Subject: RE: [Asrg] criteria for spam V2 (was: Implicit Consent (was: Another criteria for "what is spam"...))

From: "Peter Kay" <[email-masked]>
Date: Thu, 5 Jun 2003 11:18:07 -1000

You emailed the text right out of my keystrokes :) 

I agree: there is no such thing as implicit consent to receive bulk
email. So therefore the updated definition goes like this:

Spam is defined as unsolicited bulk email, or UBE

Bulk email is defined as the transmission of 2 or more emails via a
primarily automated process.

Unsolicited email is defined as email where the recipient has not
explicitly approved of receiving bulk email from the sender.

Sender can mean an individual or an organization.

In summary, UBE means:

The transmission of multiple emails via a primarily automated process to
recipients that have not explicitly approved to receive such emails.

OK gang, fire away.

Peter
www.titankey.com

> -----Original Message-----
> From: Richard Johnson [mailto:[email-masked]] 
> Sent: Thursday, June 05, 2003 9:53 AM
> To: [email-masked]
> Subject: RE: [Asrg] Implicit Consent (was: Another criteria 
> for "what is spam"...)
> 
> 
> At 07:59 -1000 on 2003-06-05, Peter Kay wrote:
> > However that also means that if you tell Verisign "stop" and they 
> > still keep sending, its UBE.  If Verisign ever sends you messages 
> > about their products without ever receiving implied or explicit 
> > consent from you, its UBE.
> 
> 
> I believe there is no way to safely manage "implied consent" 
> for BE streams.  Consent for such needs to be explicit.
> 
> 
> > It also means that if, on the signature of your email, you 
> EXPLICITLY 
> > state you do not want to receive any bulk email, and they 
> ignore that 
> > EXPLICIT request, its UBE.
> 
> 
> I think that's where your implicit consent assumption falls 
> apart. Everyone would put a "no BE" statement in their .sigs 
> if it were going to work to prevent slamming into BE streams. [1]
> 
> The reasonable assumption made when sending email is that 
> responses will be topical and will not, unless explicitly 
> requested, involve a stream of BE.
> 
> "Implied consent" interpreted overly broadly, such as 
> allowing the sender to assume some kind of signup for BE 
> after receiving any mail, inevitably leads to spamming.
> 
> If I don't explicitly and knowingly sign up for a stream of 
> BE, then it's UBE regardless of what the -sender- claims.
> 
> 
> Richard
> 
> [1] For example, the one I include on mail to vendors didn't 
> work against Verisign, or NetLux, or Thawte-pre-Verisign, 
> or... _______________________________________________
> Asrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/asrg
> 
> 
> 

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Dave Crocker <[email-masked]>
Date: Thu, 5 Jun 2003 15:23:12 -0700

Peter,

PK> Bulk email is defined as the transmission of 2 or more emails via a
PK> primarily automated process.

I believe that we do not care whether it was automated, and we have no
way to tell that it was automated.

Hence, citing that characteristic does not give us any useful technical
guidance for preventing, detecting or disposing of spam.

And the number '2' is certain to be highly problematic.

PK> Unsolicited email is defined as email where the recipient has not
PK> explicitly approved of receiving bulk email from the sender.

The example I posted about a student sending personal queries to some
experts -- and let's remember it does not matter how the student got
their addresses -- is unsolicited, but should not count as bulk.

PK> OK gang, fire away.

bang. bang.

d/
--
 Dave Crocker <mailto:[email-masked]>
 Brandenburg InternetWorking <http://www.brandenburg.com>
 Sunnyvale, CA  USA <tel:+1.408.246.8253>, <fax:+1.866.358.5301>

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 5 Jun 2003 17:20:57 -0600 (MDT)

> From: Dave Crocker <[email-masked]>

> ...
> ...

Why not!?  "Bulk" does not mean "spam," if you are defining "spam"
and you are not insisting that "spam" and "bulk" are synonyms. 

If your student sent a lot of substantially identical messages, it makes
no sense to say they are not bulk.  You might say that 2, 20, 200, 2000,
or however many are not enough to be "a lot" or "bulk." You might also
insist (incorrectly, in my view) that the student's spew was not spam,
but "bulk" is not a word that you reasonably redefine.

"Bulk" means "lots of the same stuff" in English.  Or as 
http://www.m-w.com/cgi-bin/dictionary?va=bulk puts it,
"material that forms a mass in the intestine; especially: FIBER"

It's crazy to set out to define "spam" and procede by redefining
words that are already well defined in English.  If you think
"unsolicited bulk email" is a bad definition of "spam," then propose
other English (or Latin, or whatever) words.  Don't embark on an
infinite regression of (re)defining the words that you are (re)defining
that you are (re)defining that ...

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Dave Crocker <[email-masked]>
Date: Thu, 5 Jun 2003 16:59:44 -0700

Vernon,

>> their addresses -- is unsolicited, but should not count as bulk.

VS> Why not!?  "Bulk" does not mean "spam," if you are defining "spam"
VS> and you are not insisting that "spam" and "bulk" are synonyms.

as I said in the note with the example, it is the combination of
unsolicited and bulk that make it spam.  Remove either qualifier and it
is something else.

VS> If your student sent a lot of substantially identical messages, it makes
VS> no sense to say they are not bulk.

The problem is with the distinction between "a lot" and "not a lot".  If
the student sends 2, it is not bulk.  If they send 1,000,000 it is.
Where is the line that divides?  Why?

VS> It's crazy to set out to define "spam" and procede by redefining
VS> words that are already well defined in English.

I agree entirely.

VS>   If you think
VS> "unsolicited bulk email" is a bad definition of "spam," then propose
VS> other English (or Latin, or whatever) words.

perhaps it will help if you respond to the detail of my earlier post,
where I suggest that UBE is a good working term, and then consider the
challenges to qualifying the components.

And, yes, I think that the "reasonable person" approach has its uses,
but not enough for building software.

d/

---

From: Barry Shein <[email-masked]>
Date: Thu, 5 Jun 2003 20:10:19 -0400

Re: what is bulk etc

To some extent what we need here is an actual legal scholar.

The law is full of problems like this where a specific act is colored
by intent making it slippery to define.

Not surprisingly, a lot of fraud has this quality. The same exact set
of actions can be a serious criminal fraud in one case and completely
innocent in another, depending upon what can be discerned about
intent.

The legal term is "mens rea", the state of mind of the perpetrator at
the time of the act, what was their goal, could they reasonably
foresee the result of their actions, etc.

This is why we're going round and round on the term "bulk", we're
trying to make the term (or the phrase UBE) describe the mens rea of
the sender.

Potentially difficult, but the law has wrestled with similar
definitional issues for many hundreds of years.

That said, I think the usual framework used by the legal system is to
create a brief set of "tests", essentially a form one might fill out
describing a perp's actions in terms of a set of (one hopes) carefully
constructed questions, usually standardized by some rather broad-based
process like a bunch of law faculty and judges, much like a technical
standard in spirit.

The problem with that approach is it makes for boring press &
soundbites and it takes some experience and discipline to construct
(again, like technical standards.)

Another problem is the clash of disciplines, law in my limited
experience tends to be enumerative and synthetic, give them more
examples they add more clauses (the ten commandments ceased being the
whole of the law a long time ago), while engineering and science tends
to be analytic, there's a goal to reduce all the cases to a simple
rule or two, E=MC^2 and all that (or, for the musically inclined, E=Fb).

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Thu, 05 Jun 2003 20:25:18 -0400

> To some extent what we need here is an actual legal scholar.

I agree, and the litigator I recently experted for offered to provide this.
I told him that as none of the majors waw paying, or participating, it was
a waste of billable time for us minors.

For grins, keep in mind that the -esse has to parse in both the civil law
and common law jargon-und-jurisdiction-doms.

Eric

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 5 Jun 2003 18:42:43 -0600 (MDT)

> unsolicited and bulk that make it spam.  Remove either qualifier and it

Oh, that's not what I understood you to write.

> Where is the line that divides?  Why?

Why must the dividing line by a single fixed number for us humans?
There is no mechanical rule that defines burglary or insider trading
and there cannot be.  Still, the world manages to define, prosecute,
deter and generally control those crimes--well, at least burglary.
The world also has quite useful burglar alarms and the SEC catches
some inside traders with their computers.  Of necessity, burglar alarms
and the SEC's systems use simplistic, fundamentally flawed, and wrong
thresholds.

Why can't we define "bulk" as "bulk" for human discourse but let people
installing spam-bulk-alarms use thresholds appropriate for local
conditions or other constraints?  For example, a reasonable threshold
for a spam-bulk-alarm at AOL might be 1000.  At a vanity domain SMTP
server like Rhyolite.com, 3 is reasonable and 5 is generous because
any message that hits 5 addresses @rhyolite.com is practically certain
to be hitting 50,000,000 at AOL.

> challenges to qualifying the components.

What do you mean by "qualifying the components"?

> but not enough for building software.

Ok, but building software is quite distinct from defining offenses.
Let's first define the offense of "spam" and then decide how to
approximately characterize it for our stupid computers.  Let's also
be entirely clear when we are talking about spam and when we are
talking about whatever our computers can detect or defend against.

Trying to define spam as that which we our comptuers can detect is a
serious mistake.  As you and others have often said, we cannot hope
to eliminate all spam.  An equivalent statement is that we cannot hope
for our computers to detect all spam.  It would make good sense to
define spam as UBE but note that our computers might not always detect
spews involving fewer than 1000 victims.  That would encourage spammers
to try to stay below 1000 victims, but it would also encourage us to
improve our software to detect more cases of UBE.

---

From: Dave Crocker <[email-masked]>
Date: Thu, 5 Jun 2003 18:31:31 -0700

Vernon,

>> unsolicited and bulk that make it spam.  Remove either qualifier and it

VS> Oh, that's not what I understood you to write.

Just for reference, this was the note with the example I was citing:

     <https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg05183.html>

VS> Why must the dividing line by a single fixed number for us humans?

We want to build software to prevent, detect or dispose of spam.
Software does not know about "reasonable" definitions of "bulk".  What
is the algorithm we should feed the software?

For these discussions, I am not in the least concerned with legal
aspects of enforcement or rule-making.  I want software algorithms.

VS> Why can't we define "bulk" as "bulk" for human discourse but let people
VS> installing spam-bulk-alarms use thresholds appropriate for local
VS> conditions or other constraints?

This is one of those questions that needs to get two different answers:

1.  We must, of course, let individual users have control over
parameters.

2.  Individuals will get these parameters wrong, especially if they are
FORCED to set them.  It is one thing to have common agreement of
commonly-acceptable parameters, and then permit "tuning" by inidividual
users.  It is another to have no consistent construct (threshholds)
anywhere in the system.

3. (Bonus answer, beyond the promised 2) The enforcement is often by an
intermediary and I guarantee that they will set the parameters
differently than the recipient wants.  This is the really major reason
to do interoperability standards, rather than just letting everybody set
the details themselves.

VS> Ok, but building software is quite distinct from defining offenses.

I thought this was a technical discussion list, so I was -- perhaps
foolishly -- thinking that we wanted to vector definitions to a place
that permitted implementation by software, rather than courts.

VS> Trying to define spam as that which we our comptuers can detect is a
VS> serious mistake.  As you and others have often said, we cannot hope
VS> to eliminate all spam.  An equivalent statement is that we cannot hope
VS> for our computers to detect all spam.

Frankly, I am hoping that we simply get away from the term.  No, I do
not think we can agree on a universal, all-encompassing definition for
spam and, no, I do not think we can prevent or detect all spam.

That's why I am in the group that believes we should settle on a
definition of something that we CAN operationalizem, for which improved
control will mean improved Internet usability.

d/

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 5 Jun 2003 19:49:13 -0600 (MDT)

> control will mean improved Internet usability.

It would also be a major mistake to define "unsolicited bulk email"
as that which our computers can detect.

As in any technical design process, the first step is to figure out
what we're doing.  Nit picking about whether the word "bulk" in the
requirements document should be 2 or 3 is destructive.  We must address
the fuzziness of "bulk" only when we worry about reducing the requirements
to something for the computers.  Judging from other contributions
about "largely automated mechanims" and so forth, we are not ready
for that.  Besides, your bit about the student does not seem to be
about resolving the fuzziness of "bulk" but finding contractions
between the fuzzy human notion and what computers will do and so
throwing out the notion entirely.

Perhaps I've misunderstood.  Are you instead saying that 2 is the wrong
value of "bulk" for computers?  If so, what number do you prefer?

For what it's worth, most of the thousands of operators of DCC clients
seem to prefer either values between 20 and 100 or the special infinite
or overflow count of targets that means "incredibly bulky because the
message hit a spam trap."  (One of the critical parameters for a DCC
client is the local threshold for "bulk.")