Internetworkers: http://www.ibiblio.org/internetworkers/

["Michael D. Thomas" <mdthomas AT mindspring.com>]

> Personally, I don't know /what/ to do about spam.  I mean, I get a lot
> of it, but I try not to let that bother me and simply hit 'delete' a
> lot.  Thankfully, I don't have to run any mail servers and don't see
> these problems on a daily basis.

Spam is a problem. One day, it'll be a federal crime. 

I think the best way to think about spam is to compare it to other
crimes, like burglary. We have laws against burglars. We can lock them
up. As a society, we tend to frown on burglary. 

Still, we can't assume that laws will protect us entirely. We need to
install locks and even alarm systems. We have to take a passive approach
to defend ourselves against burglars. 

With spam, we are at a stage where we are building more and more
elaborate locks and alarm systems. Some, such as challenge-response,
actually inconvenience our friends and legitimate callers. It's as if
the alarm system for your house was so complex that people stopped
coming over to see you. That undermines the value of your house and
impairs your ability to connect with the rest of society. 

Unfortunately, without good spam laws, we are prone towards a defensive
approach. Obviously, anti-burglary laws don't prevent all burglaries.
But neither do elaborate alarm systems. Spam isn't just a technological
problem, it is also a societal one.

In lieu of such laws, there is the aggressive, vigilante approach. It
has an appeal that using SpamAssasin does not. But I think you have to
compare to the idea of going and beating up someone that broke into your
house. At the very least, you've violated the Golden Rule. You've also
committed a crime.

However, if you spam the spammers, you haven't committed a crime any
more than a crime was committed against you when you received the spam.
The better analogy is that you are in the Wild West and the sheriff
isn't in town.

The best approach is a civilized one. But this is a very complex problem
that tests our ability to make laws. I like the idea of netizens going
after spammers directly. But the best possible manifestation of this
spirit is a private right of action for all of those that receive
unwanted or fraudulent spam. You can sue professionals who misrepresent
themselves to you. You can get restraining orders on people that are
bothering you. You should be able to sue spammers that use fraudulent
techniques and disregard the costs they incur on those that aren't
interested.

As a final note, here are the basic components that I think federal
anti-spam legislation needs:

- First, faking headers must be punishable. I think every piece of spam
legislation that I've looked at has such a provision.
- You can stop an entity from sending you spam. If they don't stop they
can be punished.
- An entity can stop another entity from sending spam to email accounts
it owns -- i.e., Glaxo can tell a spammer that it can't send spam to any
Glaxo account. (I'm stopping short of saying that an ISP could tell a
spammer not to send to any of its accounts b/c ISPs don't own those
accounts. However, an ISP could act on behalf of its customers in this
regard.)
- There is private right of action. You don't have to depend on a
government agency to go get spammers. You can pursue spammers through
the court system. More importantly, big corporations with deep pockets
and in house counsel can, too.
- It should be possible to file class action lawsuits against spammers.
- Any commercial entity that benefits from "bad spam" -- i.e., faked
headers or spam sent to someone after they have asked the "bad spammer"
to stop -- can also be punished as if they were a spammer. Such
punishment should include private right of action.

The last one is the most important but is also the hardest to frame. For
instance, I could send out a spam with faked headers that points to an
IBM site that sells Thinkpads. As a result of my spam, IBM might sell a
few Thinkpads. But obviously, IBM shouldn't be punished b/c I woke up
today and decided to send my spam. Besides, I could address it to myself
in order to give me cause to sue ;-)