U.S. Spam Law to Take Effect Jan. 1

We lead with news that the U.S. 'anti'-spam law, written largely by the Direct Marketing Association, will enter into effect on January 1. The bill preempts existing state laws which are tougher (states' rights anyone?), so for many citizens, this is purely a pro-spam law. The FTC is thinking about bounty hunters to enforce the new law (which you can and probably should read for yourself).

And now we can do some real work?

[Zeinfeld]

The law was necessary and inevitable. Not doing anything is not an option when the US is the second major source of criminal spam scams. Do you want the US business reputation to sink to that of Nigeria?

PA's don't-call-list is DMA managed

[Anonymous Coward]

And I don't get ANY sales calls since I signed up, but I worry how many spammers give two shits about the DMA, unlike the phone scumbags.

Please opt-out - 10,000 times

[loggia]

Yes, this is a great law. Even if spammers follow the law, you'd have to opt-out for every
"company" spams you.

That is going to work great. Put this one right up there with the Medicare Bill on the list of "2003 Who Cares If It Doesn't Work, We Passed It" legislation.

Re:What is going on in the US?

[FortKnox]

Its a step in the right direction, but isn't what you think it is.

Its a law that forces soliciters to acknowledge who they are (nothing really big), but the one kicker is to enforce that if you opt out, the spammer actually opts you out.

Direct Marketing Association...

[TypoNAM]

Isn't that the same organization that was formed by many spam companies to fight anti-spam companies by threatening to sue them?
Well that's just great! Have a spam organization set the rules for the country to follow by. It's official our government is forever currupted!

cannot sue the spammers

[Janek Kozicki]

if this is it [slashdot.org] then look:

The bill will provide criminal penalties for violations of its provisions (up to five years behind bars), but will not allow private parties to sue spammers.

correct me if I'm wrong.

useless law

[thoolihan]

This seems like another useless law around here. As others have pointed out, off-shore spam won't change a bit from this. Also, this won't affect the most annoying spam I get, the junk email from companies that I have an account with. No matter how many times I check my privacy preferences they send me email about how I can pay my bill online.

Technology could have solved this problem a better way. But leave it to the federal gov't to reign over another portion of our lives.
-t

"anti-spam law"

[burgburgburg]

Clear Skies
No Child Left Behind
Healthy Forests
Patriot Act

Doublethink doubleplusgood!

Re:Written by who?

[BillFarber]

I would point out that anybody can write a bill. The real trick is getting it sponsored and buying enough votes for Congress to pass it.

not that bad.

[Lumpy]

(2) uses a protected computer to relay or retransmit multiple commercial electronic mail messages, with the intent to deceive or mislead recipients, or any Internet access service, as to the origin of such messages,

(3) materially falsifies header information in multiple commercial electronic mail messages and intentionally initiates the transmission of such messages,

It prohibits Fake headers and abusing relays and proxies. Granted, this will only start the use of throw away email addresses that are used once for sending the 20 billion pieces of spam.

People are complaining that it's pro-spam... I see that it is a start in the right direction. 99% of the spam I get is from outside the US anyways so I expect that it will not do much to change the amount of spam out there and in that note, if mister spammer moves his spamming operation outside the country then this law has no teeth.

nice if you can enforce it.

[PreviouslySeen]

"It is hard to locate spammers, and it'd be very hard without subpoena power,".

And once you do find one (with or without the help of bounty hunters), what then? Im sure law enforcement will really care. Maybe the politicians will push for an example or two, but this will have no real impact.

Re:Opt-in for all email...

[Shimmer]

Opt-in is a lousy idea. Don't you want to be able to receive legitimate e-mail from people you haven't met yet?

Perhaps someone wants to write you a note about your web site. Or maybe someone read an article that you wrote and would like to discuss it. Or maybe an old friend from high school wants to send you an e-mail out of the blue.

If we shut off the possibility of such introductions, the Internet will become an even drier place than it is now.

Opt out?

[RT Alec]

The problem with "opt-out" is two-fold:

• First, we have all been trained (correctly) to NEVER opt-out, since it confirms our e-mail address is valid. How do we know if a particular spam is from someone who will obey the law?
• Second, it can often be difficult to opt-out anyway, purely from a technical standpoint. I receive e-mail addressed "To:" several addresses, including "info@", "webmaster@", etc. While I am savvy enough to reconfigure my e-mail client to send an e-mail that appears to be "From:" any of my addresses, it is a pain. Most people will not know how to do this, and many people (AOL, etc.) do not use an e-mail client that is capable of altering the sending address.

If the law mandated that opt-out must be implemented by use of a web link (e.g. "This message was addressed to [e-mail], click the link below and you will be removed immediately"), that would be a little better. None of this detracts from the overriding issue, and that is by requiring opt-out instead of opt-in (either double opt-in or a verification link) this law essentialy legalizes, indeed encourages, spam.

How laws get made

[Beautyon]

The RIAA writes the copyright laws.

The Direct Marketing Association writes the SPAM laws.

The Rapists write the sex laws.

The Breweries write the alocohol laws.

Way to go legislators, leading the people into a safer future!

Re:compression

[gantos]

Here's my version: The Direct Marketing Association drafted an anti-spam law to protect US from THEM.

We're screwed.

Offshoring the Spam

[handy_vandal]

Are there enough spammers in the United States to make it worth the bounty?

Not for long -- anti-spam bounties will drive the remaining US spammers offshore.

Maybe we should just keep the vile stuff here at home. I think Lyndon Baines Johnson put it well when he said "Better to have the skunk inside the tent pissing out, than outside pissing in." :)

But seriously -- no US bounty is going to affect non-US spammers. And if the bounty does actually hit US spammers where they live, expect international spammers to pick up the slack.

"Abandon hope, all ye who enter here."

-kgj

No, it isn't

[burgburgburg]

The weak Federal law was specifically advanced/signed to supercede and eliminate the tough state laws. The spam industry (and those who benefit from them) feared aggresive state level prosecutions (think what Eliot Spitzer could do to them). They got a "law" that says it is doing something, doesn't actually stop anything, and protects them from everyone who might try to stop them legally.

Re:Opt-in for all email...

[shakamojo]

"To just change the email system around isn't feasable."

If this were true than everyone would still be using CTSS Mail circa 1965. I'm not saying that we take on the "preposterous" job of implementing a worldwide change overnight, I'm merely suggesting that some thought be put into how we move forward.

If you think that SMTP will still be "de rigour" thirty years from now, you're in for a surprise, by then it will have gone the way of CTSS Mail, Autodin, Multics, the ARPANET, etc... things change!

Re:Isn't a weak federal law better?

[IANAAC]

Agreed, but don't you think that state laws (if they exist) should carry more weight over federal? That way you'd be covered (at least basically) on a federal level, yet states that want to crack down further can do so.

Re:Read my lips, no more spam.

[Cat_Byte]

I haven't read it today but I did read the whole thing a few days ago.
1) It doesn't use the word "bulk" but it does specify numbers. I believe it was around 250.
2) All laws making something a crime have limitations. Even littering. The limit was pretty high and enough to make Joe Blow in his basement think twice.
3) Those types of emails aren't the problem. I've never received any of them. They're also legitimate companies. They won't send 50 million emails/day with false headers trying to sell pron or pills.

Re:And now we can do some real work?

[Anonymous Coward]

Do you want the US business reputation to sink to that of Nigeria?

Uh...apparently you don't read /. much. With SCO, Microsoft, Halliburton and others the question should be, "Don't you wish the US business reputation could rise to the level of Nigeria?"

Re:Opt-in for all email...

[jonhuang]

To get around this "problem", most spam mailers actually DO send one mail per person.. they just do it a few million times.

One of the names is accurate

[Anonymous Coward]

Patriot "Act"

Screw the spammers... Charge/sue their clients.

[crovira]

Then the issue will quickly go away.

If the spammer's customer's have to pay the USPS or some guv'mint agency a dollar per email they send out, and maybe a day in jail per million spam emails, its cheaper and smarter to use smail mail. And most of them won't anyway.

The best way to get rid of spamers is to squeeze their customers.

Re:Opt-in for all email...

[Kojacked]

I don't see the issue with distinguishing spam from non-spam. It's all about quantity. Shimmer, in your examples it was a one-to-one corresepondence of email. Spam is about quantity not just context. If someone sent 30 million people the same or similar email then that is spam. It's the lack of clarity that people bring to these 'debates' that allow politicians to keep doing what they are doing rather than just use common sense.

Re:It... will... not... work...

[fermion]

I largely agree with you. But these do not work because they are wars. Using the mentality of war means that either you or the enemy must be vanquished. I know that in government and business this mentality is rampant, but neither is zero sum game. Not only that, but in the issues of drugs, poverty, terror, and spam, the enemies and allies are often the same people.

There are valid reasons to take drugs. Drugs are pushed on us all the time, on TV, at sporting events, even by the government. The arbitrary lines between good and bad just don't make sense. Poverty is caused by people don't have stuff. We can get stuff for more people. We just don't want to. The war is mostly PR. With terror, we know pretty much who is funding much of this. And it goes way beyond the gentleman was just captured. It is other parties that our multinational corporations depend on for lucrative contracts. Are we really going to give up that money just because a few thousand lives are lost every year? We can't even give up smoking!

So let's not treat spam as an enemy and declare a war. We can avoid developing arbitrary boundaries, creating PR campaigns to make the problem look more or less important, or destroying token parties so we don't have to deal with real lucrative players? It looks like we a clear and effective definition of spam. I like that this may give us a place to start. From there it is all diplomacy

Re:Opt-in for all email...

[amnesty]

Agreed.

It makes that email address on your resume pretty worthless quick...

Re:Opt-in for all email...

[RedHat Rocky]

Oh, I suppose the United States should have shelved the whole of idea of a free nation and just stayed an English Colony?

Please pull your head out of the sand. Thoughtful, coordinated change is good. There is certainly room in SMTP for improvement, all we need do is reach a consensus on what to do and then get it done. There are several proposals in the works, such as SPF, MS DNS records (or RMX), which all do the same thing: provide a way for a single domain to say "My mail is sent from such and such IP". An excellent idea, fairly easy to implement and solves the real problem: fraudulent mail headers.

Re:Opt-in for all email...

[pbox]

To just change the email system around isn't feasable.

1. New RFC
2. Mozilla Mail
3. Microsoft Outlook and OE
4. Rest follows...

If 3. can be achieved, the rest is trivial. 6-10 months all it would take. Email can be kept for the mean time...

This is far cry from infeasible...

+5 insightful? Re:Opt-in for all email...

[WolfWithoutAClause]

Opt-in or opt-out is irrelevant. Spam is not about that; it's a complete red-herring.

It's about people sending mail to millions of people, without the recipients being able to express a general preference at all.

I mean I get maybe 80-200 pieces of spam a day; but I bet you anything if I started to indicate my preference to not get it, by replying to it or clicking on the opt-out, I'd get even more spam. In practice that means I don't have any way of specifying it at all.

Don't you want to be able to receive legitimate e-mail from people you haven't met yet?

Define 'legitimate' and I will tell you. Actually, don't bother, I can tell that your definition would almost certainly suck.

Perhaps someone wants to write you a note about your web site. Or maybe someone read an article that you wrote and would like to discuss it. Or maybe an old friend from high school wants to send you an e-mail out of the blue.

Perhaps this 'someone' who wants to write a note about my website found it via automated search and wants to send me mail about this amazing new product they have 'discovered'? This 'old friend' suddenly wants to send me an e-mail out 'of the blue'. Uh huh. And how did they find me exactly? How do I know they are who they say the are? Looking online, reading my email, I'm clearly the most popular guy ever! And all of these high school friends of mine, girls wearing hardly any clothes all want to be my friend. Funny that, I went to a single sex school... and it wasn't a high school.

If there was one or more centralised repositories for recording preferences for email, and the spammers actually used it, it wouldn't matter if it was opt-in or opt-out at all. I wouldn't care. The point is that there is no such thing, even if there was the spammers wouldn't use it, and the current pretense that all spam has opt-out is just that, pure pretense.

It seems to me you just haven't got it, you haven't even understood the merest outline of the problem.

Re:Postal Address

[taustin]

Since those addresses will all be in China, Korea, or South America, it will hardly matter.

Like spammers who are already committing wire fraud with ever run are going to care about a new law that won't be enforced.

Quarantine Digests

[delcielo]

Like the anti-spam packages currently use.

Use opt-in, and if you get a message from somebody that isn't on the list, it gets quarantined. Once a day (or however often) you get a digest that lists all the quarantined messages, their senders, the subjects. Next to each list item is a link that allows you to release/view the quarantined mail.

Wrong way to go about it

[TheBigx00FF00]

It's funny, many of those authoring "cyber" legeslation, never seem to understand the scope or technology behind the problems they attempt to solve. For example, what stops me from setting up a machine in Ethiopia and sending my important msg about erectile dysfunction, and my new miracle cream to millions of US addresses? What stops me from plucking any number of wide open .hk hosts of the network and using them to send out my spam? This "Anti-Spam" law is merely an attempt to appease he voting public, and show that our government is "doing something about the problem". The best way to get rid of spam is to target the companies using it as a means of advertising. Online money transactions have the longest paper trail and validation setup of any other consumer service online. If they're capable of receiving payments online, they're capable of being tracked down.

Forward Spam Flood Proposal (FSFP)

[bpiltz]

What if every /.er forwarded every piece of spam to their Senators and Reps before deleting it? Just make a group in your address book...

You will quit sending when they opt out - how many 'opt out' e-mails would you suppose they need to generate to shut off the Forward Spam Flood?

Just a thought.

Re:Easy to filter...?

[zaren]

...it ought to be awfully easy to filter spam if it must contain some text (and a link?) about how to opt-out. As long as it's clear what is spam and what is not spam, then the probably is almost completely solved...

Sure, that would be the solution...

if spammers gave a rat's ass about the law in the first place.

Spammers are liars. Spammers are thieves. Spammers are already violating the laws in over 27 US states, as well as several other countries. What makes you think that they're suddenly going to change their ways and abide by a law that's designed to be all but unenforceable (citizens can't sue, only ISPs or state AGs)?

Case in point: last week, I created a mail alias for my university account, and used it for an "unsubscribe" link in a spam that I received. (Also known as "opting out", even though that alias wasn't opted IN to anything in the first place.) Today, that alias got it's first spam.

I'm actually surprised that it took so long. The site spamvertized is in .to, DNS and hosting is in .ch, and NO info kicks back from SamSpade about who registered the domain (if anyone can dig up info on beam.to, I'd appreciate it).

Do you really think that a spammer like this is going to suddenly identify himself just because the US passed an anti-spam law?

Why the spammers and not the spammers customers?

[Zed2K]

Why are they trying to go after the spammers and not the companies that have the products advertised by the spammers. Basically spam is just email advertisements. If a company uses that as a method then that company should be put out of business or fined heavily. As soon as the customers disappear then the spam will disappear.

Re:No, it isn't

[schon]

assuming that the law did work, who's to say that spammers can't skip the US

Nobody's saying they can't - people are saying they won't

Spammers are sociopaths, like any other sociopath, they do what they do because it's the path of least resistance. They are not spamming because they believe in their rights, they are spamming because they want money, and this is the easiest way to get it.

It's like saying, when the War On Drugs(tm) started, "what's to stop all the pot dealers from moving to Amsterdam"?

Unlike pot dealers, spammers (by definition) can't conceal their identities/location (they have to broadcast some way to contact them, otherwise they have no way to get your money.)
If spam truly became illegal, I think spammers would move to other, less publically visible ways to steal.

Re:Please opt-out - 10,000 times

[stinky_hippie]

I've always been leary about OPT-OUT options on shady spam emails. On more "legitimate" advertisement spams, like maybe concert updates from a venue I bought tickets from, there is always a tag-line at the bottom that gives instructions for how to be removed from the list. I trust this to a degree and believe that it will get my email taken off of the list.

When I get spam for "make your penis bigger and keep it up all weekend", I wouldn't trust any link they put in their email anyways. For one it could be a link to a site that might try to hijack my browser or do something else nasty (although that wouldn't happen because we all keep current on our patches and use less vulnerable browsers like Mozilla :) ). Another thing I've always thought of is that if I send a message to be removed from their list then all I'm doing is confirming that my email address is valid and currently in use. Sure I may get removed from that one list, but now my email address has been confirmed as active and can be put on a whole crop of new spam lists. I don't have any proof that this is what happens, but in my paranoid mind it makes alot of sense.

Re:Yeah, whatever.... Indeed!

[Neurotoxic666]

I believe the problem is not the spammer exploiting flaws, but rather people not protecting themselves.

As someone pointed in a previous post, spammers evolve just like any species would in any other ecosystem. So shall we.

Complaining will just result in useless laws that actualy affect our freedom of speech instead of doing what they're meant to. We should rather adapt and stop being "lusers". People have to get computer-litterate v2.0. Knowing how to turn you PC on and how to play solitair just isn't enough. We should learn more about secutiry and how to protect our (more and more popular) home and office networks.

Are you REALLY relying on the government to clean your inbox?

Re:Opt-in for all email...

[Theatetus]

Why not?

Well, for one because (legal) bulk emailing is a large part of what I do for a living. If someone is wrongly on one of our lists it's very easy for them to contact us and resolve the problem (happens about once a month, usually).

Besides the self interest, I'm not worried about someone with a verifiable online contact point (like a real email address) because that's a way we can get at that person if he or she breaks the law.

Yeah instead poor "[e-mail]" will. Another problem I have with TMDA. It allows a distributed DOS attack.

Yeah, that is the big problem with whitelist confirm messages. I was just pointing out that it wouldn't be hard to keep spammers with fake reply-to's from auto-confirming whitelist verifications.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:The new "spam is okay" law is very, very sad.

[jazman_777]

I can remember when the U.S. government was not as corrupt as it is today.

People don't live that long anymore.

zerg

[Lord Omlette]

No no no! You're only supposed to talk about states' rights when a Democrat is in office! Only traitors and terrorist-sympathizers would disagree.

What's Your Beef?

[Rick Richardson]

I really don't understand why so many individuals think this is a bad law.

I've looked the law over, and there are multiple requirements on each spam email message that will make it much easier and more reliable to filter it out as it arrives on your computer. Such as the requirement for a legitimate reply address in all spam and a physical address in a commercial spam.

If anybody should have a beef with this law, its the ISPs. They still have to carry the spam.

-Rick

Re:+5 insightful? Re:Opt-in for all email...

[devonbowen]

Define 'legitimate' and I will tell you. Actually, don't bother, I can tell that your definition would almost certainly suck.

I would define legitimate email as email from someone that has personal knowledge of you and wants to communicate something to you. In other words, you are not just a random address in a database. Could be a potential employer, an old friend, whatever, as long as they have a personal intent to contact you. Sure, this definition doesn't stop crackpots that are stalking movie stars, but it seems to cover most reasonable cases.

Devon

Re:+5 insightful? Re:Opt-in for all email...

[macshit]

It's obvious that spamsters will attempt to abuse any system that allows email from strangers.

However that doesn't invalidate his point, which is that in some cases mail from `strangers' is legitimate, and you would be pissed if you missed it.

Some recent examples:

• I got mail from my former stockbroker about , who thought email might be a better way to contact me than snail mail (she apparently got my email address from my Mom!) -- and she was right, it is more convenient.
  
• I recently received email out of the blue from some old college friends I haven't heard from in many, many, years.
  
• Since I work on free software, my email address is `out there', and I fairly frequently receive email from people that want to ask a question, which I'm happy to answer.

Obviously in all of these cases, there's some kind of previous association, but it's tenuous enough that any system requiring an opt-in from me is more than likely going to fail, and drop their email -- which would piss me off (and yes, it would piss me off more than spam, which I find mostly controllable via content filtering).

Do-Not-Spam Will-Not-Work

[Anonymous Coward]

Reading the linked text of the law (yeah, I know, I know...) it looks like a "Do-Not-Spam List" will be created before July 1, 2004, similar to the national Do-Not-Call List. So you should only have to opt-out once.

If the 'Do-Not-Spam' list is implemented, it will require the registration of each email address. Many of us with our own domains use multiple addresses to identify companies which deal with spammers and websites being harvested; look through the comments and see how many '[e-mail]' accounts you can find. A catch-all account allows me to invent a new address without any creating a new account on the mail server; the 'Do-Not-Spam' list would require me to register each new address with the .gov and then wait for that registration to take effect. Moreover, not all spammers intend to comply with the law, and most are outside its jurisdiction; for them, the list will be the best source to date for verified live addresses.

I read over most of this law, and there doesn't seem to be anything unreasonable in it. Certainly nothing the DMA would want, does anyone have any proof of the claim that they drafted it?

I don't know about that last claim, but the DMA did push for its adoption, and it is easy to see why. The law:

• legalizes spam;
• codifies an opt-out model, not opt-in;
• overrides more effective state measures;
• denies individuals legal recourse;
• targets spammers, not the companies paying them--a US company can simply contract a foreign spammer; and
• provides for the world's largest list of verified email addresses.

Re:Not all UCE is Spam

[alexhmit01]

Prior business relationship.

Find me an American that has never had a business relationship with AT&T?

Never called collect (with whatever 800 number is involved).

I'm more familiar with the travesty of California's law, but I recall that there are rules for bulk email, but more generic stuff for unsolicited commercial email.

Alex

Re:Opt-in for all email...

[Kojacked]

Let me clarify...

"If we establish opt-in for all e-mail we throw out the baby with the bathwater."

Now how is that? I am talking about business communication here, advertising, not personal communication.

Opt-in is not a white list. What you describe is more of the latter. We certainly don't need is any pre-emtive technology that deletes email because it's not on our personal white list. That just doesn't work and will break email.

What we need are enforcable laws and a system to support it. Opt-out just isn't a viable solution because it is so hard to prove. You opt-out of a list and the spammer sells your validated email address (plus anything else he/she gleaned in the op-out process) to another list or they use your information on another list they manage under another name.

Opt-in puts the burden of proof on the spammer and/or advertiser. Upon complaint by the individual they must prove they had a right to use that individual's email (ISP, software, hardware) for delivery of their advertisement.

Now if you start splitting hairs on how you descern an advertisement from a regular email I can only believe you are a spammer and wasting everyone's time by mudding this issue.

Re:compression

[kableh]

And glassware and other "drug paraphenalia" is a multibillion dollar industry. Your point?

And the thought of lost tax revenue certainly doesn't stop the government letting corporations dodge taxes...