Non-technical on spam

[Gunnar Lindberg <lindberg at CDG.CHALMERS.SE>]

At the (anti) spam BOF in DC we were told to stay away from non-
technical issues. All fine for a BOF, but probably less successful
in real life spam prevention. Therefore I'm sending this to the
IETF list with a hope that someone better suited then myself (any
"IT Lawyers" in the IETF?) will carry on from here.

Sally, if this makes sense for the RUN WG please feel free to forward.

Being the editor of draft-lindberg-anti-spam-mta-01.txt in a small
country I found myself in a meeting at the Swedish Ministry of
Communications, something they call "the IT Commission's Legal
Observatory" (please don't ask). There were some groups of people:

  Consumers' organizations:

    o	An active Internet user finds 3 out of 4 email being spam
	(quite well described by a "real user" at the meeting).
    o	Consumers have to pay for unwanted email - we have no flat
	rate in Sweden, instead phone calls are charged per time.
    o	ISPs' costs will be "reflected" back to Consumers.

  Lawyers:

    o	-

  Telemarketing organizations:

    o	This market will self-regulate on cost/benefit basis.
    o	It's a new medium, avoid laws and regulation this early.
    o	Don't create laws that nobody will follow.

Needless to say, neither of the Lawyers nor the Telemarketeers use
email in any substantial way...

Faced with the email cost model and a suggestion that we Internet
people may create and enforce our own laws (e.g. Paul Vixie RBL)
one of the lawyers claimed "but spam IS illegal already" and handed
over a booklet from ICC, the International Chamber of Commerce,

    http://www.iccwbo.org

There are many documents - a few examples from some of them:

    +	"Advertisements should be clearly distinguishable as such,"

    +	"The full name and permanent address of the seller or of
	 the operator should be given in the offer,"

Now, if this is worth anything, spam should already be dead...

    Q1	Could someone please evaluate the legal status of this.
	Is it useful for lawyers to sue the sender?
	Is it useful for anything else?

One serious problem is of course to find the real sender. With easily
and often forged From addresses we need something more reliable, e.g.
the dialup account/IP-address shown in the Received: lines.

This brings up a question of ISPs' responsibilities. When I grew up,
anonymous (dialup) access to the Internet was something unthinkable,
something you just didn't do, period. Now, I've been told, some ISPs
hand out anonymous accounts, only valid temporarily but still useful
for some amount time and when they get closed down the spammer just
grabs another.

    Q2	What responsibility does this give these ISPs?
	Can they be forced to take responsibility on behalf of
	the anonymous spammer they just let into the Internet?

As I said in the beginning of this lengthy mail I hope someone with
more knowledge about legal issues carry on from here. I know this is
the IETF list and a non-technical question, but at times these two
probably have to meet.

	    Gunnar Lindberg