Subject: Re: Principles of Spam-abatement

From: "Dr. Jeffrey Race" <[email-masked]>
Date: Wed, 03 Mar 2004 11:30:38 +0700

John, your summary distils a lot of hard work but is deeply troubling,
because it is constructed entirely on a "make the victims pay"
foundation.  As long as that is your stance, then sure it is so that
"Spam . . . will remain a long-term battleground".   However it is 
just NOT so if the community will change its stance to that which 
society uses (successfully) in every other area of human interaction
beside the internet: make the perpetrator pay.    A number of us have
given this a lot of thought to come up with a practical solution which
requires no new technology and no new legislation.   It has been 
proven to work within hours.   

Those interested may view an interim document (comments welcome) at

 <http://www.camblab.com/misc/univ_std.txt>

   based on

 <http://www.camblab.com/nugget/spam_03.pdf>

I grind my teeth every time I read a summary like yours because while
the lemmas are true, the conclusions are contrary to reality and 
contrary to everything known about human behavior.

Jeffrey Race 

On Tue, 2 Mar 2004 19:32:00 -0500, John Leslie wrote:
>   I'm planning to post a summary to the MARID-planning list mentioned
>elsewhere in this thread -- hopefully before 5:00 pm Korea time.
>I expect there will be a proto-WG mailing list declared by the close of
>the MARID BoF at 11:30 Thursday (Korea time). I recommend the discussion
>continue there.
>
>   The current draft of what I will post follows:
>
>=============================== cut here ===============================
>On the <[email-masked]> mailing list there has been discussion of
>Principles of Spam Abatement. This is a brief summary of principles
>which _may_ have consensus of that list. I accept full responsibility
>for editing errors and misunderstandings.
>
>- All communications must be by mutual consent.
>
>- The spam problem starts with freely accepting mail from strangers.
>
>- Spam is and will remain a long-term battleground and it needs serious
>  effort to counter.
>
>- Every mail message carries a practically unforgeable token: the IP
>  address of the SMTP client.
>
>- It is pointless to erect some expensive Maginot Line and pretend it
>  will solve the problem.
>
>- There is not and can never be a hoop low enough to pass all human
>  strangers but exclude spammers' computers.
>
>- If you want more of something, subsidize it; if you want less, tax it.
>
>- Spammers need scale because they get a very low return. Therefore,
>  part of the solution should be to deny scalability to spammers.
>
>- If we can communicate to the sender (without adverse side effects)
>  that a message is discarded, then occasional false positives aren't
>  as much of a problem.
>
>- If you reject the message during the SMTP session you don't need to
>  generate a bounce message, the other side will do this.
>
>- Errors returned after the close of the SMTP transaction are likely
>  to go to an innocent party; and should be deprecated for any email
>  identified as spam.
>
>I also recommend perusing the summary of principles expressed on the
>Next-Generation Mail <[email-masked]> list at:
>
>http://www.cs.utk.edu/~moore/opinions/user-visible-email-ng-goals.html
>
>--
>John Leslie <[email-masked]>
>

---

From: Nathaniel Borenstein <[email-masked]>
Date: Wed, 3 Mar 2004 00:06:09 -0500

The problem with this kind of proposal is that it punishes too many of 
the wrong people.   I myself was the victim of a blacklist for most of 
last year; my ISP was blacklisted by another ISP, and they spent 6 
months arguing about it, during which time all my email to users of the 
other ISP was blocked (although they kept helpfully telling me that I 
could always switch to using *them* as my ISP).

In essence, a blacklist cuts users off from some subset of the Internet 
based on the conclusions of some ISP or other "authority" with which 
the user has no relationship at all.  At best, this says that users are 
guilty until their ISP is proven innocent.  At worst, it is -- as I 
suspect it was in my example last year -- a weapon for nasty 
competition among ISP's, with one ISP using blacklists to try to lure 
customers away from another by denying them services and blaming their 
ISP.

An analogy: Imagine you live in a town with two newspapers A and B, and 
you subscribe to newspaper A.  Newspaper B announces that newspaper A 
is doing something really bad (say, murdering children to use their 
blood as ink) and starts going around town picking up all of A's 
newspapers as soon as they are delivered, on the grounds that they are 
"bad communications" and deserve to be blocked.  Newspaper A denies all 
charges, and you believe them, but you still can't receive newspaper A, 
and you're not very amused by newspaper B's attempts to get you to 
subscribe to their paper as a replacement.

I understand that part of the motivation of this approach is precisely 
to enlist a rogue ISP's own users to convince it to clean up its act.  
As the draft says, "some abusive managements listen attentively to 
their own customers while serenely ignoring the shrieks of their 
victims."  But any scheme that distributes judgment and enforcement 
(the "who is a rogue" question) to each individual ISP so lacks 
accountability as to empower each ISP to act as a vigilante, denying 
due process to the allegedly-offending ISP while punishing the 
certainly-innocent users of that ISP.

One man's blacklist is another's denial-of-service attack.  Denial of 
service is not the answer in a world where it's so hard to assure that 
the correct people are being punished.  -- Nathaniel

---

From: John Leslie <[email-masked]>
Date: Wed, 3 Mar 2004 02:39:20 -0500

Dr. Jeffrey Race <[email-masked]> wrote:
> foundation. 

   Frankly I don't see "make the victims pay" in any of the principles.

> As long as that is your stance, then sure it is so that "Spam . . .
> will remain a long-term battleground".  

   It does, alas, remain the stance of enough people that I fear spam
_will_ remain a long-term battleground. (Do enough others disagree?
Should I remove that principle?)

> A number of us have given this a lot of thought to come up with a
> practical solution which requires no new technology and no new
> legislation. It has been proven to work within hours.   
> 

   That is an implementation plan. I've refused to put implementation
plans into the statement of principles; and I stick by that.

   (When we find the appropriate forum, I'll be happy to comment on
your "interim document".)

====
   Alas: I look at the clock, and consider the delay of distribution
to this list -- I really doubt enough time remains to discuss any
more changes.

   Thus, though I'd really like to add Dave Crocker's principle, and
I'm perfectly willing to remove the "long-term battleground" one, I
expect to be posting the same document that I posted here at 19:32 EST
to the MARID-planning list in twenty minutes or less.

   Thanks to everyone for a well-informed discussion.

---

From: "Robert G. Brown" <[email-masked]>
Date: Wed, 3 Mar 2004 12:18:11 -0500 (EST)

> could always switch to using *them* as my ISP).

And this should not happen, agreed.  But Jeff's proposal doesn't suggest
that we get into "ISP wars" between pairs of competing ISPs.  It
suggests that an offending ISP be cut off from EVERYBODY, and only AFTER
a carefully prescribed due process involving collected complaints and a
lack of action resolving those complaints.  Not just any complaints,
either -- complaints of actions that violate AUAs of networks upon which
the SP-generated traffic is carried.

If your ISP >>is<< a hotspot for spammers and viruses and its managers
tolerate the abuse, well, the rest of the people in the network don't
want to be abused.

This isn't really punishing the innocent -- it is punishing poorly run
and marginal businesses (the SPs).  They will have to very rapidly
change their ways and become responsive and police their clients.  In
MOST cases their clients have choices in the marketplace, and if they
choose to leave their SP for another that polices their networks well,
that's business.  If it drives marginal SPs out of business, that too is
the way it goes.  Don't run and ISP business unless you can afford to
keep it reasonably clean and still make money.

> the user has no relationship at all.  At best, this says that users are 

This is not true.  The entire Internet is stitched together by
acceptable use agreements NOW.  If you are a user of ANY network service
provider, you a) have an AUA with them, even if you aren't aware of it;
and b) you have an AUA with them whether or not they have one of their
own because THEY have an AUA with THEIR PoP(s), all the way back to the
backbone providers.  IIRC, "all" of these AUA's have inheritance clauses
that make you subject to them even if you don't know it, and most of
them tightly regulate network abuse with disconnection as a clearly
spelled out option.

The problem is that over time many networking authorities have become
appallingly sloppy about enforcing AUAs.  In part this is because AUAs
while universal are not uniform, in part because while commerce of a
variety of sorts is permitted and even encouraged, the lines between
permissible use and non-permissible use has gotten very sloppy.  It
isn't always easy to differentiate between "free speech" (something the
Internet openly encourages and enables) and "violating privacy"
(something the Internet de facto enables along with that freedom of
expression).  Finally, the network has grown to where the most religious
of enforcers (the toplevel backbone networks) simply don't have the
resources to police SPs connected to networks connected to networks
connected to networks connected to the backbones (with money and
contracts involved at lots of the levels in between).

Consequently you have individual SPs making unilateral
blacklist/whitelist decisions without an associated due process and
possibly motivated by reasons drawn from the marketplace and not abuse
at all.  You also have networks like yahoo.com that live in more or less
perpetual abuse of AUAs prohibiting spam and requiring a degree of
self-regulation being left alone because they are so BIG, with so many
clients, that disconnecting them is unthinkable.

I disagree -- I think that it is both thinkable and the ONLY thing short
of otherwise-punitive legislation that will make them change their ways.
Disconnection hurts an SP in the only place they really care about --
their pocketbook.  It is a ticket to instant bankruptcy if they don't do
WHATEVER IT TAKES to clean up their act, up to and including altering
their fundamental business model.

I think Jeff's proposal is to make this process formal and consistent
and to get back to ENFORCING AUAs at the SP juncture as a means of
arm-twisting SPs to a) communicate AUA requirements to their own
clients; and b) to police those clients individually, lest the rest of
the network police the SP itself collectively (effectively driving it
out of business).

> the correct people are being punished.  -- Nathaniel

Sure, but take your own example seriously.  Surely if a newspaper were
being printed in the blood of children (or whatever it was) there would
be simple objective tests that would validate this assertion.  In fact,
there might well be a chief of police, or an association of newspaper
publishers, that collected reports of people whose newspapers' ink
tested positive for human blood factors and investigated whether or not
they are true. 

In a sane universe, if it were TRUE that this were occurring, or that
the newspaper were being run by the mob, or that the newspaper
constantly ran advertisements featuring ritual human sacrifices of naked
persons (or engaging in ANY behavior deemed collectively to be
antisocial and/or illegal) it would be perfectly reasonable to shut the
paper down and arrest the owner, or arrange for a boycott of the
newspaper, or remove the paper's "credentials" from the association of
newspaper publishers (said credentials required for the newspaper to be
delivered as the paper is delivered for free by PUBLIC servants who
won't deliver trash).

Would this "punish" the subscribers?  Not at all.  There are other
papers to subscribe to.  Perhaps they'd miss some featured columnist.
Maybe they LIKE getting newpapers printed with the blood of children.
However, it's reasonable to deny them access to public resources to
deliver those papers if those public resources clearly state that they
don't accept messages in which children or animals were harmed in the
printing process.

   rgb

-- 
Robert G. Brown	                       http://www.phy.duke.edu/~rgb/
Duke University Dept. of Physics, Box 90305
Durham, N.C. 27708-0305
Phone: 1-919-660-2567  Fax: 919-660-2525     email:[email-masked]

---

From: Dean Anderson <[email-masked]>
Date: Wed, 3 Mar 2004 14:42:43 -0500 (EST)

> could always switch to using *them* as my ISP).

For them to offer competing service while blocking your ISP is probably an
unfair business practice.  This is probably something that you should
document and forward to your ISP's legal department. There are a number of
torts for them to consider.  Blocking email without permission is a
violation of state and federal law as well. State law varies, though it is
usually much broader.  Federal law is codified in the Electronic
Communications Privacy Act, 18 USC 2501 et al, and 18 USC 2701 et al.

Most AUP's and service contracts give the ISP the _limited_ permission to
block spam. However, blocking things other than spam is not permitted, and
thus not lawful. You should have contacted your lawyer.  Indeed, you
should still contact your lawyer, as federal law provides you with a civil
action to recover a minimum $1000 per user blocked, plus your attorney's
fees.  Both the users affected and your ISP can initiate a civil action on
these violations.

		--Dean