From: CDT Info
To: [log in to unmask]
Sent: 30/09/2004 03:31
Subject: CDT Policy Post 10.15: Spam Continues to Plague Industry and Users
[Revised]
Please note that CDT reissues Policy Post Volume 10 Number 15 to
correct inaccuracies related to our description of the Sender Policy
Framework. CDT regrets the error and apologizes for any
inconvenience.
CDT POLICY POST Volume 10, Number 15, September 29, 2004
A Briefing On Public Policy Issues Affecting Civil Liberties Online
from
The Center For Democracy and Technology
(1) Spam Continues to Plague Industry and Users
(2) Enforcement Efforts Increase, But Face Challenges
(3) Technology Proposals Are Seen as Key
(4) Technical Solutions May Implicate Non-Profits and Political Speech
----------------------------------------
(1) Spam Continues to Plague Industry and Users
As of June 2004, approximately 60% of all email was spam. Measures
such as the federal CAN-SPAM Act, which took effect in January 2004,
have had limited impact. Certainly, nothing has yet turned the tide.
If anything, spam appears to have become more invasive: spammers
distribute viruses, spyware, and surreptitious spamware. "Phishing"
capitalizes on spam to perpetrate fraud against online consumers.
In July 2004, CDT convened a meeting of industry, consumer advocates,
human rights campaigners, and technologists to discuss the status of
anti-spam efforts. As the CAN-SPAM Act had gone into effect six
months earlier, mid-summer was an opportune time to evaluate the
extent to which Internet users were experiencing some relief from
spam, and to examine the responses of law enforcement, industry and
technology developers.
The concerns of ISPs focus on the costs spam imposes, costs that
end-user filtering does not address. Mainstream companies doing
business online worry about the efficacy of email as a communications
medium. Increasingly, they are concerned about whether legitimate
email -- for example, purchase confirmations -- will get through.
Some progress has been made in developing good practices for email
marketing, such as committing to solely permission-based marketing
lists. Strategies of email marketing may be moving away from
acquisition of email lists and toward retention of existing customers.
Consumers are frustrated with the lack of reduction in the incidence
of spam since the passage of the CAN-SPAM Act. Consumer advocates
point to the fact that users have no private right of action against
spammers under the Act. Businesses respond that an industry-sponsored
consumer education program could focus on consumers' online behaviors
that result in their receipt of spam.
Both consumer advocates and businesses note that providing the means
to identify and authenticate senders is key to resolving the spam
problem. However, issues of protection of legitimate anonymity remain
to be resolved.
A report summarizing the July discussion and highlighting areas of
agreement, disagreement, and ongoing concern is available at
http://www.cdt.org/speech/spam/20040715consultation.shtml.
For CDT's analysis of the CAN-SPAM Act at the time it was enacted,
see http://www.cdt.org/speech/spam/031211cdt.pdf
CDT's analysis of why consumers receive spam and what they can do to
curtail it is at http://www.cdt.org/speech/spam/030319spamreport.shtml
----------------------------------------
(2) Enforcement Efforts Increase, But Face Challenges
Pursuant to the enforcement provisions of the CAN-SPAM Act, several
states have brought cases against spammers under the law. At the
federal level, at least 62 cases have been brought by the Federal
Trade Commission. Most of the cases brought against spammers were
based on allegations of deceptive trade practices.
Identifying spammers is a key challenge to efforts to enforce spam
laws. Another is the lack of enforcement agents with the necessary
experience, training and skills. In many states, the attorney
general's office lacks the resources to train staff to adequately
enforce spam laws.
ISPs have also begun to bring enforcement actions, and the industry
says that the level of resources employed in fighting spam and the
skill of personnel working on the cases have increased.
----------------------------------------
(3) Technology Proposals Are Seen as Key
Given the limitations of enforcement, attention is turning to
technological solutions. Proposals focus on key characteristics of
email and email senders - reputation and identity; adherence to best
practices; and filtering by the end user.
The Sender Policy Framework (SPF) contemplates an infrastructure that
relies upon identity and evidence to assure that a sender is who he
says he is; prevention agents that detect denial of service attacks,
assess sender reputation and filter outbound messages; and protection
filters that prevent spam from reaching the end user's inbox. SPF is
a technical standard that works in conjunction with a program that
includes government-industry partnerships, strong spam laws,
interagency cooperation in enforcement efforts; industry standards
and policies; and educational programs to inform users about tools
and best practices for dealing with spam, as well as about how to
assure the deliverability of their own messages.
The TRUSTe-Bonded Sender program identifies and authenticates
legitimate email. The program identifies senders who are
pre-qualified through the Ironport service. Once certified, the
sender must post a bond for a specified amount, based on anticipated
email volume. The Bonded Sender program debits the bond amount based
on customer complaints. Once certified, Bonded Sender places the
sender on its whitelist. If there is a sudden rash of complaints or
other significant cause for concern about the sender's behavior, the
sender is temporarily suspended. Bonded Sender employs a
business-to-business dispute resolution process.
Habeas promotes sender best practices, provides feedback about
senders, and ensures deliverability of messages. The goal of the
Habeas solution is to help senders establish identification and
authentication practices. Habeas uses a complaint resolution process
that currently investigates every complaint received by the company.
For more information:
TRUSTe-Bonded Sender program: http://www.bondedsender.com/
SPF: http://spf.pobox.com/
Ironport: http://www.ironport.com/
Habeas: http://www.habeas.com/
----------------------------------------
(4) Technical Solutions May Implicate Non-Profits and Political Speech
Anti-spam technical solutions, especially those implemented at the
ISP level, raise issues non-governmental organizations. Several
issues warrant further consideration, including:
- The risk that legitimate messages sent by NGOs will be falsely
identified as spam and blocked, without notice to the sender.
- Retention of end users' control over their inboxes.
- The need to preserve anonymity for political speech in anti-spam
solutions.
- The need for political speakers to be able to respond quickly by
email, without getting permission from a bonding agent.
- Due process for all parties in resolving complaints and disputes
related to spam. Those complaining about spam should be held
accountable that their claims are legitimate, so that political
speech and unpopular speech are not blocked in a discriminatory way.
CDT expects to continue its examination of the spam issue with a
follow-up meeting focusing on these free expression issues.
----------------------------------------
Detailed information about online civil liberties issues may be found
at http://www.cdt.org/.
This document may be redistributed freely in full or linked to
http://www.cdt.org/publications/pp_10.15.shtml.
Excerpts may be re-posted with prior permission of [log in to unmask]
Policy Post 10.15 Copyright 2004 Center for Democracy and Technology
--
_______________________________________________
http://www.cdt.org/mailman/listinfo/policy-posts
--
This message has been scanned for viruses and dangerous
content by the NorMAN MailScanner Service and is believed
to be clean.
The NorMAN MailScanner Service is operated by Information,
Systems and Services, University of Newcastle upon Tyne.
************************************************************************************
Distributed through Cyber-Society-Live [CSL]: CSL is a moderated discussion
list made up of people who are interested in the interdisciplinary academic
study of Cyber Society in all its manifestations.To join the list please visit:
http://www.jiscmail.ac.uk/lists/cyber-society-live.html
*************************************************************************************
|
