Declan McCullagh: A modest proposal to end spam. Good article on Larry Lessig’s ‘spam bounties’ proposal.
Lofgren’s plan won’t give everyone who gets spammed new rights to sue (although spam victims may already may have some rights under state antispam or other laws). Instead, it states that people sending unsolicited commercial e-mail must label it with ‘ADV:’ in the subject line or run the risk of being sued by the Federal Trade Commission. If you are the first to report an unlabeled spam-o-gram to the government, you will get a bounty of ‘not less than 20 percent’ of the fine the spammer pays, assuming it can ever be collected.
There are problems with this. As far as I know, the FTC is not having a problem collecting spam — the figures I’ve seen (can’t recall them right now) indicate that they get hundreds of megs a day. (Even the SpamAssassin.org spamtraps get over 100Mb a day.)
The difficulty is chasing down the perpetrator, and prosecuting. That takes law-enforcement manpower, and that’s just not there right now — because, let’s face it, spam is not a serious offence like rape or murder.
Anyway, Declan says that the major problem is that the spammers are offshore:
For one thing, an increasing percentage of it comes from overseas, and you can be certain that offshore bulk mailers will gleefully thumb their noses at Congress. Ken Schneider, chief technical officer of antispam company Brightmail, estimates that 30 percent to 50 percent of the spam his company tracks comes from outside the United States. ‘It’s a big number,’ Schneider said. ‘It’s a global economy, and spammers are certainly taking advantage of it.’
This is a frequent misapprehension. This is not the case. It’s true that much spam is relayed through machines in Asia and South America, but the originators — the people who are writing the spam and sending it to compromised relay machines and proxies — are US-based. In fact, a vast quantity of ’em seem to be based in Florida. (This is the thing about country-code blacklists. In reality, if we could track a message all the way back to the origin, a state-code blacklist for FL would probably work much better ;)
In other news from the same article:
… Sen. Chuck Schumer, D-N.Y., is expected to introduce a bill this week to create an national ‘do not e-mail’ list–an idea that the New Democrats touted earlier this month.
OK, while I’m here, let’s debunk ‘do no mail’ lists too. ;) ‘Do not call’ lists work well for telephones, since you typically have only one phone number. But for email:
-
one can have thousands of valid email addresses forwarding to you (I do). There’s a variety of methods to address even one user, for example ‘foo@jmason.org‘, ‘foo@jmason.org.’, ‘foo%jmason.org@localhost‘, ‘foo@212.17.35.15‘, ‘foo@dogma.slashnull.org‘ will all reach me. That’s not even considering ‘role’ addresses, like ‘sales@’, ‘info@’, etc., or single-use addresses set up for particular transactions, like ‘onetime-buying-stuff-from-ecommerce-site-example@jmason.org‘.
-
mailing lists and ‘exploders’ are widespread, and frequently spammed.
-
‘do not mail’ lists are hard to implement, since they may be vulnerable to scraping (if naively done) or dictionary attacks (less naive).
In summary, I’m not confident a ‘do not mail’ list could actually be operable.
Finally — The SBL’s answer to the EMarketersAmerica.org SLAPP lawsuit.