Slashdot Log In
Senate Passes Anti-Spam Bill
Posted by
michael
on Thu Oct 23, 2003 01:35 PM
from the baby-steps dept.
from the baby-steps dept.
Zendar writes "Yahoo! is reporting that the 'U.S. Senate passed the first national anti-spam bill on Wednesday, giving momentum to an issue that has riled consumers almost as much as dinnertime phone calls.' However, the bill, referred to as the 'Can Spam' bill, is unlikely to pass the House and be signed by the President. Senator John McCain sums it up: 'The odds of defeating spam by legislation alone is extremely low, but that does not mean we should stand idly by and do nothing about it.' CNN also has the story."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Politicians for Ya (Score:5, Insightful)
Meaning, 'What we do has no effect, but we need to look like we're doing something useful.' And of course there _shall_ be unintended consequences, which will require yet another government "fix".
Re:Politicians for Ya (Score:5, Insightful)
Parent
Re:Politicians for Ya (Score:5, Insightful)
Parent
Re:Politicians for Ya (Score:3, Informative)
Re:Politicians for Ya (Score:5, Interesting)
A legal front that ought to be opened is the application of existing computer-crime laws to certain spamming techniques. The deployment of trojans to create open relays and even outright spamboxes is an obvious example.
Additionally, the use of forged headers, munged words, etc to evade spam filters is arguably a form of cracking in and of itself -- what is it, if not a deliberate attempt to use someone else's computer without the owner's permission, and indeed against the owner's express prohibition?
Parent
Re:Politicians for Ya (Score:3, Funny)
We shall fight on the landing grounds,
We shall fight in the fields, and in the streets,
We shall fight in the hills;
We shall never surrender,
--Winston Churchill
Re:Politicians for Ya (Score:3, Insightful)
Agreed - but an even more important front is the official recognition that spam is not acceptable behaviour (which a properly worded law would be.) Remember - a lot of spammers hide behind the "I'm not doing anything illegal" mask - a law against spam would remove that excuse from their arsenal, and give the average person some assurance
Re:Politicians for Ya (Score:4, Insightful)
Next he can pass a bill that will ban breast cancer. The odds of defeating breast cancer by legislation is extremely low, but that does not mean we should stand idly by and do nothing about it.
I think the statement would make sense if he were choosing to not promote the bill and instead try to do something else. Just because legislation won't stop the problem doesn't mean we have to sit idly by. Even a senator has other resources available than legislation to help with a problem.
-Jacob
Parent
Re:Politicians for Ya (Score:3, Interesting)
Ummmm, yes, that's exactly what it means.
Spam is a social, and perhaps technological, issue. Please stop wasting my tax dollars and your time on promoting legislation which you yourself admit is pointless and go handle some issues for which legislation is the actual remedy.
If you really need some useful "makework" and a politically advantageous cause how about going
Re:Politicians for Ya (Score:3, Insightful)
going through the books just to find laws that shouldn't be there but aren't enforced is completely useless. If they're not enforced, then they technically don't exist (a bit of trivia, marjuana is, in fact, illegal in the Netherlands, but no one gives a rat's ass, and the laws are never enforced, so i
Re:Politicians for Ya (Score:4, Interesting)
Parent
Fuck 'em. (Score:4, Insightful)
I think the Senate, as usual, passed a do-nothing measure that will have not an ounce of effect on the literally 350 spams I receive a day. (Yes, I do use spam filtering.) Congress would be better off to provide tax credits for companies producing filters, starting a massive education campaign on how you can stop unwanted e-mails using these filters, and investing heavily in research projects to improve filtering.
But this is a bunch of more fucking useless bullshit--par for the course for this Administration.
Follow the cash (Score:5, Insightful)
Yes, the spam mostly comes from IP addresses outside the U.S. However, it is almost always advertising something sold by an entity in the U.S.
This bill, if passed, can have an effect. If a company in the U.S. uses spam to advertise, and that spam has fraudulent headers, then the U.S. company can be prosecuted. That's the true origin of spam-- not the IP address of the sending machine. This allows for a non-technical approach to combat the true originators of the messages.
Why do spammers use fraudulent headers anyway? To evade technical spam-blocking techniques (RBLs, whitelists, etc.). As the spammers start to reduce their use of such methods, the technical techniques used by many ISPs and end users will be more effective. No silver bullet, to be sure, but every little bit helps.
Parent
Re:Follow the cash (Score:5, Informative)
See, the mortgage company is not involved in the SPAM at all! The mortgage company just buys the name/addres of someone interested by low rates.
No one does anything wrong in the U.S. with this model.
Parent
Re:Fuck 'em. (Score:3, Insightful)
But this is a bunch of more fucking useless bullshit--par for the course for this Administration
The Sponsor of the bill is Sen. Charles Schumer (D-NY). He's not exactly a part of the Administration. . .
Drat (Score:3, Interesting)
(Grim) Humor aside, the only thing that I can see this doing is forcing spammers to move off shore, open shell companies in spam havens, and generally make things harder to do.
Hate to say it, but I think it is time to move beyond email.
Re:Drat (Score:4, Insightful)
Parent
Re:Drat (Score:3, Funny)
Such as... telepathy??
Might want to think about changing the name.. (Score:4, Interesting)
It's a shame that they think it won't go anywhere, though...
-- Dr. Eldarion --
Best Spam Recently (Score:4, Funny)
Stuck with Outlook? (Score:5, Informative)
I downloaded and installed the latest version last night and am very impressed with this seemlessly integrated Bayesian Spam Filter (make sure anti-virus software is disabled before installing -- which can be difficult with McAfee as I discovered).
Very much recomeeded.
SpamPal (Score:3, Informative)
Re:Stuck with Outlook? (Score:3, Insightful)
Well duh (Score:3, Insightful)
What they really need to do (Score:5, Insightful)
Just use a "+" (Score:4, Informative)
So let's say my address is ClintXYZ@unix.org. I could sign up for something as ClintXYZ+ajkfdsjdfasjoifdoj@unix.org and the email would still be received by me.
Come up with a system, like ClintXYZ+yahoodotcom@unix.org. Then, if a spammer ever harvests your address, and doesn't cleanse out the extra characters, and then spams you, you will know it was yahoodotcom that did it. [This is just an example; don't sue me Yahoo.]
This has worked at least once for me (After doing it for a few years). A yahoo store violated yahoo privacy policy by doing this, and I reported them to yahoo. Never followed up though.
It's also good for mailfiltering. ClintXYZ+slashdot@unix.org for example if I wanted to filter everything that came from slashdot into its own filter.
Beware of webforms that don't allow +'s in the email addresss. It's a grey area of email address validity.
Parent
Funny how that works (Score:5, Insightful)
This is great! (Score:3, Interesting)
And, of course, I must unoriginally question just how they plan to enforce this? Perhaps we should just invade any country that originates more than
"CAN SPAM" = OK, you CAN SPAM at will (Score:5, Insightful)
Re:"CAN SPAM" = OK, you CAN SPAM at will (Score:4, Interesting)
Amendment X
The powers not delegated to the United States by the Constitution, nor prohibited by it to the states, are reserved to the states respectively, or to the people.
Parent
Re:"CAN SPAM" = OK, you CAN SPAM at will (Score:5, Insightful)
Federal law trumps state law. Ammendment X is not applicable here, any more than it is for the Do Not Call list or the Fair Credit Reporting Act because this law is made under the auspices of interstate trade which the federal government is explicitly granted authority over in the Constitution. And spam is most certainly interstate... in fact, the state laws do little or nothing because enforcement ends at the state line. To a large extent it's questionable whether or not this law will do anything since enforcement will end at the US border, but if it's well designed (which is questionable) then it's at least a start.
Sadly, nothing short of completely replacing SMTP with a more secure protocol, including authentication, is going to stop spam.
Parent
End users can no longer sue (Score:5, Insightful)
"State and federal law enforcers and Internet service providers such as EarthLink, Inc. would be allowed to pursue spammers, but individual users could not sue directly."
That's majorly unfortunate. It basically means that spammers will be able to buy (through settlements) access to ISPs, and the customers will have no recourse.
Other things the senate voted in (Score:3, Interesting)
Smoke & Mirrors (Score:3, Interesting)
"...but we'll pacify the ignorant public with the appearance of trying to combat spam. That will get us elected to another term, at least!"
Problem with a do-not-spam registry (Score:5, Insightful)
The only reason this isn't happening with the telephone do-not-call list is that the cost of international calls is still prohibitave... but I think VoIP might make this option attractive at some point. I'd just love to get a sales call from some guy in India trying to sell me a new car windshield. Also, phone numbers are published anyway, so there is no real need to harvest the do-not-call list.
I think the way this should be implimented is a national list of MD5's of the addresses. Make it illegal to email any address whose md5 matches one on the list (converted to lowercase so that capitalization is not a loophole). This would prevent address farming, and have the same integrity as the proposed do-not-spam list.
(BTW, consider this prior art in case anyone goes patenting md5's of email addresses...
this bill (Score:5, Insightful)
Do Not Email List == Loss of Privacy == Abuse (Score:4, Insightful)
A "Do Not Email List" would cause a further loss of privacy...government (and its contracters, some of which are sketchy) would be able to associate email addresses with IPs and possibly other information...
If implemented, it's very likely one would be asked to not only supply the email address(es) they wish to add, but would also asked for their real name, postal address, and phone number too.
Now anyone who thinks that information will remain confidential is kidding themselves. Did you know most U.S. states sell driver license information, including DL pictures to private entities...even those states that have laws against such actions share the information too due to various loopholes in their respective state laws; information also shared with other government agencies, including the Feds (don't think for a second it's not).
Ok, got on a tangent there, but to make a point...
If the government were to compile a "Do Not Email List"...the following will *likely* occur...
* Email and associated collected information would be stored and added to other unrelated government/private databases too.
* Government and other private entities will use the list to help track/monitor people - ie. "Deadbeat Dads"
* The email addresses and likely their related information will be used by politicians for sending out spam...yep, there's likely an exception for that; there is for the national do not call list.
* Various private entities, mostly offshore, will obtain the "Do Not Email List" and use it in the exact opposite way for which it was intended...that is they'll send spam to those addresses.
Opt-Out doesn't work for email; its debatable whether it works for phone numbers either, but that another topic for another day.
Bottom line is that any decent anti-spam bill should NOT have a "Do Not Email List" component, but rather instead require companies, non-profits, politicians, etc to use double-verified OPT-IN email lists for sending ubsolicited email.
Ron Bennett
Real Solutions (Score:4, Insightful)
Now let's get real:
It's important to realize that there are certain characteristics of most spam:
1. Most "legitimate" promotional mail comes from a static, traceable source (i.e. mailing lists or a specific web site such as amazon.com) The more legitimate spammers, due to their visibility, are forced to maintain more responsible mailing practices or else they will be blocked or blacklisted.
2. The vast majority of spam comes from rapidly rotating sources difficult to trace and lock down (random IPs on the Internet that are either unauthorized or compromised SMTP servers). Regardless of the nature of the spam message content, most of these spam sources involve one or both: violation of the ISP's terms of service (which most disallow smtp relaying from direct client IPs), or an illegal exploitation of third-party computers.
#1 is easily dealt with. Any centralized operation that doesn't perform responsible mailing (opt-in/out, non-forged headers, published contact info, etc.) can be dealt with. We know who these people are and how to reach them; they are large, targetable operations.
#2 is the real problem and the major source of spam online. All the penis-enlargement, Nigerian scams, online pharmacies and home mortgage solicitations are promoted through the use of an ever-changing network of computers, most of which are broken into by spammers or otherwise re-routed through a plethora of foreign ISPs.
The key to solving the spam problem is nailing down #2. I believe that most of the rotating spam sources involve illegal computer exploitation and compromises. We're talking criminal activity - not civil wastes of time. This is the angle law enforcement should use. Go after relay hijacking and enact punitive damages on ISPs who have demonstrated a consistent disregard for the control of their IP blocks. If we go after the spammer-criminals, they will be forced to settle with spam-friendly ISPs or face criminal prosecution. At that point they either clean up their act, or their ISP will become blacklisted. So the solution is straightforward: go after the spammers who take over third-party SMTP servers and client machines. These are criminal offenses which the authorities have yet to actively enforce.
My solution to the Spamedemic:
Believe it or not, solving the Spam problem is really easy and practical. It does not involve infringing on freedom of speech. It does not involve denying ANY business interest the freedom to use e-mail for marketing.
1. FORM A DEDICATED CYBERCRIME ENFORCEMENT AGENCY. Populate the agency with well-trained IT people who know the laws and the nature of the problem. This agency does not need to encroach into areas covered by US Customs or the FTC (i.e. not be concerned with the content of spam, but merely focus on computer/network-tampering/exploitation). The FBI is not adequately equipped to fight cybercrime. A new agency separate from the other law enforcement organizations should be created.
How to fund this new agency? How about a small fee for domain registrations? I think most people would be willing to pay an extra $5/year per domain to ensure that the Internet is more secure and spam-free. In any case, there's plenty of frivolous spending that could be repurposed to fund this very useful agency.
2. ENFORCE CRIMINAL PENALTIES for computer exploitation: mail-relay-hijacking, trojan horse, worm, virus and vulnerability exploitation. There are already laws on the books criminalizing these activities, but since Americans like laws and have a short attention span, it wouldn't hurt to pass a new law which exclusively, specifically addresses the issue of computer/network/communications exploitation by third parties, and levies very intimidating CRIMINAL penalties. There should be no threshold of monetary damage before criminality is triggered: that only punishes diligent admins to catch attacks before extreme damage
5 year prison terms (Score:4, Funny)
Problem with "opt out" legislation (Score:4, Interesting)
I've thought of generating a bunch of legal addresses and putting them on a CD-ROM, to show to my congresswoman with the message 'Here are 60 million of my legal e-mail addresses. This disk is full. How many more should I make?'
I'm glad that this bill is unlikely to pass, though it makes up something like 70% of my mail. We need opt-in legislation, and we need it with teeth. Large and increasing fines, individual grounds to sue, and possibly even the death penalty after some number of convictions; maybe 10?
How about this idea .... (Score:3, Interesting)
Hell, the RIAA got such an absure bill introduced. Just imagine if anti-spammers had that kind of back-door infuence on the congressional process.
Who Can Prosecute? (Score:4, Informative)
For those of you interested... (Score:5, Interesting)
CAUCE (Coalition Against Unsolicited Email) opposes this bill [cauce.org].
The bill isn't "Can Spam" in terms of canning spam. It's "Can Spam" in terms of "You Can Spam. Sure. Go ahead." It's opt-out, not opt-in. Prepare to have your mailbox flooded. Legally.
Sec. 105 (a):
(4) PROHIBITION OF TRANSMISSION OF UNSOLICITED COMMERCIAL ELECTRONIC MAIL AFTER OBJECTION- If a recipient makes a request using a mechanism provided pursuant to paragraph (3) not to receive some or any unsolicited commercial electronic mail messages from such sender, then it is unlawful
(5) INCLUSION OF IDENTIFIER, OPT-OUT, AND PHYSICAL ADDRESS IN UNSOLICITED COMMERCIAL ELECTRONIC MAIL- It is unlawful for any person to initiate the transmission of any unsolicited commercial electronic mail message to a protected computer unless the message provides--
On the other hand, Sec. 105 (b) (1) (A) (i) and (ii) make it illegal to use address harvesters or dictionary attacks to send spam.
I'm also worried that Sec. 105 (e)'s restrictions on sexually explicit advertising will be struck down as unconstitutional, and may have adverse effects on the rest of the law.
Musings on how this might work (Score:3, Interesting)
Instead, the list would need to be secret, and a spammer could send a query: "Is joe@yahoo.com on the list?".
You need to avoid the naive solution, where the list-keeper says "yes" if the address is on the list and "no" if it is not on the list. Otherwise, a spammer could just do a dictionary-type attack on the list to discover as many email addresses as she could. "How about joeb@yahoo? joec?"
You need to instead say "yes" if the address is on the list and then randomly choose "yes" or "no" otherwise. This way if a spammer gets "yes" she doesn't know whether she has a real email address or not.
Ah, but more problems. If the response is truly random, then a spammer can make a repeat request for all the addresses that the list-owner said "yes" for. The ones that actually aren't on the list will have a chance of coming up "no" a second time. Repeat as many times as you want to get a higher certainty that you have obtained usable addresses.
So you instead need some history -- always say yes to "fooxyz@yahoo" even if it is not on the list. And now your memory requirement becomes infinite. Sure you could keep a cache of your most recent responses, but this just delays the time it takes for the spammer to find out who is on the list.
From this brief thought-exercise, I don't know if a "do-not-spam" list is doable. Maybe I'm missing something.
What is clearly much easier to implement is a "please-spam-me" list. The memory requirements would sure be smaller. And no problem making this a publicly-available list. Likewise, it would be easy to prove you are not on the list when you get some spam. And hey, if 90% of uses don't want spam, why should we force them to say "no"?
Buyer Beware! (Score:4, Informative)
There's ALWAYS a Way (Score:4, Funny)
They should have called it something like "Mary Sue's Law for Liberty and Freedom". It would have been signed by dinnertime today.
Also, have a link between spam, Bin Laden, Hussain, and peodphiliac drunk drivers.
Re:Finished Quote... (Score:3, Insightful)
Ah... but it's these same ridiculous laws that make cops stand by until it's legal to do something about it.
Re:This will only momentarilly stop the hemorrhagi (Score:3, Funny)
That could be a problem -- after Afghanistan and Iraq, I'm not sure if we still have 20 Predator-mounted Hellfires in stock.
Re:Ledgislation is BAD (Score:3, Informative)
Re:It's been said time and time again... (Score:3, Interesting)
In this, it is similar to the problem of burglary -- both better locks and better law enforcement have their place.