Subject: Joint legal/technical anti-spam effort

From: "Eric A. Hall" <[email-masked]>
Date: Mon, 26 May 2003 00:56:19 -0500

Below is an example of how technology and the law could work together,
with both camps bringing essential pieces of the puzzle to the table.

What should be most obvious from this exercise is that there needs to be
somebody willing to intermediate between the legislature and the
engineers. Otherwise, they will produce ineffective laws and we will
produce ineffective technologies, both in isolation.

Objectives:

  minimize the need for post-transfer spam detection

    - provide technical measures for refusing mail prior to transfer

    - provide legal backup for when the technical measures are ignored

  fundamental premise is preservation of property rights

    - my bandwidth/storage/cpu is my property

    - this extends into privacy realm; some users may choose to put
      up virtual "no trespassing" signs and those prohibitions
      should be protected under the same principles (gradeschool
      children, emergency-responder mailboxes, hermits, etc)

Technical measures:

  Short-Term

    - RCPT TO response codes signifying acceptance levels, EG:

    - 250 (default) what the law allows by default

    - 255 (stiff) no solicitations at all

    - 259 (extreme) no trespassing -- authorized senders only

    - 25x allows interoperability but other codes may be more useful,

    - especially considering different jurisdictions will likely need
      their own codes

    - organizations can set default as policy requires, or can allow
      users to set according to preference

  Medium-Term

    - improve accountability measures in email

    - possibile work areas include encouraging authentication, PTRs,
      TLS and certificates, etc.

  Long-Term

    - reinvention of mail transfer service

    - eg, recursive signatures of modernized "Received" headers allow
      path validation at any hop

    - global directory technologies for key retrieval and other uses

Legal Measures:

  Must be defined per-jurisdiction but some US examples might be:

  Definitions

    - define problem messages as any solicitation, such as for money
      or action (eg "click here")

    - some exceptions such as charities, government, others, MAYBE

    - violations after grace period (1 year?) subject to law

  Protection

    - default case, recent prior relationship is okay

    - recipients may always refuse (eg, stronger response codes)

    - recipients may opt-out even if a current relationship exists

    - no opt-in explicitly required but encouraged by penalties

  Penalties

    - recipient has private civil recourse

    - $500 per unlawful recipient, treble for willful violations

    - can file against beneficiary if invalid recipient

    - can file against bulk-mailer if response codes ignored

    - "loser pays" written into law to prevent abuses

    - state reserves felony penalties for egregious violators

    - bulk-mailers implicitly encouraged to use documented opt-ins

So who would the IETF community trust to take something like (better than)
this to their jurisdictional legislature(s) and asks for feedback?

<cynic>and have they made the right campaign contributions</cynic>

-- 
Eric A. Hall                                        http://www.ehsco.com/
Internet Core Protocols          http://www.oreilly.com/catalog/coreprot/

---

From: Bill Sommerfeld <[email-masked]>
Date: Mon, 26 May 2003 09:28:39 -0400

>       users to set according to preference

 - virtual "no soliciting" signs may be more appropriate in some cases.

 - allow receiver to provide an (optional) indication of the receiving
host's or users's legal jurisdiction(s), so that the spammer can't
claim they don't know which set of rules apply.

						- Bill

---

From: shogunx <[email-masked]>
Date: Sun, 25 May 2003 12:17:45 -0400 (EDT)

I have a mailbox at gmx, a german isp in england.  the anti-spam measures
recently enacted there now label all posts from ietf-announce as spam.  be
careful what you wish for.

scott

> <cynic>and have they made the right campaign contributions</cynic>

sleekfreak pirate broadcast
world tour 2002-3
live from the pirate hideout
http://sleekfreak.ath.cx:81

---

From: [email-masked]
Date: Mon, 26 May 2003 11:56:59 -0400

>     - 25x allows interoperability but other codes may be more useful,

(a) this isn't usefully backwards-compatible - it only helps if you're
talking to another upgraded MTA.  As such, given the usual glacial upgrade
speed, this isn't a short-term solution.

>     - especially considering different jurisdictions will likely need

See Don Eastlake's I-D:

http://www.ietf.org/internet-drafts/draft-eastlake-xxx-05.txt

You're looking at a lot of the same issues.

---

From: "Eric A. Hall" <[email-masked]>
Date: Mon, 26 May 2003 11:14:24 -0500

on 5/26/2003 10:56 AM [email-masked] wrote:
>> - RCPT TO response codes signifying acceptance levels, EG: - 250
>> (default) what the law allows by default - 255 (stiff) no
>> solicitations at all - 259 (extreme) no trespassing -- authorized
>> senders only - 25x allows interoperability but other codes may be
>> more useful,
> 
> talking to another upgraded MTA.  As such, given the usual glacial
> upgrade speed, this isn't a short-term solution.

Bulk-mailers as senders are a small enough scope that forced upgrades
within a grace-period window is feasible.

No recipients have to upgrade unless they want stronger rejection levels
over the default. Every system that generates 250 today would have the
default protection tomorrow.

There is some validity to the argument that non-spamming senders would
have to upgrade to recognize the stronger codes. Perhaps this is the best
argument for using codes other than 25x.

---

From: [email-masked]
Date: Mon, 26 May 2003 13:15:23 -0400

> within a grace-period window is feasible.

The people that are the problem have a horrible tendency to not follow
the *CURRENT* RFCs (things like ignoring MX records, syntactically borked
MAIL FROM:, the whole gamut).

What makes you think they'd upgrade to software that would diminish their
ability to spam people who didn't want to be spammed?

---

From: "Eric A. Hall" <[email-masked]>
Date: Mon, 26 May 2003 12:20:19 -0500

> ability to spam people who didn't want to be spammed?

That's what the penalties are for. The people who are doing that kind of
stuff today do it because there isn't any penalty for doing so.

A grace period gives them time to get their act together, to honor the
law, to clean their lists, etc. After that, bombs away.

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 26 May 2003 11:37:00 -0600 (MDT)

> From: [email-masked]

> ability to spam people who didn't want to be spammed?

See also standards track RFC 2919 which is supposed to identify bulk
mail and which this mailing list does not follow.

Vernon Schryver    [email-masked]