H.R. 3113: Spam Bounty Hunters Wanted

belgin writes: "According to this ZDNet article, the U.S. House Commerce Committee is considering a law that places a bounty on illegal spammers. These bounties would be paid to ISPs and individuals who track down and turn in spammers. Specific types of spam mentioned by the article include fraudulent spam and spam that attempts to falsify its origin. Fun to think about if you've landed on one too many spam lists, but a little scary in 'leads to ...' department." The bill, called H.R. 3113, or the Unsolicited Electronic Mail Act of 2000, would impose Federal law in the form of what seem to be common-sense restrictions on electronic junk. But belgin is right -- what consequences might laws like this have that we don't want to trade for, even in spam? Would private solutions be better in the long term?[updated 18th May 2000 13:45GMT by timothy] Not to be confused with last year's H.R. 3113.

Comments

Re:Please send me my bounty....

[Chris Johnson]

Uh- is 'send them to prison' really a useful thing to ask an ISP? O_O Here's my version- as a MacOS clipping so it's just drag and drop, over and over and over and over and over and.... eight times today alone... Please kill this spammer's account. -postmaster@airwindows.com Note that I send the complaint as postmaster >:) I think possibly this might help in borderline cases. I'm not above saying 'we're getting slammed here'. airwindows.com is of course, just me...

Re:Pandering? Pandering?

[Chris Johnson]

What? lusers. It's not about _content_! Spam is not about content, it's about mechanism! I totally impartially go after the accounts of MLM and Ponzi scams, porn, and missing children reports. Do you realize how useless your emailbox would become if it was legally filled with the reports and descriptions of all the missing children in the world? O_O

Summary of the bill

[joeboo]

SUMMARY AS OF:
10/20/1999--Introduced.
Unsolicited Electronic Mail Act of 1999 - Authorizes any person, on his or
her own behalf or on behalf of his or her children, to file with the Federal
Communications Commission (FCC) a statement that he or she desires to
receive no unsolicited commercial electronic mail (e-mail), unsolicited
pandering (erotically arousing or sexually provocative) e-mail, or both.
Directs the FCC to: (1) maintain and keep a current list of such filers; and
(2) make such list available to any person, upon reasonable terms and
conditions, including a service charge for such list. Prohibits any person
from initiating the transmission of any unsolicited commercial or pandering
e-mail to an individual whose name and e-mail address has been on such list
for more than 30 days. Prohibits any other use of such list.

Prohibits any person from sending an unsolicited commercial or pandering
e-mail message unless the message contains a conspicuous reply e-mail
address to which a recipient may send notice of a desire not to receive
further messages. Subjects to an FCC order to discontinue any person who
transmits such a message after such an objection. Directs the FCC, upon
request, to include in such an order the names and e-mail addresses of any
children of an objecting recipient.

Provides a private right of action, or an action by the FCC, against an
e-mail initiator who violates the above requirements.

Authorizes an interactive computer service provider to establish and enforce
policies that are nondiscriminatory on the basis of content regarding
unsolicited commercial e-mail. Authorizes such provider to decline to
transmit such messages to subscribers without compensation from the sender.
Requires a provider to notify the violator of such policy in writing and
request compliance. Makes subject to the same FCC order as above a violator
who sends such messages after provider notification. Provides a private
right of action by a provider, or an action by the FCC, upon an e-mail
initiator who violates such requirements.

Requires the FCC to report to Congress on the effectiveness and enforcement
of this Act.

Re:nice.

[fatboy]

It boils down to using a traditional and effective compensation method (bounty) on an act that infringes on others' rights. What great freedom of yours is being lost?

Anyone that knows RFC822 knows that any compliant MTA shows where it gets mail from. You have an audit trail of where that mail came from in each and every message. If that is not enough information, you can call the admin of each MTA the offending message went through. There is no need for any kind of government regulation.

If you don't want spam, get an ISP that uses the RBL.

If the government starts dictating what can be in email headers, the technical reasons information is placed in those headers can be restricted.

I would rather deal with some spam and follow RFCs than have a little spam and have goverment regulated RFCs

Re:nice.

[fatboy]

seriously, though, this is definately needed. i think we are all victims of spam, and it's time somehthing is done about it. filter all you want, you can't catch everything. or can you? it would be interesting to know what filters people use and how succesfull they are.

I have not read the bill or anything, but I think that it sounds like a Bad Idea. We can take care of these problems ourselves. There is no need to have the US government police our networks in this manner.

I will accept a little spam if I can keep all of my liberty.

Well, what little liberty I have left ;)

Private Is Always Better...but...

[waldoj]

I'm pretty gung-ho about private solutions to technical problems. I'm far more confident in my abilities, and those of my technical compatriots, than I am in the ability of our government to enforce a law appropriately.

So I'm generally a firm believer in my ability to take care of things on my own. ORBS and The RBL have certainly been shown to be an extremely successful method of filtering out spam. Since I got my mail server set up with MAPS and ORBS, I get about 2 pieces of spam a week. That's pretty managable. (And good, because I'm the kind of guy that gets spam and calls the company to bitch. Total waste of time.)

However, I don't run an ISP. I worked at one, as all good geeks must, back in '95. Spam wasn't a problem then -- I shutter to think what it must be like these days. Spam is obviously a huge loss to these people, MAPS or no MAPS. Because of the direct financial losses that result from the actions of spammers, I can't help but, although reluctantly, support federal legislation to limit UCE. It seems like the only method of stopping it.

God help us all...I'm in favor of a law. :)

-Waldo

Spam Runner

[ch-chuck]

Now that would be a cool movie I'd pay to see!

"In the future, when all the worlds electronics are networkd, a 'leet group of govt agents, outfitter with the latest in tracking gear, neat-o flying cars and spiffy firearms quietly hunt down unsolicited bulk email perps and 'terminate' them, usually with lots of fighting and evasive action scenes ending up with an aweful bloody death for the spammer."

Isn't it just?

[Kris_J]

There're not enough bounty hunter jobs in the world - I'm definately following through on this one. I wonder if one could make a decent living on legitimate bounty hunting and rewards these days?

Sorry to all pro-freedom/privacy zealots, but I'm willing to try this one before I condem it - I don't see anything being given up with this. You only point the law at the aledged spammers, you aren't judge, jury an executioner.

The actual current text of HR3113

[tgeller]

Before you go all postal with visions of 1984 in your head, read the actual text. It's still being modified, but the current version will always be found at http://www.suespammers.org/us. There's *nothing* in there about bounties.

For the record, I don't see how a government-sponsored bounty program could work for spam. The problems aren't in finding good examples of spam -- we all get those every day! The barriers are:

1. Having good laws (that define spam accurately and give right of action to both the individual and the ISP)
2. Getting a name and address to which you can serve papers
3. Collecting after judgement.

All three of these problems are made much easier to overcome with a strong government mandate. But bounties? I don't see it.

--Tom Geller, Founder and Administrator, The Suespammers Project (http://www.suespammers.org)

Government Bounty for Spammers -- A Question...

[Guppy]

So, to get the bounty--do we need to turn in just the ears, or does the government want to see the whole carcass? It'd be mighty nice if I could keep the pelts to sell on the market.

A client side idea

[finkployd]

I'd like to see more Linux email clients (you hear me, spruce guys) include some feature to drop all mail NOT directly addressed to me. If it allows me to set up exceptions to let in the couple of mailing lists I'm part of, then this would effectivly fix the problem.

Maybe there is a way to do this with filters, and I'm just too lazy to figure it out.

PS. I KNOW there is a way to do this with procmail, I just don't use it (neither do alot of people who just have a pop account or two)

Finkployd

California Republican Party spams Canadians

[KeithH]

Interesting that the US Congress would be discussing the issue. Here's a copy of some spam that was received by myself and a whole whack of my colleagues just today:

------- begin extract -------
Wed, 17 May 2000 09:34:49 -0400
Received: from sdeveaux (race203.ienet.com [206.253.15.203])
by qcars001.nortelnetworks.com with SMTP (MailShield v1.5);
Wed, 17 May 2000 09:34:39 -0400
Return-Path:
From: California Republican Party
To: "Hanlan, Keith "
Subject: Greetings from the California Republican Party
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Date: Wed, 17 May 2000 07:34:36
X-SMTP-HELO: sdeveaux
X-SMTP-MAIL-FROM: rapid@cagop.org
X-SMTP-RCPT-TO: keithh@bnr.ca
X-SMTP-PEER-INFO: race203.ienet.com [206.253.15.203]
Greetings from the California Republican Party:

The California Republican Party would like to invite you to become online activists with our State Party. This is a free activity, as we would like your support to help our federal, state, and local candidates and other Republican activities.

Please join today by clicking www.cagop.org/rapid now.

++++++++++++++++++++++++++++++++++++++++

We apologize if you have received this email in error. If you do not wish to receive this email in the future, just delete this email. Thank you.
-------- end extract --------

Apart from not having a clue, they seem to have confused .ca and .ca.us domains - talk about compounding stupidity!

Re:I can see it now...

[seebs]

That "handful" of people is ever-growing, and I will say, *damn* few telemarketers call me back after I say "TCPA" and tell them to put me on a do-not-call list.

Do I sue? No, I'm too busy. But I'm on a mailing list *full* of people who sue, and win. One of them has a respectable income going here; I know people who work full time and don't get as much money as he does, just suing junk faxers.

http://www.junkfaxes.org/

Read it, learn the magic words, sue the bastards.

Re:Jurisdiction

[arcade]

I rember reading a few weeks back that either Norway or Sweden has just passed a law that makes spamming legal.

Not norway! It was sweden! :) Don't blame US for those stupid swedes. ;)

Oh, and the swedish parliament is really having a tough time nowadays. People are subscribing them to all sorts of mailinglist, sending 'unsubscribe' messages to different spam-lists for them, and doing them all sorts of favors. :) Not to mention all the mailbombs sent their way.

In short, I think the swedish parliament will remove that "its ok to spam" paragraph pretty damn soon. :)

(oh, and if you want to help bomb them from here, to h*** and back, look up the swedish parliament, find some email addresses and .. well, you know what to do :)


--
"Rune Kristian Viken" - arcade@kvine-nospam.sdal.com - arcade@efnet

Re:what consequences?

[kramer]

Nevertheless, any program where people are rewarded for turning in other people for alleged misdeeds has a KGB aura to it, no doubt. But why should we be so suspicious if the misdeed is, in fact, A Bad Thing?

Perhaps you're unaware of this, but the IRS has a number you can call to turn in people who cheat on their taxes. I know they used to, (but am not sure if they continue to) pay a portion of monies recovered to the person who turned the cheat it.

Mind you, YOUR records better be pristine if you turn someone in, 'cause they're gonna audit you as well operating on the theory that if you hang out with Tax Cheats you might well be one as well.

But a Bounty is hardly a new concept for the US government.

Nothing illegal here

[Webmonger]

There's very little spam out there that doesn't involve someone trying to make money. If they're going to make money, they need some route for receiving money. That route is traceable.

Most people don't want to take the time, though.

Bounty on Spammers?

[skribe]

How do you want them? Dead or Alive?

What about innocent "spammers"?

[vladkrupin]

And what would happen to those innocent souls that do not even know that spam is being sent from their addresses? I mean, how can you distinguish right from wrong and innocent people from guilty, if there is virtually no way to prove that the spam is coming from a particular source, unless you actually seize a computer and manage to dig something useful out of it?
(I certainly hope placing bounties will not give more rights to certain agencies to dig through peoples mailboxes in search of evidence).
-----------------------------------------
------- ------------------------------------------

Re:What about innocent "spammers"?

[Zipo Bibrok 5e8]

Methinks you need a bit of spam-education.

In tracing spam, the "from" and "reply-to" addresses are essentially ignored. Thus, that risk is bypassed.

When people have their accounts cracked, their ISP admins will go poking through their logs anyway, so that bit of privacy invasion was already present.

As someone who's helped newbies survive an ISPjacking, I can tell you that many help desks will let them off with a warning once. Once. If anything, the experience teaches them proper security practices. Nobody I know has ever been penalized too heavily for stupidity.

--

Re:Consider the CAUCE response.

[AME]

Did you read it? That paragraph was talking about other legislation. Later:

CAUCE vigorously supports HR 3113...

I only said that CAUCE likes it. I said nothing of the decenting opinions of other parties.

--

Re:Dammit

[spencerogden]

This is totally different than the WAVE situation you mention. In that case kids were being encouraged to turn in others who exibited weird behavior, not who committed actual crimes. In this case, if we do get a law against spamming, then these people would be encouraged others who are breaking the law. Totally different.

Re:nice.

[Bouncings]

• We can take care of these problems ourselves. There is no need to have the US government police our networks in this manner.

It's easy to get carried away in this kind of regulation indeed, but consider things for a moment. What about only banning forged email? Don't I atleast have the right to contact who is spamming me? Outlawing the worst-case SPAM cases isn't going to cost you very much liberty.

The idea behind freedom and liberty is doing what you want, so long as it doesn't hurt others. Email SPAM, like the now illegal FAX SPAM, does cost the collectors money. It's only fair that those damages be collected on, and it might be a good idea to encourage the process by offering a reward.

It boils down to using a traditional and effective compensation method (bounty) on an act that infringes on others' rights. What great freedom of yours is being lost?

Boba Fett!

[TrevorB]

Rats, there goes my Star Wars idea and my karma bonus.. :)

I was thinking rather of posters with Boba Fett on them, pointing his arm rocket pack toward the viewer...

"Now you too can be a bounty hunter"...

Oh well, At least I have something:
Darth Vader is now Canadian... :)

SpamCop - Easily report your spam!

[citizenc]

SpamCop does a wonderful job of helping eliminate spam -- you just paste the headers and full body of any spam you recieve, and it chews through it, and reports the spam to the account's admin! It's VERY VERY cool! And free too.. check it out guys =)


.- CitizenC (User Info)

a great new job...

[juzam]

i could get bizness cards that say spam bounty hunter.... this would be a nice way to make extra $, but i think some people would abuse it.

Re:Nice HR!

[joe52]

why couldn't it have been HR 31337?

seriously. How many other people saw 3113 and tried to read it. It took me a few seconds to realize that it was just a number and not some cryptic reference to a fashion magazine.

Re:what consequences?

[G27 Radio]

Nevertheless, any program where people are rewarded for turning in other people for alleged misdeeds has a KGB aura to it, no doubt. But why should we be so suspicious if the misdeed is, in fact, A Bad Thing?

I'd rather not have our government(s) regulating our e-mail. It'll just feed into their whole "we need more resources to fight cyber-crime" thing. I personally would really like to avoid handing any more of the Internet over to them if possible.

I have serious doubts about the benefits too. No legal solution will ever stop spam as well as a technological solution. At best it will reduce spam but it will never stop it. A technological solution on the other hand could stop automated spamming very easily. Unfortunately users and ISP's would have to make changes on the client and server side to allow for protection from automated spamming--and as far as I can tell no one is really interested in doing the work.

Users should be able to maintain a whitelist/blacklist for e-mail at their ISP. Blacklisted stuff should go to /dev/null, whitelisted stuff should pass through unhindered. Everything else should be returned with instructions on how to get to through the filter--nothing complex, maybe including a keyword or something like that. Just something the an automated mailer can't get around. It would be important that the white/blacklists could be easily maintained from the client.

numb

PS: Never invite a vampire into your home.

Re:Another opportunity to fink

[Super_Frosty]

This guy has a good point.

Governments that have become police states criminalize simple, innocuous actions. This means that virtually everyone is a criminal, and if they don't like you, theyll be able to arrest you and convict you of scads of crimes that you unwittingly comitted.

Your tax dollars are going towards...

[BMIComp]

A bunch of Shimomuras looking for spammers. Now that's what you call worthwhile.

Re:nice.

[TheCarp]

You obviously don't run systems with more than
a couple of thousand users.

Sure its only a 2k email....however when you
multiply it by 10,000 users, that "one little
mail" will take up 10 MB of space...not much by
todays standards....but given that it is not
unheard of for an individual on spam lists to
get several spams per day....it adds up quick.

Plus the greif of admins. When a student where
I work sent out 5,000 spam messages, advertising
a company he was running on the side, the
university abuse adress (which I am one of the
recipients of mail to) was recieveing several
spam complaints per day for 4 days...which of
course we had to answer and tell these people that
the issue was resolved.

Forget about user quotas (which are finite, as is
the very nature of quota) and what happens when a
user runs out of quota...I am sure they would
rather the last 2k of their quota going to a
message from their friends than some spam
advertising some "get rich quick" shceme.

(yes, our users have quota. I know that some
people are amazed by this - like say the people
who wrote pine - but its true)

Re:Really simple

[TheCarp]

I have to agree here. We have too many good
examples of this sort of thing NOT working.

Take paid informants. There was an incident in
Florida where a paid informant informed police
that a certain house was a drug house. The truth
turned out to be that it was nothing more than the
residence of an old couple. That fact wasn't found
out until police showed up in full storm trooper
gear and killed an innocent old man. Need I
mention that no "drugs" were found in the house?

I think this is an issue that is best dealt with
on the ISP level. Give ISPs the ability to sue
spammers who use their machines to relay spam.
That should help..

Beyond that....Laws can't really stop the problem.
Spammers will just spam from acounts in other
countries where the laws are les strict.

-Steve

Consider the response rates...

[sansbury]

You assert that direct(junk) mail and telemarketing are not viable, and yet they exist. Paradox? Non!

The key is response rates- telemarketing is expensive indeed, but successful sells are comparatively common. Direct mail less so, but it is much less expensive (they use bulk rate and metered pre-sorted rate postage so it's actually less than 32 cents/item).

Spam OTOH might have insanely low response rates but it quite cheap, so it still works. This is why marketers get so juiced up over the idea of targeted opt-in mailing lists. These have lower costs than direct mail, but potentially with the response rates of phone jockeys.

And yes, it's terribly trivial. Wait until they start broadcasting custom digital TV and the ads you see on Friends are targeted just for your household. We've only seen the first 1% of the bleeding edge of truly personalized marketing. In 20 years' time we'll look back and long for the days of simple spam.

-cwk.

Re:Nice HR!

[dingbat_hp]

4 minutes to post it. Clearly the Force is strong today

Two Words: BOBA FETT

[zpengo]

Vote Boba Fett for Spam Bounty Hunter General!

Tomorrow's headline:

[DrEldarion]

H.R. 31137: Script kiddie bounty hunters wanted.

-- Dr. Eldarion --
It's not what it is, it's something else.

/. spammers

[348]

I wonder if we could gain some dollars by turning in some /. spammers. Lord knows we have our share.

ASCI art $ 100
Trollmastah $1,000
Hot Grits $10,000
First Post $100,000

We could all be rich.

Re:what consequences?

[HomeySmurf]

The law does lump people who break the law into the overarching category of "lawbreakers"; however, it certainly divides that up into felonies and misdemeanors, and further divides up the felonies into different classes. There is also tort law and the whole idea of liabilities. I think that civil justice can be much more painful to spammers than whatever criminal penalties would be assessed (they would be very light since the crime not inherently harmful). If automatic class action suits could be filed so that every person who receives a piece of spam from a spammer is owed $.05, I think the world would be a much better place. Not to mention that anyone with accounts on AOL, Hotmail, or Yahoo mail would have an wonderful new revenue stream.

I don't think there is anything wrong with having bounties for people who catch criminals, at any level of crime. It has been shown time and time again that what prevents crime is strict enforcement rather than harsh penalties. No criminal does his crime if he thinks he is going to be caught. If we have a problem with it being a crime we should decrimininalize it rather than being hypocritical and not seriously enforcing it.

Encouraging every citizen to be on the look out for crimes in progress merely amplifies everyone's civil duty and reduces the price of hiring more law officers. The only problems to be avoided are people potentially being "framed" and so forth, but that is already a problem today. That is what insurance fraud investigation is about.

renegade spam hunters

[kb9vcr]

Lorenzo Lamas and Brandscombe Richmond star in their most demanding Renegade rolls ever as Reno '31337' Black and Bobby 'w00t' Sixkiller in a smart new action thriller on UPN!!

Re:Congress ahead of its time?

[Frank T. Lofaro Jr.]

Sarcastic rant time: Of course Congress believes in free speech. Here in the good old USA you can say ANYTHING you want. Unless of course it is offensive, costs somebody money, embarrasses someone or is politically incorrect. But everything else is completely legal.

ponder ponder ponder

[gunner800]

I have some serious reservation about this. Paying citizens to tattle on each other is serious business. In fact, it's been an early step in many totalitation regimes such as Hitler's (for turning in "disloyal" citizens, not sleazy marketing types though).

How would we react if citizens were rewarded for reporting other crimes? There's a $100 fine for littering, would it bother anybody if I got half if I turned litterers in?

(For once) I think that the lawmakers are genuinely trying to do a Good Thing, but the indirect consequences could be bad.


---
Dammit, my mom is not a Karma whore!

illegal spammers

[myshka]

Illegal spammers? Would that include the NASDAQ-trading, inernet economy-sustaining, politically donating companies that opt you in no matter what you say and opt you out only when somebody sells them a list of recently deceased people whose families might be interested in discounts on funeral arrangements? Nah, that's as legal as it gets, isn't it. After all, millions mean respectability and with spam as with everything else in this world, whoever's got the money got the (il)legal ride.

At least with small-time spammers, you can have their ISP shut the account down. Now try doing the same when the spammer is an A-list client on Exodus.

Re:Congress ahead of its time?

[gilroy]

Quoth the poster:

(1) There is a right of free speech on the Internet.

I'm so happy Congress found it, I thought it was lost before.

Hmmm. DMCA. UCITA. PTO... I think there's evidence that the First Amendment had gone missing for awhile. I know it's irksome that Congress feels the need to assert the existence of a right guaranteed in the Constitution, but... but, it's nice to have this formal and in print.

This isn't bounty hunting

[MrShiny]

Receiving a reward for turning in a criminal is not bounty hunting. Unlike these guys, you are not taking the law into your own hands if you use the legal system to pursue a spammer. All they are proposing is that you receive a reward for doing so.

This is completely different from the WAVE program where kids report their peers just for being weird, and not for commiting any crime.

Re:Jurisdiction

[_ganja_]

"What about spammers outside US jurisdiction?"

I rember reading a few weeks back that either Norway or Sweden has just passed a law that makes spamming legal.

Does anyone have any more details?

better ways

[cabbey]

belgin and timothy are not alone in the fear of where this might lead, that's for sure... I hate spammers with a passion, but I'm not sure if I really want to start down the road this could take.

Anyway, I much perfer Julian's philosophy over at spamcop.net: "Protecting the internet community through technology, not legislation." If you're sick of spam and want a way to slap those responsible, then join up (or don't, there is a free service as well) and parse all your spamage. But please read the intro and the FAQ, we need to preserve the image that spamcop has in the minds of the abuse desks; it's only a tool being put in your hands, YOU are responsible for what you use it for.

and besides, an address like cabbey@spamcop.net, is bound to make a would be spammer queasy.... (note: happy spamcop user, not an admin.)

Re:Actually not many people are so vitrolic

[Stiletto]

Not really.

I find that most non-techies are quite annoyed with spam, but they sweep it under the rug since they don't know what else to do. I took about 10 minutes to show my friend how to look at the headers, find what is most likely the mail's original domain, and email abuse@, he now has something he can do about it.

Trust me, it feels good to get that message back from their ISP, informing you that they canceled the spammer's account.

If you think u$oft is bad...

[Longing]

All spam has some sort of contact information in it, right? Either a phone number to call, or an address to send money to, or a (p0rn) url to go to. Easy way to track down the perp and sue them for lots of money!

Let's pretend I'm p0rn site www.slashporn.net and www.slashporn.com is getting more business than me... I'll just put them out of business - send a few hundred thousand emails stating "Visit slashporn.com! p0rn for nerds!"

Soon enough, slashporn.com gets sued for hundreds of thousands of dollars and is out of business. My business goes up and life is peachy.

Wonderful.

Of course, this ties in to DDoS - how do you track down the spammers if they're spoofing their return address? The current state of the internet makes this difficult if not impossible (if done well). Yes, I know there are differences between spoofed IP packets and spoofed SMTP headers, but there are similarities as well.

Dammit

[Dr. Sp0ng]

This is a tough call - on one hand, I'd love to see spammers get bitchslapped, but on the other hand I hate to see the government (or anybody else) do stuff like this. Remember the big uproar that was caused by that group in North Carolina (I think, I could be completely wrong) that was paying kids to turn in potentially dangerous kids? Same basic idea goes here - it's just not the right way to handle things.

I know that this is a completely different situation, but the same basic idea applies.

Ahh... fuck it, dude. Let's go bowling.
--

Re:Dammit

[gilroy]

Quoth the poster:

Same basic idea goes here - it's just not the right way to handle things.

I disagree ... this is not the same basic idea. In the WAVE thing, kids were paid to inform. Here, Congress is defining the right of a private citizen to recover damages incurred by a violator of civil law. Read carefully ... it is not all spam, only those that falsify origins or defraud the recipient.

The issue is, spam costs time and money. Unlike even junk mail, the sender suffers effectively no cost, but the recipient does. It's annoying enough when this is "legitimate" but it's maddening when the message is fraudulent.

Despite the wonderful Wild West connotations of "bounty", this isn't a bounty ... it's not a reward, it's a right to recover damages.

This will never work

[BlueLines]

I worked at a medium sized isp for a little over a year. While I was there, i was one of the main spam contacts (ie, i got the mail that went to "abuse@" ). In general, it was easy to nail spammers. Trace the headers, send a complaint to the isp/admin on the other side. If a spammer came from uunet or psi, then it was usually a guaranteed kill. However, spammers are getting smarter, and recently i've been noticing more and more spam being relayed through boxes not in the US. This poses several problems, the main being that the rest of the world is under no obligation to follow the laws of the US. Also, there is the language barrier. Alot of uce seems to originate from asia, and i'm not sure that firing off an email in ascii characters would make much of a difference to someone who reads kanji .

Then there's the most annoying problem i faced, which is admins that either don't know how to prevent relaying, or don't care that they are being used as a relay. I recently was notified by a friend of mine that he got spammed through a mail server owned by a major canadian isp. Not only was the server an open relay, but it's sendmail configuration was so fucked that it didn't even log the originating ip address in the mail headers (IOW, it trusted whatever HELO said). TO make matters worse, the admin of the box was contacted about this, and has done nothing. I think the only way to prevent spam is to educate admins about relay-proofing their mail servers.No open relays, no spammers. Then the US could put a decent amount of money into public education instead of making bounties to catch these bastards.

Just my $2^-2 worth.

Joy, this legalizes spam

[weave]

If you read the bill, there are troubling points in it including:

• RETURN ADDRESSES REQUIRED (No forging)
• TRANSMISSIONS AFTER OBJECTION (Must remove from list if asked)

There's a business opportunity here. Open a spamhausen ISP, make it OK in your TOS to spam, just require your clients to use a valid return address and honor a remove list.

Most spam I get always says "No need to be removed, this is a one-time mailing, your name is already deleted." So joy, each time I want to send out a new SPAM I just create a new account with that ISP, spam away.

An Opt-Out law is worse than no law at all

Opt-in (or "permission-based marketing") is the way to do it. Opt-out will always just be spam and this bill makes that legal.

I can see my spam now. "This message can not be considered SPAM under HR 3113 as long as we provide a valid return address and a way for you to be removed from our lists.

Consider the CAUCE response.

[AME]

A quick look at the cauce response indicates that they are all for it and why.

In general, I support cauce and their put-the-power-in-the-hands-of-the-people-not-the-g overnment philosophy. So if cauce likes it then it's probably a pretty good idea. If you hate UCE then consider joining cauce. They do lobby legislature and the quantity of their members adds to their political ability.

--

Jurisdiction

[Bouncings]

There are some conflicts of interest and problems with this otherwise good idea:

• What about spammers outside US jurisdiction? They often can't be collected from, so who pays the spam-hunter bounty? The US tax payer? I'm paying for SPAM enough as it is in my ISP bill.
• If spammers can't be collected from, a bounty hunter could hire them to spam and give them evidence of it, and split the bounty, again picked up on by the tax payers.

Personally, seeing spammers being hosed is reason enough for me to fight them. :-)

Be careful, Timothy

[Jim Tyre]

With the Microsoft "precedent" in hand, you should be more careful in choosing your titles.

Hormel, which holds the trademark on spam, might sue you for infringement. ;-)

Pandering? Pandering?

[Jim Tyre]

The Bill provides:

(8) UNSOLICITED PANDERING ELECTRONIC MAIL MESSAGE- The term `unsolicited pandering electronic mail message' means any electronic mail message which the recipient, in his or her sole discretion, believes to be erotically arousing or sexually provocative that is sent to a recipient with whom the initiator does not have an existing consensual relationship or has been sent by the initiator without the express consent of the recipient.

So what if, unsolicited, I send a scholarly dissertation on the evolution of the sea slug to Roblimo, but unbeknownst to me, it gets him all hot? (You just never know with Roblimo.)

Am I screwed?

How do you "win" the bounty?

[zaius]

What exactly do you have to do to get the bounty money? Do you have to find the person's real IP address, or their name, or phone number, or physical address or what? It seems to me that in order to find any physical contact info, you would either have to be extremely lucky, or you would have to do something illegal to get it...

Also, I also think that it might be remarkably easy to frame somebody, and then collect the bounty for finding them. Unless some law enforcement agency checks your findings, thuroughly.

-- zaius --

No More Spammer Excuses

[Accipiter]

See, the typical spammer response to general complaints is "But 94% of internet users WANT to receive junk E-Mail!" Now, this excuse won't work anymore.

User@domain.com receives spam.

User complains to ISP about spam.

User takes approproiate action against spammer.

Spammer cries "But people WANT spam!"

BZZZZT! That's where the excuse dies. If users want spam, there wouldn't be such an outrage against it. Now when this little law goes into effect, and people see the percentages of internet users complaining about spam, Spammers will have to come up with another excuse.

Then in turn, tougher rules will be enacted. This seems like a Good Thing to me. Here's hoping Internet Spam goes the way of Fax Spam.

-- Give him Head? Be a Beacon?

Re:I can see it now...

[orpheus]

>>> rush to see how many SPAM lists you can get Therein lies one danger of this plan.

Other have addressed some of the reasons why this is hardly the panacea it seems at first glance. I just want to note that whenever a law is passed to control an 'out of control' practice, the public's resistance to that practice diminishes.

Even the most inept telephone telemarketer has a few stories of conversions: people who start off following the "Put me on your No-Call list" script of DMA-supported so-called 'consumer' groups, but end up as buyers. The secret is that the longer you talk, the more likely you are to buy. Most people who follow a No-Call script would have hung up point-blank before. The 'don't call' script offers a tiny foot in the door of otherwise definite no-gos. The Telemarketers have scripts of their own to capitalize on this.

Why do you think Publisher's Clearinghouse makes you fiddle with so many stickers to complete one of their sweepstakes stickers? So the visions of payoff, and other irrational notions can dance in your head. Even after you hang up after your Don't-Call spiel, don't you secretly wish they call back, so you can nail them in small claims. Only a tiny handful of people have ever successfully sued (not enough to pay for a single DMA trade seminar luncheon) while telemarketers do many successful conversions every hour, in every state.

And now we dangle the 'bounty' of a potential windfall, albeit a modest one, in front of every newbie, casual user, and kid?

Less spam will get filtered and discarded unread and more spam will be scrutinized for 'illegal' elements that qualify it for the bounty. People will be less cautious about prtecting their e-mail, because it's a potential pay-off as well as an annoyance, and because watching your privacy is hard work, and humans will seek any rationalization to avoid such a tedious and thankless task. "Spam is illegal" is just such an excuse

Publishers Clearing House would love this! PCH spends several times as much on its interactive sticker-laden mailings than it does on the grand prize - and made decades of tidy profit on this marketing model. They are proof of concept.

Salesmen - especially shady ones - are cynical masters of psychology, unlike engineers.

I'll close with a general warning tht you should keep in mind for the next year of so:We are at a critical time when private data is still largely unregulated in the US, and is not as tightly regulated as it will be, even in Europe. They can gather and share information now that they may never be allowed to gather again.
_____________

Spam bounty hunting - Sweet!

[Chairboy]

I could see it now, cruising around newsgroups and SMTP servers looking for spam with my Boba Fett outfit on. People could contact bounty hunters and offer added incentives for giving the personal data of the spammer to them first before passing it along to the government.

Spammed person: (getting ready to freeze the offending account and dispose of the spammer)

Me: He's no good to me dead.

Spammed person: (pausing) Don't worry, you will be properly compensated.

Spammer: (screaming as the torture began) Aaaaaaaarrrggh! They didn't opt out, they didn't opt-AAAAAAAAAAAAHH! NO! Not my e-mail finger-GNNNAARGH!

I like it.

Congress ahead of its time?

[Jim Tyre]

The actual Bill provides, among other things:

(a) FINDINGS- The Congress finds that:

(1) There is a right of free speech on the Internet.

I'm so happy Congress found it, I thought it was lost before.

Nice HR!

[Rei]

Aww, why couldn't it have been HR 31337? That would have been so much more fitting ;)

- Rei

Spam vs. Junk Mail

[khog]

Spam and junk mail, at the first look, seem very similar. In fact, they are quite different. Those of you geeks who bother to leave the house (myself included) know that you need a stamp to send snail-mail. Stamps, as you know, are not cheap. What is it now, 34 cents? I can't keep track. (I just don't leave the house enough, that's my problem.) To send an e-mail? With an unlimited internet access plan, nothing, really. On bandwidth rated connections it could end up costing you a pretty penny if you were really high volume. Notwithstanding, spam is, on the whole, free to send; junk mail isn't.

This presents quite a conundrum. In the "real" world, junk mail isn't free to send, so there's less of it. Telemarketing isn't viable, either, because you need to pay people. Spam, on the other hand, can be efficiently run on an old computer with a 56K, or 33.6K (if you're patient) modem. What is there to do?

Well, nothing good. Government regulation (as in USA government) of anything on the internet is just wrong -- the internet belongs to no one, at this point. If the government wanted to regulate it, it shouldn't have ever left our borders; not so quickly, at least. It's too late for wide-scale regulation -- it'd be trivial and stupid. Trivial because anyone can route through some foreign server and stupid because it's no one's place to go around making regulations.

As mentioned previously, I think the best solutions are private. Set up some filtering software. Or, god forbid, delete the crap. If you're on a per-bandwidth payment schedule...sorry. It's what you have to deal with. The whole point of freedom is that anyone, not just geeks, can do what they want. If what they want to do is sell printer toner then by all means, sell away.

As a side note, doesn't this all seem a bit trivial to anyone?

Mikey G.

I can see it now...

[DgtlGhost]

The rush to see how many SPAM lists you can get on so as to track the origin of the msg, just to turn them in. Undercover SPAM cops! Oooo, I think I see a new Fox Show for next fall, following the special, When SPAMmers attack!
Is it just me or does this sound damned hard to work out details for?

-Earthman

Private solutions? Sure, they're waiting for you!

[Frater 219]

Ummm.....If there are viable private solutions to this scourge, then why haven't we seen them already?

There are viable private solutions to spam. See the Mail Abuse Prevention System. Using MAPS's lists to filter your incoming mail will significantly reduce the amount of spam you receive. No, it will not eliminate all spam -- but neither does any "solution" to a social problem entirely eliminate that problem. (Certainly law is not a perfect solution to problems -- otherwise, why do we still have murder, theft, and copyright violation?)

(One of the great things about MAPS is that the more participants, the better it gets. If you use MAPS to filter your mail, then report spam you receive back to MAPS appropriately, you will be helping to improve the service -- thus reducing your future spam intake and everyone else's.)

I am not sure if a private solution would work in this situation because of the "free speech" arguements and also of the multi-juristdictional nature of the problem.

It's funny you should mention those -- because those are, in fact, two problems with law-based solutions which do not affect private solutions.

"Freedom of speech", as protected by the U.N. Declaration of Human Rights and the U.S. Constitution (among others), is more accurately described as the freedom to use your own resources, including your voice and your property, to speak your mind. It does not justify your use of other people's property to speak your mind. That, however, is what spammers do -- they use my mail server, without my permission, to spam me, my users, and others. In the civilized world we call that "theft of services" -- just as if I owned a printing press and you crept in by night and used my press to print up your leaflets.

The legal trouble, then, lies in defining "permission". Some would argue (and have argued) that by connecting a mail server to the Internet you are implicitly granting everyone permission to use it as much as they want, for whatever purpose they want -- including spamming. The opposite extreme is to hold that only explicitly solicited mail is granted permission -- which would rule out a lot of perfectly legitimate mail. Both of these are IMHO ridiculous extremes. A legal attempt to stop spam, however, must deal with these issues in defining spam. Veer to far towards the first position, and you violate property rights; veer too far towards the second, and you violate freedom of speech. A private attempt to stop spam can define permission extensionally -- i.e. by example. This is exactly what cooperative, voluntary systems like MAPS's lists do. The lists are made up of addresses associated with actual pieces of spam received and reported by participants.

You also mention the "multi-jurisdictional nature of the problem". This, too, is a problem solely for legal attempts to stop spam, and not private ones. Private cooperation among ISPs and among users may easily ignore governmental borders -- indeed, it already does. MAPS participants come from all corners of the globe.

For all those anti-government folks, I am surprised to see that a creation of a civilian anti-spam force is so distrubing to you.

What's so "anti-government" about bounty-hunters and more laws? That's about as "anti-government" as any other case of stool-pigeonry.

As a Libertarian, I object to government meddling in private affairs. I also object to crime (i.e. the violation of people's rights), and I consider spamming to be criminal, regardless of whether or not government thinks it is. Spamming is a violation of the property rights of those spammed, and of the owners of mail servers that relay and store the spam. I support people taking private action to protect themselves from crime, insofar as they feel the need to do so, and can do so without violating others' rights in the process -- and that is exactly what MAPS and similar systems do.

If you are emotionally dependent on government to protect your rights -- in other words, if you are unwilling to protect them yourself -- what rights do you really have?

what consequences?

[geekpress]

The ./ summary hints at some potentially scary future as a result of the precedent set by this bill. Well, we already have worse incentive programs. Thanks to DARE, kids turn in their parents for smoking pot. Compared to that, the precedent set by hunting down spammers seems pretty benign.

Nevertheless, any program where people are rewarded for turning in other people for alleged misdeeds has a KGB aura to it, no doubt. But why should we be so suspicious if the misdeed is, in fact, A Bad Thing?

Well, we should be suspicious if it is only A Bad Thing and not An Evil Thing. SPAM is a pain, but it's just not on the same level as rape or murder. There is a real difference between giving someone an incentive to turn in their rapist neighbor vs their spamming neighbor. The law ought to see a difference between the magnitude of those two acts, rather than lumping them together as "lawbreakers."

Then again, if they'll let me hunt them spammers with my shotgun in hand, to hell with the precedents! :-)

-- Diana Hsieh