Subject: Why Spam is a problem

From: "Bill Cunningham" <[email-masked]>
Date: Tue, 13 Aug 2002 22:06:53 -0400

I'm no fan of spam but we all get snail mail ads don't we? Shouldn't
advertisers of a possibly good product be allowed to e-mail adverstise? If
you could block snail mail ads, and you can, shouldn't the idea of working
on filters and so forth be the way to go? Perhaps it should be the ISP's
responsibility to block spam if you request it. All we need is the
politicians making new laws to stop things!

---

From: "Perry E. Metzger" <[email-masked]>
Date: 14 Aug 2002 12:28:00 -0400

"Bill Cunningham" <[email-masked]> writes:
> I'm no fan of spam but we all get snail mail ads don't we?

I'll repeat my calculation. I'm receiving at least 55,000 spams a year
at the rate they are arriving this month. I'm using automation to nuke
most of them, but if I did not, at three seconds each that's over a
work week every year devoted to killing that mail -- by comparison,
the average American gets two weeks of vacation a year.  The amount of
spam is at least doubling or tripling every year.

Imagine if just 1% of the world's businesses decided to spam you in a
given year. You would literally have no time in the day to read your
mail. You would no longer be able to use email for any productive
purpose at all. Email would be dead for you.

Quantity has a quality all its own. There is nothing wrong with
shining a flashlight at your neighbor, but a 50 megawatt laser is not
okay.

The junk physical mail I receive is perhaps two or three pieces a day
that are easy to throw in the trash as I leave the mail room in my
apartment building. Spam is different. Even at current rates I'm
spending hours a year dealing with it, and given the exponential
growth, soon even my high-quality filters will be as good as useless
because even 5% leakage will be too much.

> Shouldn't advertisers of a possibly good product be allowed to
> e-mail adverstise?

No. They should not. I pay for my email link, and my time is
valuable. I am protected from getting harassing phone calls, and
should similarly be protected from harassing email advertisements.

> All we need is the politicians making new laws to stop things!

No, that's not all we need, but it is certainly part of what we need.

-- 
Perry E. Metzger		[email-masked]
--
"Ask not what your country can force other people to do for you..."

---

From: "Bill Cunningham" <[email-masked]>
Date: Wed, 14 Aug 2002 15:27:19 -0400

----- Original Message -----
From: "Perry E. Metzger" <[email-masked]>
To: "Bill Cunningham" <[email-masked]>
Cc: <[email-masked]>
Sent: Wednesday, August 14, 2002 12:28 PM
Subject: Re: Why Spam is a problem

> work week every year devoted to killing that mail --

Is an annualized rate of 55,000 spams a year, sustainable for a year? If you
know statistics figure 1-3 standard deviations for that monthly average.

---

From: "Perry E. Metzger" <[email-masked]>
Date: 14 Aug 2002 16:18:35 -0400

"Bill Cunningham" <[email-masked]> writes:
> Is an annualized rate of 55,000 spams a year, sustainable for a
> year?

It is likely to be far worse for the full year, as that's just what
the current levels are. The level rises very steadily with time, and I
am almost certain that the level will have increased sufficiently by
the end of the year to make the complete annual number much
higher. And yes, I really do get 150 to 200 of the damned things a
day, every day, week after week, the number slowly ratcheting
upwards. My annualized figure was taken by conservatively using 150
rather than 200.

Apparently there are people doing even worse than I am. There are also
quite a number of people I know who are running at perhaps 30% or 50%
of my rate, but of course, they need merely wait if nothing is done
before they hit the rate I'm at.

I am a bit unusual. I run a number of mailing lists and post a lot to
the net. However, I'm just ahead of the curve. If things continue, in
a few years, you will be where I am, almost regardless of where you
are now.

---

From: "Gary E. Miller" <[email-masked]>
Date: Wed, 14 Aug 2002 13:19:13 -0700 (PDT)

Yo Bill!

On Wed, 14 Aug 2002, Bill Cunningham wrote:

> Is an annualized rate of 55,000 spams a year, sustainable for a year?

Every table and graph I have seen has shown exponential growth.  My own
logs show exponential growth.  However bad it may actually be for you
or me it will be much worse later this year.

Only one thing may slow the growth.  I find a lot of customers no longer using
email at all.  This trend is accelerating.  People have moved over to the
instant messaging world where spam seems to be more under control.

Just like a virus may kill itslef by killing the host, the spammers may
limit their business by killing off email users.

RGDS
GARY
---------------------------------------------------------------------------
Gary E. Miller Rellim 20340 Empire Blvd, Suite E-3, Bend, OR 97701
	[email-masked]  Tel:+1(541)382-8588 Fax: +1(541)382-8676

---

From: "Bill Cunningham" <[email-masked]>
Date: Wed, 14 Aug 2002 18:57:30 -0400

> a few years, you will be where I am, almost regardless of where you
WOW Thats' a lot of spam. I don't blame you for wanting to get rid of it. As
for unwanted telephone solicitations, Radio Shack has a device called
'tele-zapper'. It is supposed to keep out tele-marketers. I was in
tele-marketing for 5 years and I got people who hated me and people who
looked foreward to me calling them again. If you ask for a written copy of
the tele-marketer's Do not call policy, you have written proof you asked to
be taken off the list. If they call again, you have a court case.
    When a tele-marketer calls me, I usually listen long enough to see what
product or service they're peddling, then if I'm not interested I hang up.
Of course I'm not swamped with tele-marketers either. If you don't like
soliciting, you should be able to stop it.

---

From: "Perry E. Metzger" <[email-masked]>
Date: 15 Aug 2002 03:52:47 -0400

"Bill Cunningham" <[email-masked]> writes:
> WOW Thats' a lot of spam.

Remember: exponential growth. As I am now, you shall be -- unless
something is done.

> I don't blame you for wanting to get rid of it. As
> 'tele-zapper'.

I don't need that. New York State has a master "do not call" list and
since I joined it, it has been nearly 100% effective.

This, and the junk fax experiences, are perhaps why I'm starting to
think legislation, if not the answer, might at least be a powerful
tool.

---

From: Richard Welty <[email-masked]>
Date: Thu, 15 Aug 2002 07:49:25 -0400 (EDT)

> Remember: exponential growth. As I am now, you shall be -- unless

Dave Rand has been keep detailed stats for some time. he just reported in
another forum that spam to his server is up by a factor of 30 with respect
to 2 years ago. the comparison isn't strictly correct statistically; he
simply had a day where the domain got as much spam as it had gotten in a
month 2 years ago.

the situation is deteriorating rapidly.

richard
--
Richard Welty                                         [email-masked]
Averill Park Networking                                         518-573-7592
              Unix, Linux, IP Network Engineering, Security

---

From: [email-masked] (Claus Färber)
Date: 15 Aug 2002 13:57:00 +0200

Bill Cunningham <[email-masked]> schrieb/wrote:
> advertisers of a possibly good product be allowed to e-mail adverstise?

There are a lot of differences between snail mail and email ads:

. With snail mail, the advertiser pays production and postage. With
  email, the recipient has to pay his/her own provider.

. Snail mail is expensive enough to regulate the amount of mail you get.
  Email on the other hand is so cheap for the sender that the amount of
  mail you can send is nearly unlimited.

. Snail mail ads can be sorted out more easily, usually even without
  opening the envelope. Email ads provide much less information on the
  outside (i.e. what MUAs usually show in the message list). Most spam
  senders even try to make that as difficult as possible now.

. In some countries, there are institutions that allow recipients to
  opt-out for all commercial snail mail. There's no such working
  solution for email.

BTW, national legislations don't seem to help much. I do get a lot of  
national spam (i.e. in German language), although German laws forbid  
sending unsolicited email (not explicitly, but the German Bundegerichts- 
hof ruled it to fall under unfair competition laws).

Claus
-- 
------------------------ http://www.faerber.muc.de/ ------------------------
OpenPGP: DSS 1024/639680F0 E7A8 AADB 6C8A 2450 67EA AF68 48A5 0E63 6396 80F0

---

From: Jan Meijer <[email-masked]>
Date: Thu, 15 Aug 2002 14:33:53 +0200 (W. Europe Daylight Time)

> hof ruled it to fall under unfair competition laws).

How many people/ISPs in Germany have actually sued German spammers?  We
have laws against computer-breakins yet because nearly no-one (not
ordinary people/ISPs, banks and telco's probably *do*)
files a complaint with the police they are basically not enforced.

Jan

---

From: Keith Moore <[email-masked]>
Date: Thu, 15 Aug 2002 10:03:14 -0400

> think legislation, if not the answer, might at least be a powerful

I suspect that reduction in phone/fax spamming is a combination of
two factors: legislation imposing stiff penalties combined with
the investment and expense required to do phone or fax spamming on
a significant scale.  The significant investment that is required 
to do phone or fax spamming has two effects: it reduces the number
of potential phone/fax spammers (thus making them easier to identify)
and it means that they have real and identifiable assets that can 
be targeted (and that they need to protect).  Also, international 
calling tarriffs tend to mean that the phone or fax spammer is in 
the same country and legal jurisdiction as its targets.

With email spamming, significantly less investment is required and 
the costs are not distance sensitive.   

That's not to say that legislation could not be a useful part of a
solution, just that I don't think that legislation by itself would
significantly reduce the volume of email spam.

Keith

---

From: "Eric A. Hall" <[email-masked]>
Date: Thu, 15 Aug 2002 12:30:38 -0500

> significantly reduce the volume of email spam.

Of course it wouldn't. Neither would anything else. The key point here is
that the root problem is a social issue. Spammers just don't CARE that
there are costs incurred by recipients, and that property rights are being
violated. Civil and criminal penalties are there to MAKE violators care
about these issues.

Once it becomes a matter of property rights, we can develop all kinds of
technology to support it. We can erect virtual "no trespassing" signs in
the protocol if necessary to preserve our rights, for example, with the
technical work being used to reinforce the legal basis.

The root problem is social.

-- 
Eric A. Hall                                        http://www.ehsco.com/
Internet Core Protocols          http://www.oreilly.com/catalog/coreprot/

---

From: Keith Moore <[email-masked]>
Date: Thu, 15 Aug 2002 13:51:10 -0400

> violated. Civil and criminal penalties are there to MAKE violators care

well, it would make them care about civil and criminal penalties, if
not about the social issues.

(but you're dead on about spammers not caring - the ones I've talked to
seem sincerely convinced that they have a right to steal from others, and 
the only justification they need is that they can make money from doing so.)

at least in the US we're extremely unlikely to get legislation that 
imposes substantial civil and criminal penalties, because the DMA wants 
to make spam legitimate, and they have more money (thus influence) than 
geeks do.

> The root problem is social.

depending on how you look at it, the problem is social, economic, political,
technical, or some combination of these.  I don't find such generalizations
very useful. 

Keith

---

From: Fred Baker <[email-masked]>
Date: Thu, 15 Aug 2002 14:34:03 -0700

>The root problem is social.

the root problem is indeed social, but I don't think we need laws on the 
books to provide technical work-arounds. If we want to, for example, have 
white-list people (people who are subscribers to the mailing list, or 
people who work for our company, or people to whom we have sent the 
appropriate goober in the past so they can now present it) present a 
credential and in our own instance of a mailer process treat peers that 
don't present the credential differently (such as r-e-a-l s-l-o-w-l-y), 
that doesn't require a law, it merely requires the appropriate technical 
specification and implementation.

---

From: Richard Welty <[email-masked]>
Date: Thu, 15 Aug 2002 19:18:27 -0400 (EDT)

> books to provide technical work-arounds.

moreover, i think that lawmakers might well treat technical guidance from
the IETF with some respect. a number of the legislation proposals that have
been floated in congress contained language referring to potential
standards that would mostly likely come from the IETF.

> If we want to, for example,
> have 

additionally, there are mechanisms in the IETF like information and BCP
RFCs that might be useful.

an Informational RFC might be used to present technical and/or operational
issues relating to spam issues (e.g., my suggestion of an informational RFC
on Requirements for Effective Opt Out systems), and explicitly list things
that will likely fail (for example, unless use of a centralized opt-out
list is mandated, it will be of no value.)

a BCP RFC on mailing list management practices would be another example
where things that the old hands all know can be articulated (for example,
that confirmed opt in works best, that bounce management is important, and
that conflict resolution procedures must exist and be effective where
someone on a mailing list is having issues with the list owner.)

richard

---

From: "Eric A. Hall" <[email-masked]>
Date: Thu, 15 Aug 2002 18:53:29 -0500

on 8/15/2002 4:34 PM Fred Baker wrote:

> the root problem is indeed social, but I don't think we need laws on
> the books to provide technical work-arounds. If we want to, for
> example, have white-list people (people who are subscribers to the
> mailing list, or people who work for our company, or people to whom we
> have sent the appropriate goober in the past so they can now present
> it) present a credential and in our own instance of a mailer process
> treat peers that don't present the credential differently (such as
> r-e-a-l s-l-o-w-l-y), that doesn't require a law, it merely requires
> the appropriate technical specification and implementation.

We certainly don't need laws to do any of that. The laws are needed for
when all of that fails to work, for the ten years between now and whenever
critical mass is achieved, and for the simpler technologies which replace
SMTP in the mainstream that start to have their own spam problems.

ICQ has been whitelist-centric for years, and there is spam there too.

---

From: "Eric A. Hall" <[email-masked]>
Date: Thu, 15 Aug 2002 19:04:22 -0500

on 8/15/2002 6:53 PM Eric A. Hall wrote:

>>have white-list people (people who are subscribers to the
>>r-e-a-l s-l-o-w-l-y)

Couple of other points I wanted to make on the whitelist approach. First
is that whitelists only keep me from seeing the junk, they do NOT
alleviate the symptoms. For example, I still have to pay my 95th
percentile bandwidth costs for all that crap I'm not seeing, I still need
machines and disk space to hold and process that crap on my behalf, and I
still need personnel to manage the bandwidth, systems and software. Plus
the canonical problem, which is that my property rights are still being
trampled by miscreants who flunked kindergarten's basic lessons.

Secondarily, whitelists are sufficiently annoying that, if used on a large
enough scale, they would have to be standardized so that they could be
dealt with automatically. At that point, spammers can just automate the
whitelist responses and we would have gotten nowhere.

There are also social problems with whitelists which I will not get into.

---

From: "Perry E. Metzger" <[email-masked]>
Date: 15 Aug 2002 22:12:10 -0400

> to make spam legitimate, and they have more money (thus influence) than 

I no longer believe that. NPR's All Things Considered, for example,
had a 12 minute three part story on spam this evening, and their view
on legislation seemed very positive. One of the reporters noted that
she'd received a dozen spams today alone. Average people are being
impacted, which means the Direct Marketing Association will soon be
arguing with a torch-wielding mob.

Perry

---

From: John C Klensin <[email-masked]>
Date: Thu, 15 Aug 2002 22:59:31 -0400

--On Thursday, 15 August, 2002 22:12 -0400 "Perry E. Metzger"
<[email-masked]> wrote:

>> at least in the US we're extremely unlikely to get
>> legislation that  imposes substantial civil and criminal
>> penalties, because the DMA wants  to make spam legitimate,
>> and they have more money (thus influence) than  geeks do.
> 
> I no longer believe that. NPR's All Things Considered, for
> example, had a 12 minute three part story on spam this
> evening, and their view on legislation seemed very positive.
> One of the reporters noted that she'd received a dozen spams
> today alone. Average people are being impacted, which means
> the Direct Marketing Association will soon be arguing with a
> torch-wielding mob.

Somewhat more to the point, the DMA is very pragmatic.  If they
see the writing on the wall for "plain spam", they will almost
certainly rapidly start to retreat toward "responsible spam",
including opt-out systems, unenforceable laws, etc., with the
claim that they are trying to find a good balance between the
"needs" or marketers and consumer desires.  In the last
analysis, they --or at least the folks from there with whom I
had some long discussions a few years ago-- understand both
"backlash" and the principle that irritating people sufficiently
doesn't result in more customers.  Of course, from that
perspective, irritating people just a bit less than
"sufficiently" is just fine.

On the other hand, approximations to torch-wielding mobs can be
a powerful force, especially in congressional election years.
And the ISPs, who don't have a lot fewer resources than DMA,
are, I assume, getting fairly tired of the staffs they have to
maintain to try to deal with this stuff.

     john

---

From: "Anthony Atkielski" <[email-masked]>
Date: Fri, 16 Aug 2002 06:48:40 +0200

Keith writes:

> ... at least in the US we're extremely unlikely
> to get legislation that imposes substantial civil
> and criminal penalties, because the DMA wants
> to make spam legitimate, and they have more money
> (thus influence) than geeks do.

Convince movie studios and music companies that spammers are somehow
violating a copyright somewhere, somehow, even slightly, and they'll
probably pay Congress to make spamming punishable by death.

---

From: "Eric A. Hall" <[email-masked]>
Date: Fri, 16 Aug 2002 01:10:17 -0500

> arguing with a torch-wielding mob.

http://search.npr.org/cf/cmn/segment_display.cfm?segID=148399 has the NPR
realaudio segment, or one of them anyway. The DMA wasn't mentioned so
maybe its another one. The segment isn't very educational, although there
was one especially salient quote from a spammer: "I don't see where we're
doing something wrong, and if there was something wrong, why aren't there
any federal laws pertaining to it". Which is exactly why we need the law,
so that the deficient can be told that it's wrong.

http://www.the-dma.org/cgi/dispannouncements?article=158 has the DMA
guidelines. They might as well be non-existent. The guidelines allow the
members to send you unsolicited mail even if they only got your address
from somebody who claims that you received an opt-out message which you
did not respond to (guideline 4b). This is, of course, the favorite
blanket of the THIS-IS-NOT-SPAM crowd.

This is in direct contrast to the public face the DMA puts on when they
feel the heat. As far back as 1998, they have publicly stated that they
favor opt-in (see http://news.com.com/2100-1023-218803.html). Earlier this
year, they made a stink about their rules and that members would be booted
if they weren't followed (see http://news.com.com/2100-1023-822053.html).
Read their policies at their own web site for the private face.

---

From: Einar Stefferud <[email-masked]>
Date: Fri, 16 Aug 2002 01:16:08 -0700

Opt out is not a good spam solution, since in most cases, the opt out 
email address is  generally used to collect good "live" addresses for 
use by other spammers.

So, we have mostly all learned to never reply to an opt out offer.
I have never seen one that worked, and now I never reply to them.

How could the law detect that opt out FROM addresses do not become a 
valuable commodity for other purposes?  How deeply do you want to 
bring the government into the protocol development and program coding 
business?  Are you going to station FBI officers in the spammer's 
offices?

To solve the problem, any anti-spam law has to require Opt-IN 
procedures, and documentation of the Opt In actions.  And even then, 
they can fake the opt-in EMail documents.  How many times already do 
you get spam that claims they have your opt-in records.

Come to think of it, I expect that the FAX opt out process also is 
used to collect good (live) FAX numbers, these days.

Cheers...\Stef

---

From: Richard Welty <[email-masked]>
Date: Fri, 16 Aug 2002 07:09:52 -0400 (EDT)

> I have never seen one that worked, and now I never reply to them.

nor do i.

the theoretical possibility of effective opt-out comes from having the list
managed by a neutral third party with strict controls; bulk emailers would
submit lists to be cleaned. a prototype of a system that might have been
effective was built by Rodney Joffe several years ago.

> you get spam that claims they have your opt-in records.

opt-in is certainly always preferable.

richard

---

From: "Bill Cunningham" <[email-masked]>
Date: Fri, 16 Aug 2002 07:17:34 -0400

----- Original Message -----
From: "Einar Stefferud" <[email-masked]>
To: <[email-masked]>
Sent: Friday, August 16, 2002 4:16 AM
Subject: Re: Why Spam is a problem

> used to collect good (live) FAX numbers, these days.

When you go into a business you may see a "No Soliciting" sign. This sign is
backed up by law. I've never seen a "Soliciters are welcome here" sign.
If MIME protocols had built in extensions that were the equivalant of a "No
Soliciting" sign, and were backed up by law, could that work?

---

From: Richard Welty <[email-masked]>
Date: Fri, 16 Aug 2002 07:37:49 -0400 (EDT)

On Fri, 16 Aug 2002 07:17:34 -0400 Bill Cunningham <[email-masked]> wrote:

> ...go into a business you may see a "No Soliciting" sign. This
> sign is

why in MIME?

why not revive the old proposal for NO UBE and other strings in SMTP
banners? it's better than numerous things that have shown up in proposed
legislation.

richard

---

From: "Perry E. Metzger" <[email-masked]>
Date: 16 Aug 2002 09:48:49 -0400

John C Klensin <[email-masked]> writes:
> "needs" or marketers and consumer desires.

It won't matter. If the laws aren't effective, the torch wielding mobs
won't go away. In the end, the DMA will either accept laws that work,
or they'll ultimately lose. I suspect the latter.

Perry

---

From: Keith Moore <[email-masked]>
Date: Fri, 16 Aug 2002 10:44:20 -0400

> or they'll ultimately lose. 

all the DMA requires is that the laws be "good" enough to get the mobs
to put down their torches, and to raise the bar enough for spamming that 
spam can be used to sell soap instead of penis enlargement.  if the result 
still annoys and inconveniences and costs people, the DMA doesn't care - 
actually, they'd consider that a successful result.

---

From: Einar Stefferud <[email-masked]>
Date: Fri, 16 Aug 2002 09:47:58 -0700

>Soliciting" sign, and were backed up by law, could that work?

The spammers have no interest in putting an "I am a solicitor" sign 
anywhere in their message, and solicitors in your building do not 
wear anything special in order to see the sign.  They have to use 
their own brain, and received messages depend on the recipient's 
brains to view the message.  In fact, spammers do their best to look 
like a friend or someone you know and will accept into your space.

MIME is only seen by the recipient's software after the message has 
been accepted for delivery, unless you search the whole body of the 
message for some hidden clues.
The protocol is more like "hide and seek" combined with "catch me if 
you can" than anything else.

Mail is "whole-message-store-and-forward" so there is no dialog 
between sender and recipient before delivery is completed.

So, the equivalent of such a sign only exists in my filters, which do 
not look for "I am a solicitor" signs in the incoming message.  They 
look for more useful things like "cn.net" or "com.ru" or "com.cn" 
which are useful surrogates for "I am a Solicitor" signs.

Cheers..\Stef

---

From: Doug Royer <[email-masked]>
Date: Fri, 16 Aug 2002 11:22:05 -0600

> email address is  generally used to collect good "live" addresses for

A technique used here where I live for telephone marketing, is that
the telephone companies were required by law to provide a registry
service of phone numbers that have subscribed to 'do not call me'
lists. This works. The marketing companies are fined when they violate
the law. In fact the phone company itself was fined recently for
violating its own lists. I was surprised to find out that not everyone
wanted to be on that list.

I am not sure how this could work when the spammer is in
another country. I throw away all email from 3 countries anyway
or when the language/charset is not english.

---

From: [email-masked] (Claus Färber)
Date: 17 Aug 2002 19:21:00 +0200

> How many people/ISPs in Germany have actually sued German spammers?

This is another problem with antispam legislation: It does not pay to
sue spammers. You can only sue them individually and the damages you can
get are very low (less than a cent per message).

In Germany, you would have to pay several hundred EUR to bring forward
an action against a spammer (which you will get back if the spammer
loses the lawsuit and is not already bankrupt), which can only yield a
few cents damages and an injunction that this single spammer must not
send you any more spam (So you get one or two less pieces of spam per  
year...)

Claus
--

---

From: Henning Schulzrinne <[email-masked]>
Date: Mon, 19 Aug 2002 10:29:03 -0400

Isn't that what class action lawsuits are for, i.e., combining a class 
of claimants into one law suit? Given, for example, the small-fry 
amounts in recent telecom leasing suits, one would think this would be 
fertile ground for lawyers.

---

From: John Stracke <[email-masked]>
Date: Mon, 19 Aug 2002 11:22:36 -0400

Henning Schulzrinne wrote:

> of claimants into one law suit?

Does Germany have class actions? They're relatively new in the US 
(mid-20th century, I think).

-- 
/===============================================================\
|John Stracke      [email-masked]                      |
|Principal Engineer|http://www.centivinc.com                    |
|Centiv            |My opinions are my own.                     |
|===============================================================|
|Both candidates are better than a megalomaniac mutant lab mouse|
|bent on world domination...but it's pretty close.              |
\===============================================================/

---

From: Richard Welty <[email-masked]>
Date: Mon, 19 Aug 2002 11:38:43 -0400 (EDT)

> fertile ground for lawyers.

IANAL, but i'm given to understand that certifying classes for this type of
lawsuit is extremely difficult, and rightly so.

richard

---

From: [email-masked] (Claus Färber)
Date: 20 Aug 2002 01:26:00 +0200

Henning Schulzrinne <[email-masked]> schrieb/wrote:
> of claimants into one law suit? [...]

There are no class actions in Germany (and many other legislations).

Claus
--