Subject: Re: [Asrg] anti-spam updates for ISOC from the ASRG (fwd)

From: "John R. Levine" <[email-masked]>
Date: 14 Nov 2011 17:46:09 +0800

I sent this initial response to Joel.  Please cc him on any traffic here 
since he's not currently on the list.

R's,
John

---------- Forwarded message ----------
Date: Mon, 14 Nov 2011 16:59:02 +0800 (CST)
From: John R. Levine <[email-masked]>
To: Joel M Snyder <[email-masked]>

> We are looking for short statements and pointers to work in the following 
> areas:

This stuff is all available (other than perhaps a useful list of anti-spam 
products, since there's a vast number, mostly lousy) but it's a considerable 
amount of work to pull it all together.

> - current players (other than ISOC) in the policy-based anti-spam front. This 
> would include governmental and NGO policy groups helping to craft policy, 
> industry groups, etc.  Anyone, in short, who is hoping to help write or 
> influence legislation, regulation, or policy regarding spam.

Hmmm.  The OECD has a fairly good anti-spam framework which is getting old but 
that they're starting to revise.  I'd start with that.

> - current anti-spam policies/legislation/regulation AND a statement of 
> evaluation.  (e.g,, pointer to CAN-SPAM and an admission that it doesn't seem 
> to have done anything)

CAN SPAM hasn't been very useful, not so much because it's opt-out, but because 
the effort to bring suit is enormous.  The FTC has whacked some spammers, 
there's been a handful of criminal and civil cases, but not a whole lot.

The EU's spam directive, which has been implemented to a greater or lesser 
degree in all the member countries, has been pretty effective against spam 
that's not wholly criminal.  AU and NZ have pretty good laws, CA has a new one 
based on the earlier ones.

The majority of spam these days is utterly illegal just about everywhere, sent 
using stolen resources advertising fraudulent stuff.  That doesn't so much need 
new laws as it needs better coordination among law enforcement in various 
countries, cooperation between network operators and LE as well as identifying 
and dealing with a relatively small numbers of networks that are run for or by 
crooks.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. http://jl.ly

---

From: Alessandro Vesely <[email-masked]>
Date: Mon, 14 Nov 2011 18:53:27 +0100

>> - current anti-spam policies/legislation/regulation AND a statement
>> of evaluation.  (e.g,, pointer to CAN-SPAM and an admission that it
>> doesn't seem to have done anything)
> 
> [...]
> 
> The EU's spam directive, which has been implemented to a greater or
> lesser degree in all the member countries, has been pretty effective
> against spam that's not wholly criminal.

It is more of an annoyance than an effective practice, IME.

It seems EU is about to revise their Data Protection Directive to make
it tighter[1].  I have no idea how to tell them that in order to work
in Internet, the idea of getting a user's consent has to be
implemented with an adequate protocol.  As an exercise, I tried and
describe how such a protocol could be conceived[2].

[1] http://www.google.com/search?q=%22Reding%22+Aigner&hl=en
[2] http://fixforwarding.org/

Perhaps, if Google and Facebook are willing to comply, they can push
for having a compliable law...

> The majority of spam these days is utterly illegal just about
> everywhere, sent using stolen resources advertising fraudulent stuff. 
> That doesn't so much need new laws as it needs better coordination
> among law enforcement in various countries, cooperation between
> network operators and LE as well as identifying and dealing with a
> relatively small numbers of networks that are run for or by crooks.

Although that's true, I don't think end users are able to distinguish
those categories of spam.  So the bottom line is that they cannot
defend their rights.  Isn't this sufficient to say the law is ineffective?