Subject: Re: Guidance for spam-control on IETF mailing lists

From: Vernon Schryver <[email-masked]>
Date: Sun, 17 Mar 2002 12:48:57 -0700 (MST)

> From: "Tim Kehres" <[email-masked]>

> ...
> http://groups.google.com/groups?selm=200110250552.AAA03935%40localhost.radpa
> rker.com
> > I hope that particular example was not the message in question, because
> > there are special reasons that make me confident that it was unsolicited
> > bulk advertising.
>
> Two issues here - first, no the message in question above is not the same as
> above.
>
> With respect to the second above issue - I am very aware of what happend -
> some of our people sent single directed messages (unsolicited) to parties
> they thought might be interested in what we do.  They were single, short
> messages, sent from real people on a one on one basis.  They were sent with
> valid headers, through our servers, and only one short message was ever sent
> to anyone.  We don't deal with unsolicited bulk advertising.
>
> I just have not had the time or energies as of late to set the records
> straight.

The "straight record" of the messages archived by Google is that they were
unsolicited, more than one and substantially identical, and therefore
"spam" or "UBE" by the definition held my most informed people.
In addition, because promoted or advocated a commercial product, they
were "UCE" or spam by the second most common definition.

The motives claimed by the senders are irrelevant.  Whether the
unsolicited bulk mail is sent one at a time or with a single SMTP
transaction is irrelevant.  Whether the headers are valid or you steal
service from third parties instead of only your spam targets is also
irrelevant.  I and most informed people think that the contents of
the messages are irrelevant except to determine whether they are
substantially identical.

Whether International Messaging Associates Ltd should have been
disconnected by UUnet or the local Hong Kong reseller is not a matter
for public consideration, although the sorry history of spam from
UUNet and Hong Kong makes the apparently result unsurprising.  However,
it is certain that such messages are sufficient to get you long term
entries in blacklists around the world.

Now that I've check my own logs and blacklists, I have discovered that
ima.com is in my blacklist because I received a substantially identical
messaeg from [email-masked] on Oct 23, 2001.  Ima.com will remain in
my blacklist until someone here has a reason to receive mail from
ima.com, which given Mr. Kehres's words is unlikely to be soon.

That Mr. Kehres is the technical contact for ima.com suggests that
contrary to implications I take from his words, he probably knows all
of this as well or better than I do.

Vernon Schryver    [email-masked]

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Sun, 17 Mar 2002 20:17:52 -0500

Oh goodie! We get to chat about the other IAB -- Internet Advertizing Bureau.
(http://www.iab.net)

Reading Mr. Kehres back-to-front.

Is in-list spam in-scope for poisson? Yup. Is there a venue for general spam?
Yup (April's got it).

Would adopting an opt-in regime in the US improve things? Yup. (spam TTL >= 3)

Is everything a horrible muddle so nothing is clearly worth depricating? Noo,
but that is a nice try.

Cheers,
Eric (ex-engage, where cookies were baked, users tracked, and marketing made)

---

From: "Tim Kehres" <[email-masked]>
Date: Mon, 18 Mar 2002 08:14:31 +0800

From: "Vernon Schryver" <[email-masked]>

> "spam" or "UBE" by the definition held my most informed people.

They were indeed mostly identical, as is common when trying to make initial
contact with new groups of people.   They were however never sent more than
once to a specific individual, regardless of wether or not the recipient
replied.

> were "UCE" or spam by the second most common definition.

Are you suggesting that if the content were different, say promoting a
personal sex site, that they would have been acceptable?   Somehow I suspect
that this is an ineffective metric by which to measure content.

> the messages are irrelevant except to determine whether they are

The behavour that bulk emailers exhibit is substiantly different from
happened in this case.  I've outlined in detail what our people had done -
if you look at the bulk mailers and their practices it is not difficult to
determine many key differences.   In fact if you look at the various forms
of legislation around the world, including in the US at the moment, they
take into consideration issues pertaining to the authenticity of the
messages (forged headers), theft of service (unauthorized use of third party
systems) and similar issues.  Going by memory, some also take into
consideration the harassment factor, or how many times a single message is
bombarded against an unsuspecting individual, however sadly, from what I can
read, the current proposed US federal legislation into this does not go this
far.  In short the legislation is trying to go after the bulk mailers
without killing the Internet as a medium for electronic commerce.

One common thread of all the legislation that I've been able to get
reference to is the preservation of the right to be able to responsibly use
the Internet for business purposes.  Please don't think that I'm trying to
make a case for the mass mailers here - I am not.   Under your model, it
would be improper (or even illegal) for an individual or organization of any
type to make first contact via email - regardless of how it is being done,
and for what purpose.   This is what I disagree with - there should be
reasonable ways in which people / organizations can continue to use this
medium to establish communications.

If we shut down our ability to expand our horizions by shutting out all but
our established friends and business associates, the Internet will become a
very boring place to live in.  Somehow a proper balance has to be
established, which should start with a solid and unchanging definition of
what spam is.  I've heard your definition of spam, and countless others over
the years (I've even participated in some of the anti-spam groups a while
back), and the only consistent thread of all this was that nobody could
agree on the most basic issue of a commn definition.   It's hard to make
much real progress in this area when you're going after a moving target.
And yes, the definition of what spam is, really *is* a moving target,
regardless of how firmly any of us believe in our own particular
interpretations.

I believe that this is an important issue that needs to be discussed,
however I also suspect that it is not in the context of the charter of
either of these lists.   As I stated in an earlier message in this thread,
if anyone can point this off to a more appropriate forum, I'll be happy to
shift my replies there.

Best Regards,

-- Tim

---

From: Jeff Williams <[email-masked]>
Date: Sun, 17 Mar 2002 19:23:14 -0800

Tim and all,

> once to a specific individual, regardless of wether or not the recipient

  You make a key point that it seems Vernon neglected to mention in his
response above.

> that this is an ineffective metric by which to measure content.

  I would also have to wonder by Vernon's stated second most common
definition, whatever that really means, would apply to IETF, ISOC,
Church affiliations, ICANN or other non-commercial and charitable
orgs send out that I receive from time to time are also UCE?  I think not.

> without killing the Internet as a medium for electronic commerce.

  This is my understanding as well.  Perhaps than Vernon is suggesting
that such legislation does not go far enough, and is advocating a form
of censorship?

> medium to establish communications.

  Very much agreed!

> very boring place to live in.

  Yes something like a "Friend of the IETF" social club or garden club...

>  Somehow a proper balance has to be

  It seems to me this is a good a forum as any, and likely needs to be
discussed here specifically given the range of responses thus far...

> -- Tim

Regards,
--
Jeffrey A. Williams
Spokesman for INEGroup - (Over 121k members/stakeholdes strong!)
CEO/DIR. Internet Network Eng/SR. Java/CORBA Development Eng.
Information Network Eng. Group. INEG. INC.
E-Mail [email-masked]
Contact Number:  972-244-3801 or 214-244-4827
Address: 5 East Kirkwood Blvd. Grapevine Texas 75208

---

From: "todd glassey" <[email-masked]>
Date: Mon, 18 Mar 2002 08:40:39 -0800

> > far.

Amen to that - the US legislation makes SPAM the problem of the end-user or
recipient and that is just plain wrong. The legislation needs to be amended
or turned upside down so that the last person responsible for the spam is
the person it is sent to. Not the first.

>> In short the legislation is trying to go after the bulk mailers

I have a different view - The legislation currently in force gives them
(Bulk Mailers) a method of existing at least once for each identity they
coin and they can send out a major spamming and then just dry up and blow
away - I can see it now. Spam from Domain 102115.com today and tomorrow from
domain 102116.com and so on. Ad infinitum. There is no end - each one with a
new life period of from a day to a week or so.  That being what it takes to
get them caught.

The only thing at the Domain Level that  will stop these types of domain
based SPAM is to get into it at the InterNIC level and to:

    1)    Link the inter-registrar "domain systems" together tighter such
that rule sets can be propagated within a single 24 hours. Say once an hour,
which potentially limits any Spammers exisitence to potentially as little as
a single hour or so.

    2)    Create a set of mechanisms wherein the DNS services of a SPAMMING
operator can be suspended as part of this regular  rolling of services and
take to the level such that any such domain is to be shutdown immediately
pending receipt of good contact data from their owners.

    3)    Create a process whereby all domains registered to any set of
Domain Managers can be identified. This will help when domains that have to
real way to contact their owners are found and you need to find any others
they have registered.

These steps will make Spam much more livable -

> that such legislation does not go far enough, and is advocating a form

Under the current legislation the real issue is that the email facilities
are essentially provided "as is" by the Email service providers. Most ISP's
don't want to or are not capable of being responsible for making sure that
the email that their systems deliver or propagate onward is of a
non-intrusive nature or not.  The problem is that we as the subscribers to
this wind up footing the bill for it, both in actual data services and in
time. If we make SPAM the ISP's problem and create a formal set of email
routing/response rules,  I assure the problem will get addressed.

There are effective ways to do active filtration and for the US perhaps the
thing to do is to nationalize the boarders and declare what can and cant
cross them protocol and content wise. The Homeland Security Office could
likely do this unilaterally. This would give law enforcement a method of
reacting that is stronger than what they have now and will force the ISP's
to evolve smarter and more efficient email systems.

Todd Glassey

---

From: "todd glassey" <[email-masked]>
Date: Mon, 18 Mar 2002 08:40:39 -0800

Todd Glassey