The CAN-SPAM bill examined

Posted Nov 26, 2003 3:39 UTC (Wed) by zone (guest, #3633) [Link]

> CAN-SPAM also makes it illegal to for spammers to use open relays or other methods of hijacking computers to send spam, and requires a working method to opt-out of e-mail. Again, these provisions are unlikely to deter offshore spammers, but the provisions are welcome nonetheless.

The requirement of an opt-out method is a nice loophole for the government and ISPs to be able to prosecute spammers who are otherwise legitimate businesses sending now explictly legal email. However, it would be a tragedy if 'Just click the opt-out link when you get spam, it's illegal for them to keep sending you spam after you do that' becomes common knowledge. Even if you assume (made up statistics) that 25% of spam originates in the US and 50% of that compiles with the opt-out provision, that'd still mean 7/8 of the opt-out links put your email address on the known-good and known-reader lists.

In my experience, users were really catching on that spam should be disregarded entirely. Lets hope sys. admins reinforce the 'don't reply to spam, ever' mantra around the office. And lets home the press catches on as well: a slew of 'Spammers required to honor opt-out' headlines could set us back five years in five days.

Posted Nov 26, 2003 6:32 UTC (Wed) by AnswerGuy (guest, #1256) [Link]

Thus U.S. legislative process is systemically broken at this point. Almost no consideration remains for mainstream popular interests --- it's all special interest pandering; mostly purchased by professional lobbyists, with a few
nods to politically influential extremists on a few knee-jerk issues (abortion, gun control, etc).

It is almost inconcievable that any law could materially reduce spam.

A "do not spam" list could be implemented in a distributed and technically sound way that didn't give spammers a simple new target list. I would specify a sort of DNS query sort of like a negated SMTP VRFY --- call it a "NOMAIL" query. So, if I have a purported e-mail address in your domain I can make the query --- if I get a "TRUE" back it mean that I may NOT send mail to that address at that domain.

Trying to harvest addresses through this won't work --- if you make up addresses I'll just return a TRUE for any possible address. I will ONLY return a "false" NOMAIL for those (very few) people who *want* to receive spam. I'd extend that spec. a little to provide rate throttling. So the extra fields for this query would say: "don't ask about *any* other NOMAIL addresses for at least N minutes" It would be illegal to violate that part of the spec (from the client side) :)

In my version of the "opt-out" list each ISP would be free to have a policy that all spam is unwelcome (if you want spam go join another ISP) or to treat the default as "NOMAIL" and internally implement it as more of an "opt-in" mechanism. Commercial mailers would be required to make a NOMAIL query before sending unsolicited bulk mail (defined as 100 or more recipients in 24 hours, 1000 or more per week or 10000 or more per year).

Would this be too much of a "burden" for legitimate commercial mailers? Certainly not on a technical level. There is only a tiny incremental cost to the extra DNS query. On a political level --- HELL YEAH! It would prove to all and sundry that almost NO ONE wants to get unsolicited mail. Almost NO ONE would sign up for this (and many ISPs would publicly state that customers who did want spam were unwelcome at their site).

In other words it would reveal, even more starkly than the U.S. national "Do Not Call" list, that people are tired to pushy forms of advertising.

Jim

Posted Nov 26, 2003 10:48 UTC (Wed) by dps (subscriber, #5725) [Link]

If this law forces US spammers, who seem to be a majority where I sit, to use identifable IP address this the bill might be more useful to "normal users" than you think... We can then block all mail from those specific IPs (with a deny rule on our firewall, ideally backed up by deny rules on mail servers, etc).

ISPs could blackhole those IPs too to reduce the amount of their bandwidth wasted by spammers---in the old days when spammers were using their own IP addresses some major ISPs (such as ISPs the small ISPs use) blackholed the major sources of spam. This prompted the current tactics.

Posted Nov 26, 2003 14:48 UTC (Wed) by copsewood (subscriber, #199) [Link]

I think that appropriate law on this can have an effect if denial of service starts to be voluntarily operated against email services from IP ranges within countries that don't implement and enforce laws based on certain principles. I suggest these principles are likely to include:

a. Opt in. AnswerGuy's post suggests how a suitable list might be implemented from a technical point of view. This would place an extra burden on DNS administrators, but use of DNS wildcards to opt-out everyone using a particular ISP or domain by default might make a legislated opt-out provision effective if the authority tasked with implementation by the legislation accepts a wilcarded opt-out implemented by ISPs as meeting the requirements of the legislation.

b. Companies are considered accessories for computer crimes or breaches of ISP contracts by third parties used to propagate their marketing messages. A civil liability should apply in civil matters (breach of ISP contract) and a criminal offence should be prosecuted in respect of criminal matters (e.g. causing a mail-relay trojan to be installed). Something similar was done to shut down pirate radio in the UK coastal waters during the 1960ies. Without the advertising revenue to fund it, this activity dried up.

c. Use of forgery and deception to attempt to hide the message origin. Where there is systematic intent to perpetrate a fraud, including deliberately misleading bulk recipients as to the message orgin and the law has loopholes, these need to be tightened up.

Posted Nov 26, 2003 15:00 UTC (Wed) by freethinker (guest, #4397) [Link]

"Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003"? Why does Congress have this obsession with cute acronyms? You'd think they were with GNU or something.

Posted Nov 26, 2003 18:15 UTC (Wed) by Ross (guest, #4065) [Link]

They both have to do with opt-out.

1) Companies are allowed to spam until you opt out. What keeps a company from farming out their spamming operations to different companies. After each round, aren't they allowed to spam you again as long as it is a fresh company?

2) There is no requirement that the opt-out mechanism be simple, that is is understandable, that it can be completed quickly, that it can be completed without more advertisements, or even that it works on non-Windows platforms or with non-graphics browsers. What keeps them from making you click through 12 different GIF-animated, Javascript and ActiveX filled pages before they confirm your removal?

3) Now that you have opted out of that specific company's spams, what keeps them from selling your verified legitimate address to another spamming operation?

Posted Nov 26, 2003 19:21 UTC (Wed) by skybrian (subscriber, #365) [Link]

A national do-not-spam list might actually be somewhat useful, but not for ordinary users. Instead, ISP's and spam fighters could put dummy email addresses on this list and use it to more easily detect spammers.

Posted Dec 2, 2003 7:39 UTC (Tue) by jmason (guest, #13586) [Link]

'The CAN-SPAM bill actually has the effect of legitimizing spam so long as it is non-fraudulent and provides the recipient with a means to "opt-out" of future e-mails. This is a big win for the DMA, and a major loss for the rest of us.'

Agreed.

Note, however, that many other parts of the world, including most of Europe, already has or will be making opt-in a requirement; in other words, doing spam laws *right*.

So even if CAN-SPAM suits the DMA's members, they may still have an interesting time trying to figure out which list 'subscribers' are "opt-in required" (outside the US) or not (inside the US).

I, for one, do expect to see an increase in mainsleaze spam. However, my .org, and my personal email address(es) are registered and based in Ireland, which requires opt-in; and big US-based multinationals -- or at least the ones with European offices -- may still have to respect Irish laws in that respect. That should be interesting -- and worth a try, at least!

Posted Dec 4, 2003 21:06 UTC (Thu) by gswoods (subscriber, #37) [Link]

The idea that government interference won't solve the problem is not new, it is rather obvious. You don't have to look any further than the War on Politically Incorrect Drugs and the Civil Rights of the Innocent ("War on Drugs", for short). Has this approach solved the drug problem? I would argue that it's made it worse, since addicts now have to admit to being criminals before they can get help, and we have thousands of people incarcerated for drug crimes who have never directly harmed anyone else. Keep in mind that drug dealers, unless they use force to make their clients use their product (or target children), aren't the ones doing harm, those who choose to take drugs are responsible for whatever harm is done to them. There are already laws against things that addicts might do while high or in order to obtain drugs that cause harm to others.

I am not trying to make a direct analogy between drugs and spam, but the point is that trying to control a social problem by making it illegal rarely works, almost always has side effects that are worse than the original problem, and it gives people a false sense of security. I believe that technical solutions can eventually make it unprofitable to spam, which is the ONLY thing that can effectively end it. As long as it's profitable, spammers (who already don't much care what laws they violate) will continue to spam.

I personally like the idea of SPF (Sender Permitted From), where sites can indicate in their DNS records which IP addresses are allowed to initiate mail that purports to be from that domain. If this spreads netwide, it can put a virtual end to e-mail forgery, which will go farther than any law in getting rid of spam. I could block 99% of all unsolicited spam if I could reject any mail whose sender address either doesn't exist or doesn't come from one of the real mail servers for that domain.

Posted Dec 5, 2003 18:12 UTC (Fri) by tegbert (guest, #17578) [Link]

Sometimes our inept Congress stumbles onto something.

The reason we have so much spam is because the email system as it now exists allows it with very little friction. It's analogous to the reason we have so many email virii: because Microsoft Outlook is so promiscuous.

If this Congressional action makes the spam situation worse, maybe it will hasten the day when one or more of the many technological methods of reducing spam will finally be put into effect.

tegbert