritimetic formula, effectively computable algorithm (the
formal notion related to "Turing computable"), or a statement in a first
order predicate calculus instead of a law or rule among people.

Consider the legal notion of "burglary."  It is not a first order
logical predicate but what a "reasonable person" sees as being in the
wrong place without permission and with bad intentions.  The fuzziness
of "wrong place," "permission," and "malice" is intentional and vital
and not a bug.

Look at "cracking" or "security attack."   There is no confusion there
(at least among us) despite the fact that the same set of packets can
be benign or an attack depending on circumstances.  We each act as
the legal word's notion of a "reasonable person" in that area.

If the student's query were "solicited" by its targets, then it would
not be "unsolicted bulk email."  If it were not solicited and it
involved what a reasonable person would consider lots of mail, then
it would be "unsolicited bulk email."   That "unsolicited" and "bulk"
are not defined legalistically and as a number is a feature instead
of a bug for the same reason that you don't say that every strange
UDP packet a "port scan."

It's odd how many people who are "reasonable" in the legal sense of
a "reasonable person" when confronted with a tcpdump trace or some
real mail but when talking about spam definitions turn into either
GFWs or Richard Stallmans of the 1980s demanding the inalienable right
to use any and all unused CPU cycles and disk space on other people's
computers.

(GFWs or "Goobers with firewalls" are experts with "personal firewalls"
who report "hacking" from the root's DNS servers.)

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Bill Cole <[email-masked]>
Date: Wed, 4 Jun 2003 10:28:34 -0400

>address list of the same.

Oh, you mean survey spam?

Hypotheticals are a problem because one can hand-wave relevant 
details. Your ellipsis is telling. How DID this student get my 
address? That's an important bit of information, and one which you 
are treating as unknown in its details.

(and yes, I have in the past and will in the future treat survey spam 
as spam. In most cases it is not simply rude and unjustifiable 
unsolicited bulk email, it is also a terrible research methodology.)
-- 
Bill Cole
[email-masked]

---

From: Art Pollard <[email-masked]>
Date: Wed, 04 Jun 2003 09:25:35 -0600

>   the recipient to stop and/or reasonably prevent from receiving.

I think it would be important to note that it is AUTOMATED.

For example, if I get a letter from someone who thinks that because of my 
business, that they have a tool that I might be interested in and if they 
have typed the e-mail themselves and sent it to me then as far as I'm 
concerned it is OK.  It is OK even if I'm not interested in their 
product.  The fact of the matter is that they actually took the time (e.g., 
economic cost) to sort out who they were going to send their letter to and 
that they sent it to me based on their judgement that it was actually 
relevant to me.

However, much (most) spam is not targeted specifically and we get so much 
of it that it is overwhelming.  Personally, I don't think that it is spam 
in itself that is so much the problem as is the fact that it is not 
targeted and we are all overwhelmed with it. (I get several hundred per-day 
that I have to sort through.)

For example, if those of us who are programmers were provided with a single 
e-mail that advertised a C/C++ compiler that compiled what you meant rather 
than what you typed (and it actually worked) for those of us who are 
programmer's it would probably be greatly appreciated.  Why would it be 
appreciated? Because it would have great bearing on our business and it 
would save lots of time and money.  But if we received 1,000 of these it 
wouldn't be appreciated nor would advertisements for underwear (even though 
most people wear underwear -- making it relevant but not very relevant).

The key to all this is the economic cost either in time or money or ... 
that the sender went through to send it.  When there is no economic cost 
then we end up with a runaway situation such as it is today.

So, as mentioned before, I think the AUTOMATED word needs to be there 
though I can easily envision where mail sent in an automated fashion.

Also, one problem with your definition is that given a hypothetical 
situation where everybody actually unsubscribed you if you unsubscribed, 
there are too many potential mailing lists (one for each company world 
wide) that one would have to unsubscribe to in order to even fractionally 
reduce the amount of spam received.  (This is of course, ignoring the fact 
that there are a few spammers that send most of the spam.)

I don't mind people sending me something that is actually relevant to my 
wants and needs and I know it has been carefully considered and that 
someone on the other end actually took the time to compose a letter and 
send it to me.  I do mind getting inundated with tons (if bits can be 
measured that way) of irrelevant crap.

-Art
-- 
Art Pollard
http://www.lextek.com/
Suppliers of High Performance Text Retrieval Engines.

---

From: Dave Crocker <[email-masked]>
Date: Wed, 4 Jun 2003 09:29:27 -0700

Bill,

>>The student sends the same query for assistance to each of these people.
BC> Oh, you mean survey spam?

No, this is nothing like a survey. A survey is a formal, structured
measurement instrument.

I'm talking about someone trying to chat up some folk about a topic of
interest.

BC> Hypotheticals are a problem because one can hand-wave relevant

The hypothetical was carefully designed to highlight a mode of
interaction that is of *fundamental benefit* to human activity but would
be excluded by the simplistic, Draconian rules under discussion.

BC> details. Your ellipsis is telling.

Failure to appreciate the essential nature of the example is also
telling.

BC> How DID this student get my address? That's an important bit of
BC> information, and one which you

No it is not important. It does not matter at all.

Please focus on the nature of the communication, not the means of
obtaining the address. That was my specific point.

AP> I think it would be important to note that it is AUTOMATED.

We need a definition that helps us to create rules and software for
prevention, detection and disposition of spam. How do we detect that a
piece of email is automated?

One might argue that comparing hashes of the content are oriented to
this, but note that my example explicitly permitted identical content,
yet was not spam by any reasonable criteria.

HBP> The problem the user wants solved is unwanted email

This means either that the recipient must be able to characterize wanted
vs. unwanted in a way that permits an up-stream filter to distinguish
between them.

And the algorithmic basis for doing that would be...?

d/

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 4 Jun 2003 13:02:06 -0600 (MDT)

> From: Art Pollard <[email-masked]>

> I think it would be important to note that it is AUTOMATED.

If a someone hired 100,000 people to manually type copies and individually
send 100 substantially identical messages/day, would that be spam?
In other words, I bet your statement is wrong and that what you really
care about is "bulk."  In practice "AUTOMATED" and "bulk" go together
in spam, but it's the "bulk" that matters and how the stuff is produced.

This is related to the fact that "commercial" or "advertising" is not
a good characterization of "spam," although in practice almost all of
the mail that you would label as "spam" is flogging something.

We could try to define "burglary" more precisely than being where you
don't have permission for a malicious purpose, but that would be a
big mistake.  We could define "burglarly tools" as all screw drivers
and crowbars or never as screw drivers or crowbars, but either choice
would be bad.  You can literally be convicted in the U.S. of "possessions
of burglary tools" for having a screw driver in your car and without
being convicted or even charged with burglary (my wife served on a
jury in such a case).  On balance, this fuzziness is a good albeit
imperfect thing.

That "burglary" is fuzzy does not hinder technical defenses against
it including guards and alarms.  Defining spam as "unsolicited bulk
email" without getting legalistic about the words (e.g. is SMS email?
what about x.400 or UUCP mail?) does not stop us from producing
effective if imperfect spam defenses.

---

From: mathew <[email-masked]>
Date: Sat, 7 Jun 2003 17:36:09 -0400

>   the recipient to stop and/or reasonably prevent from receiving.

Yes, this is good. This is a sufficient, but not a necessary, condition 
for something to be classed as spam.

Perhaps the way to come up with an acceptable definition of spam is to 
enumerate sufficient conditions, rather than to attempt to encapsulate 
both necessary and sufficient conditions within a single definition.

So... Each of the following conditions is sufficient, but not 
necessary, for an e-mail to be categorized as spam:

- It is from a source which it is hard or impossible for the recipient 
to stop from sending further messages.

- It is unsolicited commercial bulk e-mail from an organization the 
recipient does not have any prior relationship with.

- It is bulk e-mail from an organization the recipient does have a 
prior relationship with, but the subject matter of the e-mail is 
outside the scope of subject matter about which the recipient agreed to 
receive e-mail from the organization.

- It is bulk e-mail from a source the recipient has requested not send 
him any further e-mail.

mathew

---

From: Margie Arbon <[email-masked]>
Date: Sat, 07 Jun 2003 15:24:35 -0700

--On Saturday, June 07, 2003 5:36 PM -0400 mathew <[email-masked]> 
wrote:

> - It is from a source which it is hard or impossible for the
> recipient to stop from sending further messages.

There are ~25,000,000 small businesses in the US alone. If 10% of 
them decided to send you one email per year, you would get 6,849 
peices of mail a day.  It would be hard or impossible to get those to 
stop.

> recipient does not have any prior relationship with.

Define prior business relationship.  If I have a store credit card 
with Company, Inc., and have never given them my email address for 
any reason, do they get to e-pend it from other sources, merely 
because they can?  Yes, I have a business relationship with Company, 
Inc., but they were never granted permission to extend that 
relationship into an arena I have not chosen to invite them into, 
namely my inbox.

How about registering software or a waffle iron for waranty purposes? 
If I don't give them an email address, do they have a right to go 
find one, because we have a "business" relationship?

Is a bulk email for a survey or to preach to me about the Church of 
$diety or to ask for donations spam?  It's not commercial.

Spam is not about content, it is about consent.

> outside the scope of subject matter about which the recipient
> agreed to receive e-mail from the organization.

Define "agreed".  The recipient and the sender often have varying 
definitions of "permission".

> - It is bulk e-mail from a source the recipient has requested not
> send him any further e-mail.

One free bite? No.

http://mail-abuse.org/standard.html

An electronic message is "spam" IF: (1) the recipient's personal 
identity and context are irrelevant because the message is equally 
applicable to many other potential recipients; AND (2) the recipient 
has not verifiably granted deliberate, explicit, and still-revocable 
permission for it to be sent; AND (3) the transmission and reception 
of the message appears to the recipient to give a disproportionate 
benefit to the sender.

DISCUSSION:

(i) Trivial or mechanised personalization such as "Dear Mr. Jones, we 
see that you are the holder of the JONES.COM domain" does not make 
the personal identity of the recipient relevant in any way.

(ii) Failing to click the "do not send me marketing literature by 
e-mail" button in a web sign-up form does not convey explicit 
permission. Only when the default result is "no followup e-mail" AND 
the inbox impact is clearly stated before any action which changes 
this result, can permission of this kind be conveyed.

(iii) The appearance of disproportionate benefit to the sender, and 
the relevancy of the recipient's specific personal identity, are 
authoritatively determined by the recipient, and is not subject to 
argument or reinterpretation by the sender.

(iv) Non-personal e-mail always places a disproportionate cost burden 
on the recipient, and is considered to disproportionately benefit the 
sender unless it was verifiably solicited or by the recipient's 
willing exception.

(v) A message need not be offensive or commercial in order to fit the 
definition of "spam." Content is irrelevent except to the extent 
necessary to determine personal applicability, consent, and benefit.

---

From: Vernon Schryver <[email-masked]>
Date: Sat, 7 Jun 2003 18:31:00 -0600 (MDT)

> From: Margie Arbon <[email-masked]>

> relationship into an arena I have not chosen to invite them into, 

According to "Legislators Call for Fix to Law Against Unsolicited
E-Mails" in the Friday's "Wall Street Journal"
( http://online.wsj.com/article/0,,SB105484626839598400,00.html may
require a subscription) Sprint argued that you do have a prior business
relationship in such a case:

]                        ... Sprint Corp. for example, denied
] sending unsolicited mail to Terry Gillman, one of Mr. Riddle's
] clients. In court papers, the Overland Park, Kan., telecommunications
] company argued that Mr. Gillman agreed to receive promotional e-mail
] while registering in April 2002 on a Web site owned by closely held
] Audio Galaxy, an online music company. Addresses collected by Audio
] Galaxy were sold and resold and ended up with a company called
] GroupLotto that initiated a mailing for Sprint long-distance phone service.

Disclaimer:  I think the DCC deals better with that kind of slime than
with the current flood of porn, loan shark, and drug spam.

---

From: mathew <[email-masked]>
Date: Sat, 7 Jun 2003 20:57:44 -0400

On Saturday, Jun 7, 2003, at 18:24 US/Eastern, Margie Arbon wrote:
> There are ~25,000,000 small businesses in the US alone. If 10% of them 
> decided to send you one email per year, you would get 6,849 peices of 
> mail a day.  It would be hard or impossible to get those to stop.

You seem to be in agreement with me then, since I would consider small 
businesses each sending me one unsolicited marketing message per year 
as spam.

> Define prior business relationship.

It's up for debate. I'd start with something fairly tight, like I have 
to have given them the information. Remember, we're talking about 
sufficient, not necessary, conditions.

> definitions of "permission".

Again, I'd take the conservative route, and say that I must have 
explicitly stated that I agree to it.

>> send him any further e-mail.

You seem not to understand the concept of "sufficient but not 
necessary". I am defining that if I've asked not to get e-mail and I 
still get it, it's spam. I'm NOT saying that if I haven't asked not to 
get e-mail, it's not spam.

mathew

---

From: Dave Aronson <[email-masked]>
Date: Mon, 9 Jun 2003 07:47:51 -0400

mathew <[email-masked]> wrote:

 > Each of the following conditions is sufficient, but not
 > outside the scope of subject matter about which the recipient agreed
 > to receive e-mail from the organization.
 >

The last one is merely a subset of the prior -- it is outside the scope 
because the scope has been explicitly reduced to the null set.  The 
first one, in turn, could also be considered a case of the last one.

Also, the second is faulty in that such email needn't be commercial to be 
spam.  Remember the religious, political, and a few other kinds of spam.