Lessig Wagers His Job On Anti-Spam Theory

kien writes "Lawrence Lessig is betting his position at Stanford on his anti-spam legislative recommendations. From his blog:'First the analysis: Philip Jacob has a great piece about spam and RBLs. The essay not only identifies the many problems with RBLs, but it nicely maps a mix of strategies that could be considered in their place. But, alas, missing from the list is one I've pushed: A law requiring simple labeling, and a bounty for anyone who tracks down spammers violating the law. Here goes: So (a) if a law like the one I propose is passed on a national level, and (b) it does not substantially reduce the level of spam, then (c) I will resign my job. I get to decide whether (a) is true; Declan can decide whether (b) is true. If (a) and (b) are both true, then I'll do (c) at the end of the following academic year.' The Declan referred to in point (b) is Declan McCullagh." Update: 01/07 02:45 GMT by T : Speaking of whom, here is Declan's acceptance of Larry's bet.

Comments

First problem with this solution:

[swordboy]

Lawrence Lessig is betting his position at Stanford on his anti-spam legislative recommendations.

Umm...

You *don't* need LEGISLATION to fix this problem (isn't that what technology is for?). Fix the technology (or lack thereof), and you've fixed the problem. There are several very good ideas floating around out there that don't require an office of homeland spam in the whitehouse.

Stupid lawyers...

Re:First problem with this solution:

[Anonymous Coward]

Name one technological measure which has a zero false-positive rate, a low false-negative rate, and a snowball's chance in hell of being adopted. The problem should address spam at the server side, since it's already wasting space by the time it's allowed onto a client machine.

Re:First problem with this solution:

[Mike the Mac Geek]

Yes, but the laws give it teeth. Software can cut spam, but more will come, in a never ending cycle. If we make it financially hurt people to send out pure spam, then we don't need to have software that could possible filter out vald mail at a prohibitive cost.

Re:First problem with this solution:

[GigsVT]

Show me one technological solution that will stop spam, that doesn't involve a constant cat-and-mouse game.

Re:First problem with this solution:

[Guppy06]

"There are several very good ideas floating around out there that don't require an office of homeland spam in the whitehouse."

What amazing reflexes you have in your knee-jerk reactions. You could have a future in television news. Just because there is a federal law passed on something doesn't mean there will have to be federal enforcement of that law.

Consider federal anti-junk-fax laws. If you get an unsolicited advertisement on your fax machine, the sender owes you $500, collectable through your local small claims court/justice of the peace/etc (if need be). Essentially, all this law does is explicitly spell out the rights of the owner of the receiving equipment and make it easier for the recipient to claim damages without having to carefully explain how junk faxing is essentially trespassing each and every time.

The FCC doesn't enforce this law. The FBI doesn't enforce this law. You enforce this law.

I personally think the idea of expanding the existing junk fax law to include spam would be easier to enact (add three or four words to existing law) and easier to enforce (track down spammers for a guranteed $500 instead of just a chance at $10,000), but I'm obviously biased.

Now calm down before you shatter your kneecap.

Re:First problem with this solution:

[swordboy]

Consider federal anti-junk-fax laws. If you get an unsolicited advertisement on your fax machine, the sender owes you $500.

If long distance faxing did not cost anything to the sender, then we'd all be getting spam via fax from China. US laws mean nothing to spammers.

Hell, there is nary a US provider that will carry a major spammer. How is a law going to fix that?

Re:First problem with this solution:

[arb]

On one overly spammed account, 23 people are on the white list, I get no spam.

And how do you expect to receive a surprise email from a college buddy you lost touch with 10 years ago? White lists only work if you have a clearly defined set of people who you wish to receive email from - they do not allow the possibility that someone will legitimately send you an email without you having added that person's email address to your list.

Re:First problem with this solution:

[sfe_software]

Name one technological measure which has a zero false-positive rate

Bayessian Classification

a low false-negative rate

Bayessian Classification

and a snowball's chance in hell of being adopted.

Mozilla has (very preliminary) Bayessian classification. So far, that part works great - not a single false-positive in weeks of use (I've been using it since 1.3a was released), and once they add the ability to auto-mark-as-read and move/delete SPAM, I'm all set.

The problem should address spam at the server side, since it's already wasting space by the time it's allowed onto a client machine.

I'm not sure if you are referring to the origin server, or the receiving server (in which case it has already wasted space/bandwidth), but the receiving server could easily implement Bayessian filtering as well. It would take some work on the part of the clients to make it work (or perhaps simply forward junk mail to a local address that classifies it as SPAM?)...

I personally am okay with doing this in the client, as long as the Mozilla team continues to improve this feature. Currently I'm still interrupted and must mark the messages as "read", but eventually I won't have to ever see SPAM.

I'm normally not all that fanatic about software or software-ideas, but Bayessian filtering just plain works. If some implementation were to add common word-groups instead of just word occurrances, it might even be more rock-solid, but even as it stands in Mozilla's implementation, it has serious promise.

Implemented as a Perl script on the server-side, one could easily eliminate the problem all together for each user (since everyone has a different idea of what constitutes SPAM).

A classic example of this: Yahoo mail uses a more global approach to SPAM classification (BrightMail I believe). Unfortunately the RedHat Eratta mails fall into the Junk folder, since apparently many Yahoo users consider it SPAM. Similarly, I still get "notification@mailsweeps.com" SPAM in my inbox, no matter how many times I report it as SPAM.

This is where Bayessian filtering, which works on individual users, solves the problem.

Anyway, if it isn't obvious, I'm all for using technology to solve the problem, especially now that a very promising technology is currently available. Legislation won't help, unless it's globally enforced, and even then it still won't help much. Bayessian lets the user define what he or she considers SPAM, which will vary from user to user, making it the most logical approach IMO.

Re:First problem with this solution:

[asa]

While it's not completely free of the "cat-and-mouse game", Mozilla's Junk Mail Controls are cutting my spam down by about 90% and it only requires a single mouse click for each of the few spam messages that gets through to keep the filter trained at that level.

--Asa

Re:First problem with this solution:

[Sheetrock]

A decent idea I've seen along these lines (barring your third criterion -- but I remind you we're still waiting for things as important as IPv6 to be deployed) has to do with requiring the sender of an e-mail to generate a computationally-expensive hash collision, dubbed 'hashcash', of the message that is computationally-inexpensive to verify by the systems forwarding the message to its destination. In a nutshell, a computer sending e-mail can be required to spend an arbitrary amount of time to generate this data, as the alternative would be to have the mail discarded by any mail server/relay implementing a check for the data.

There are more details here. Obviously, there's more to creating a workable system than this, because such an atmosphere would make it impossible to run a large-distribution mailing list, but it should be possible to get around such problems with a little ingeniuity, such as allowing the recipient of such mail to exempt certain IP addresses at the mail server from having to generate hashcash. My favorite part of this scheme is that, implemented properly, it could stop spam before it leaves the originating ISP.

Re:First problem with this solution:

[Mr Bill]

If a SPAM doesn't appear in my inbox, was it ever sent?

By the time the SPAM gets filtered by your mail reader it has already done lots of damage. SPAM costs ISPs money in time, bandwidth, and storage space. Where do you think that extra cost is heading. Right back to the end user.

There are many solutions out there that can limit the amount of SPAM that appears in your inbox (like bayessian filters), but that isn't enough to stop the SPAM problem. It just puts a band-aid over it...

Re:First problem with this solution:

[ergo98]

Mozilla has (very preliminary) Bayessian classification.

Just as an aside it's "Bayesian". I'm not launching into pedantry but noticed that when I tried doing a search on it (good old Google and its suggestions).

In any case, the success of Bayesian Filtering is because it is rare: Do you think that spammers couldn't dedicate some time and create a "norm" email if these filters were widespread? The only reason that they haven't is because users utilizing it as an anti-spam technique are rare, though if it took off it would be rendered impotent quite quickly. In other words if you like it so much, don't go around advertising it.

Re:First problem with this solution:

[SpaceLifeForm]

It is a band-aid if few people use it.
However, if enough people (and ISPs) use it, then the effectiveness of spam will be reduced, possibly to the point that many of the spammers give up. It's too soon to dismiss a possible solution.

Re:First problem with this solution:

[Guppy06]

"Hell, there is nary a US provider that will carry a major spammer."

Then explain to me how this guy manages to make all his money. Or is Louisiana no longer part of the US?

Just because spam comes through off-shore relays doesn't mean it originated off-shore.

Re:First problem with this solution:

[splattertrousers]

Show me one technological solution that will stop spam, that doesn't involve a constant cat-and-mouse game.

Mail storage should be the responsibility of the sender . The sender only actually sends email notifications.

Mail notifications should include a digital signature of some sort. Users can choose which signing authorities to trust. Signing authorities may require a deposit before issuing a signature certificate and may gain trust from potential recipients by offering to split the deposit 50-50 with the first person to receive spam from the account.

So it boils down to a whitelist of ISPs. If you want to send legitimate mail, you need to use an ISP that other people trust to enforce the spam rules.

How will spammers get around that? The only thing I can think of is by forging certificates, but preventing certificate forgeries is something that I assume has already been solved.

Re:First problem with this solution:

[Mr Bill]

Do you think that the .002% of the morons that actually click through on these SPAMs are actually going to setup and maintain a filter? You have a higher regard for their intelligence than I do...

The uptake of SPAM is so incredibly small, and yet it is still profitable for these pricks. End user implemented solutions will only help reduce the annoyance of SPAM for that user, but I don't believe it will ever eliminate SPAM.

No spammer has ever made any money by spamming me yet, so do you think they will make less money if I filter their emails and never look at them?

Re:First problem with this solution:

[sfe_software]

If a SPAM doesn't appear in my inbox, was it ever sent?

In my opinion? No.

See, my bandwidth isn't much of an issue. I have DSL that goes largely unused. My server sits on a DS3 that, again, goes largely unused.

So for me personally, and all 300+ clients on my servers, the biggest problem with SPAM is the time spent manually classifying it, and deleting it. And being interrupted in the middle of something when the 'new mail' notification sounds.

So for me personally, Bayessian filtering offers enough of a solution to eliminate the problem as I see it.

I don't think we will ever fix the problem any further than that. Stopping SPAM will only happen when everything is controlled and regulated -- and I don't want to see that happen. I don't what "white lists", and I don't want to approve each sender, and I don't want to have to "sign" emails through a trusted authority.

I want to decide what I personally want in my Inbox and what I don't, and let my client sort it out from there.

Band-Aid(TM)? Perhaps. But anything further can potentially take away freedoms we currently have (like being able to send an email to an address found on a web site to ask a question or propose a business opportunity, without fear of being labeled a SPAMMER).

Re:First problem with this solution:

[ergo98]

Is that a challenge? :-) Seriously though I don't imagine it would be that hard to do a, tada, Baysesian analysis of a large set of email and from that author spam that fits within the profile closely. For the filters to continue to filter out spam they would have to start filtering "suspect" emails (Hotmail, for example, would always filter messages that had short subjects. As friends often emailed me with subject lines like "BTW" this became a major nuisance), including false positives, and that is absolutely deadly for any anti-spam product (as one link I came across while trying to determine what this new fangled "Bayesian filter" was: It's like an acne cream that kills the user).

Re:First problem with this solution:

[sfe_software]

Just as an aside it's "Bayesian".

Crap, I've made quite a few posts with the double-S up to now... ugh! Gotta love Google Suggestions though :)

...the success of Bayesian Filtering is because it is rare:...

I'm not sure about this. The success of Bayesian filtering (rather, Classification) is that it learns what you, the end-user, considers SPAM. How does a SPAMmer learn what you, personally, don't consider to be SPAM?

Currently I get a TON of SPAM with "jm4n" in the subject (my most common email username), and often it sounds like a reply to a personal email ("thanks for your email! Look at my web site and see me naked!").

But the point is, since it learns, and it's completely based on individuals (rather than some generic description of what constitutes SPAM), it works rather well -- better than you might imagine. I suspect this will work in the future.

I also mentioned:

If some implementation were to add common word-groups instead of just word occurrances, it might even be more rock-solid

Currently Bayesian classification is extremely simplistic. It classifies word-counts, and figures if the word "Viagra" never appears in "real" mail, and often appears in "Junk" mail, then this is a key indicator that this is SPAM.

If this were extended to word groups (say, groups of words that appear together frequently, like "penis enlargement" or "work from home"), it could even be more effective. I'm tempted to work on some Perl scripts to implement this even further than what Mozilla does (and, being on the server-side, stop wasting bandwidth on my DSL; not to mention multiple-client compatibility)...

Re:First problem with this solution:

[rgmoore]

In any case, the success of Bayesian Filtering is because it is rare: Do you think that spammers couldn't dedicate some time and create a "norm" email if these filters were widespread?

But how could they? A "norm" email might help a bit, but it can only do so much. That's because a Bayesian filter works on an individual basis, rather than a collective basis. So for them to get their mail past my filter it's not enough for them to make a mail that looks like an ordinary mail. It has to look like my ordinary mail, which is going to be a trick since they don't know what my mail looks like.

To add to the problem, you can't really make an effective commercial email without mentioning your product and where to get it. You can't sell me a mortgage without mentioning mortgages in some way. You can't ask me to help get your mail out of Nigeria without mentioning Nigeria. You can't sell me penis enlargment without mentioning penises in some way. Since none of those things is a regular part of my email conversations, anything mentioning them will be caught by my Bayesian spam filter.

Additionally, a good Bayesian spam filter can look at the headers as well as the contents of the mail it's filtering. Try as you might, you just can't hide the email address of the open relay you're taking advantage of, or the servers between it and my computer, so my filter will notice those things, too.

Re:First problem with this solution:

[ergo98]

I had a long winded reply regarding false positives and what they represent to even the best filtration (i.e. what happens when your filter is attuned to emails between you and your buddies, and suddenly a proposal comes in from an employer, or a partner, or a customer? This single lost email could be incredibly damaging) when I noticed this page that says it eloquently and thoroughly.

Re:First problem with this solution:

[sfe_software]

...what happens when your filter is attuned to emails between you and your buddies, and suddenly a proposal comes in from an employer, or a partner, or a customer? This single lost email could be incredibly damaging...

Personally, I will always at least review the subjects of the 'junk mail' periodically. Currently the Mozilla implementation doesn't treat Junk any differently, other than setting the flag. When it's able to "Move to Junk Folder" I'll still double-check.

The difference is, I can do that once per day. A quick scan of subject lines will rule out the vast majority at a glance (mentions of Viagra, Toner Cartridges, etc) and the questionable ones will get opened for further examination. I estimate about two minutes out of my day, on my own time, to make sure no false positives are in the Junk bin.

Beyond that, Junk mail coming in won't interrupt me while I'm working. I do occasionally receive important mail that needs immediate attention, and the absolute worst case scenerio (in my plan) is that an important message will be marked as SPAM, and only be seen by me at the end of the day.

In practice this would be very rare. So far, I've only had a couple false positives in the early beginning, and these were mailing lists I'd agreed to receive messages from that otherwise may have sounded like SPAM. Now these are getting through no problem.

So, end result -- I don't think Bayesian filtering is the end-all solution, but to be able to classify email upon arrival, and later double-check its work, is the best solution I've seen yet. Sure, some users will end up "trusting" it and might get burned, but that's their fault for putting too much trust into Bayesian (or any) filtering.

Re:First problem with this solution:

[Jeremi]

The way I have it set up is this: Bayesian spam filter plus a white list. Addresses on the white list get an automatic spam rating of "Genuine", and other addresses get analyzed for content by the Bayesian routine. Email that I train the Bayesian filter on as "genuine" gets its sender address automatically added to the white list. Works pretty well.

Another system which I've read about is this: Anyone on your whitelist gets through the filter immediately; any emails not on your whitelist get an autoreply back to the sender saying "please verify that you are not a spammer". If the sender replies (and there are various techniques to make sure the reply can't be easily done by a robot), the original email is then presented to you (and the sender is auto-added to the white list). That should work 100%.

Re:First problem with this solution:

[OrenWolf]

What your missing is this key element: *you* have your criteria as to what is, and is not spam, *not* the spammer.

The spammer cannot adapr to you because s/he does not know the ruleset you are using to detect spam. Even a spammer running 1,000,000 valid emails through a filter would not work, because the filter adapts to the email you actually *receive*. Sure, it may make the filter have to guess more (and subsequently classify more spam as legit mail) at first, but the more email you feed your filter, the better it gets at knowing the difference.

I really don't think spammers can defeat this without knowing the characteristics of *legitimate* email a person receives.

Re:First problem with this solution:

[Anonymous Coward]

And you don't mind indirectly paying for the spam that you don't see??

Fine, but I do mind, even if I don't ever see it.

Re:First problem with this solution:

[casio282]

Hmm, would you mind sending me this post in an email? Never mind, don't bother. You mention "mortgages", "penis enlargement", and "Nigeria". It will never get past my Bayesian spam filter.

Thank goodness /. isn't a mailing list!

Re:First problem with this solution:

[cduffy]

Except almost no spam mentions the word "bayesian"! With appropriately set tolerences, it could still get through.

In any event -- I always check my spam filter's "caught" box daily (something which takes much less time as a batch process than processing messages when they come in), so the rare genuine message which *does* contain a large number of spam words and very few clean ones will still be recognized as good.

Re:First problem with this solution:

[sfe_software]

I've always got the Errata to my Yahoo account. Are you sure you did not block them by mistake?

Actually, this only happened a few weeks ago (when I first downloaded RH 8.0). I told Yahoo to allow that specific address since then, as well as reported it as "Not SPAM". Possibly they fixed this since then.

Re:First problem with this solution:

[hype7]

Mozilla has (very preliminary) Bayessian classification.

As does Apple's Mail program. It works great - very very accurate at getting rid of spam.

-- james

Re:First problem with this solution:

[sfe_software]

Wrong.

Bayesian classification, by definition, cannot have a zero false-positive rate without a 100% false-negative rate except in the most trivial cases.

I should have clarified, but even in my experience there wasn't a zero false-positive rate. Early on, I did get a couple mailing list subscriptions (which I had legitimately subscribed to) marked as Junk.

But it is low, lower than any other type of filtering I have seen/used so far to date. The point is, as long as you double check (once per day perhaps) the classification, it can still save a lot of time.

...but I am quite certain that it wouldn't last very long if spammers were trying to avoid it.

Well, yes, but those of us using Bayesian filters aren't the target of the spammers. Those who actually make purchases as a result of SPAM aren't running Bayesian filters. See the patern? The spammers have nothing to gain by trying to circumvent our filtering, and everything to lose, since they will have modified their message quite a lot.

That's the beauty of Bayesian filtering. It's personal. Only the individual can implement the filter, it's not something that will be done at the ISP level. So the spammers have no reason to try and circumvent it. Anyone using it will, most likely, not ever make a purchase or otherwise respond to SPAM.

This article actually makes a similar point to yours. Read it through -- I responded to his challenge at the end, with a similar (but longer-winded) version of the above. Granted, he has a lot of good ideas, but I don't think spammers will put that much into defeating filtering that only those who are seriously against SPAM will use anyway.

Re:First problem with this solution:

[WatertonMan]

I believe that Apple's spam filter in their default client is Bayesian. I've written a lot of Bayesian and vector space categorizers in my time. Yet I'm still amazed at how well Apple eliminates the spam. Thus far I've not had one mistake. The difference between using my Mac at home and using Outlook on my PC at work is night and day. I have hundreds of pieces of spam that get through Outlook's spam filters. (Rule based I believe)

Re:First problem with this solution:

[WatertonMan]

I pointed out Apple's Mail as an excellent example earlier as well. One point I should make. Unlike Bayesian filters that go through your POP server before you do, the fact Apple's is integrated into the Mail client makes all the difference. You can go into the spam folder and if there is a message that isn't spam, you tell the program and it updates the Bayesian tables. If you find one that Mail missed, you just right click and tell it that it is junk mail.

Apple has it set up in a very friendly way. It prompts you initially for mail it thinks is spam. At that point it has preliminary training from Apple plus whatever you give it. At a certain point it figures it is accurate enough and goes off on its own automatically.

As I mentioned, after a little training myself, it has yet to make a mistake. It is amazing what that does to your workflow!

Don't get me wrong. OSX Mail isn't a perfect mail client. It isn't aware of the blockquote HTML tag, for instance. And I hate how it uses a drawer that isn't resizable for its folders. Unlike the old Claris Mail it doesn't have scriptable triggers for certain mail events either. (Of course neither do most mail clients, especially on other platforms) But other than that it really is very, very impressive.

Re:First problem with this solution:

[tdelaney]

(Good) Bayesian filters - spambayes and bogofilter - work on both spam and non-spam (ham) indicators.

If your message has more and/or better ham indicators (e.g. it comes from a known good email address) then it is highly unlikely to be classified as spam.

Re:First problem with this solution:

[mesocyclone]

I suspect Bayesian filter will only work for a while. Spammers have a lot of money, and they can use it to hire a lot of creativity. If Bayesian filters get very popular, spammers will engage in counter-counter measures, just like a lot of them have already done to other techniques (return address filtering, IP filtering, and these days, simple keyword filtering).

I would bet that it is relatively easy to make a bit of spam that would pass most peoples' Bayesian filters... since most people are fairly alike in their email - or at least there are large subsets worth going after.

Ultimately it will be sort of a Turing challenge - my spam filter vs. your spam trying to emulate any person (not every person) that I might ever want to get email from. Doesn't sound too hard to me!

As many have pointed out, the real problem with Spam is that it as is an economic activity where people other than the spammer pay most of the costs (externalitites). The cost of mass email is only going to get cheaper unless some pretty stern measures are taken. I like Lessig's approach. Make the bastards pay. They are stealing resources!

Of course, we should do the same thing to telephone spammers, but so far nothing has been done there. It is a lot easier to propose legislation than to get it passed.

BTW... I got one of those TeleZapper things (disclaimer: I have not finanical interest in the product). It really does reduce telephone spam. Unfortunately, like most technological solutions, it also has false positives. When the library computer calls up to let me know a book is available, TeleZapper freaks it out before it delivers a message (I know this from watching caller ID). [another aside, the Phoenix, Arizona public library is so primitive that it still can't send you *email* notifications!]

Re:First problem with this solution:

[silentbozo]

Spammers are already adapting. They're resorting to 1 or 2 sentence spams, pared down the the minimum, a 1 line pitch, a URL, and that's it. Still annoying as hell - actually more annoying, because they've fine tuned them to slip by many filters, by not giving the filters anything to work with.

The next step on my server is whitelisting with a challenge response.

Re:First problem with this solution:

[Lozzer]

Would legislation cost me any less?

Re:First problem with this solution:

[Saib0t]

OSX Mail isn't a perfect mail client. It isn't aware of the blockquote HTML tag, for instance. And I hate how it uses a drawer that isn't resizable for its folders.

Just for your information, you can resize the folder drawer by clicking on its outer edge (horizontal, not vertical).

What I hate most about it, and I know it's off topic, is that when you press the "maximize" button, it doesn't take the drawer into account, and also that single clicking to view an email marks it as read and no way to change that behavior in the preferences

Just my .02

Re:First problem with this solution:

[CableModemSniper]

Wow, that has to be the most interesting thing on spam I've ever read. It's almost like using Bayesian classification to stop spam is as bad as unesscessarily using anti-biotics. The spammers (or bacteria) evolve and get around it, and become even more annoying then they were before.

Re:First problem with this solution:

[Eivind]

Depends on your definition of "stop" spam. Personally I'd consider it a huge advantage if I could force spammers to have a valid return-adress to be able to get trough to me. I strongly suspect this would raise costs to the point where spam is no longer profitable.

A simple technical way of doing this is to have 3 lists: a "white" list of people that can always send you email. a "black" list of people who can not. And a third, "grey" list which is initially empty.

People not in any of the lists would be sent a response with a challenge. (something along the lines of "I'm not sure if you're legit or a spammer, if you're real, please send your message again including the word 'flurryfish' somewhere in the text."

People completing the challenge successfully would be added to the greylist, and would not be challenged again in the future.

This way even strangers could send you email, if they're willing to jump trough a hoop the first time. If they're not willing to jump such a hoop, well I guess for me that indicates that their message was not really that important.

Everyone already in my adress-book would ofcourse be in the whitelist and would never see the challenge at all.

Re:First problem with this solution:

[William Tanksley]

Spams like that are even easier to detect -- and best of all, even easier to ignore in the rare cases they make it through.

-Billy

Re:First problem with this solution:

[poot_rootbeer]

No spammer has ever made any money by spamming me yet, so do you think they will make less money if I filter their emails and never look at them?

No, but they WILL send out more emails so they can continue making the same profit with the reduced response rates due to increased filtering.

Filtering is a band-aid, no matter how accurate or how transparent it is. The only real solution is to stop spam at the source. And while legislation is itself another band-aid (at least until a better mail system, one that's not susceptible to spammers' tricks, is developed and universally implemented), it'll at least reduce the bleeding.

Re:First problem with this solution:

[poot_rootbeer]

The problem with hashcash is that it discriminates against mail nodes with less processing power. The small company with an excessively powerful 1.4Ghz dual-processor mail box might have cycles to spare, but what about the other small company with an old P90?

Additionally, no one will be itching to adopt this, as it creates additional overhead for EVERYONE. There's no performance improvement pushing the upgrade, in fact all mail servers would take a significant performance hit because they'd have to use up cycles computing hashes instead of simply pushing data from the spool out onto the network.

Re:First problem with this solution:

[mesocyclone]

I should have been more specific. The spammer community has lots of money. Some spammers (one of whom I used to know) themselves have lots of money. The small scale scammers fund the R&D efforts to defeat anti-spam by purchasing spam software and services from the smarter or richer. It is that economy, not the idiot in the work-at-home pyramid scheme, that I was referring to.

Also, there is a huge amount of money in internet pornography, and there seems to be a lot of spam in that department too.

Overall, adequate money to keep a number of clever programmers at working generating counter-counter-measures.

Re:First problem with this solution:

[Tackhead]

> If long distance faxing did not cost anything to the sender, then we'd all be getting spam via fax from China. US laws mean nothing to spammers.

We'd be getting spam via fax from China - for US businesses. And those are who would be fined under the TCPA.

The problem isn't the law, it's the lack of enforcement.

> Hell, there is nary a US provider that will carry a major spammer.

Level3? Verio? (Awright, maybe Verio doesn't count as US-based :) Worldcon/uu.not? AT&T? Sprint? Dude, what the ring-tailed rambling fuck have you been smoking for the past 8 years?

On Slashdot, you can get a (+5, Insightful) for that, but I dare you to try and slip something like that past news.admin.net-abuse.email. Bring your asbestos underwear and be prepared to find out what (-6, Couldn't Find His Ass With Two Hands And A Team Of Sherpa Guides) feels like.

Re:First problem with this solution:

[Sheetrock]

I agree with you and the anonymous fellow that replied as well that older systems or computers that are underpowered because of their portability pose a problem to the scheme as written.

If there was a bulletproof technological answer to spam that was cheap or free and easy to implement, many of us would be using it by now. Any solution (technological or legislative) will create additional overhead -- the real concerns are where should the burden be placed and are the results worth the cost?

You may be on the same page as me, but I'll mention that I have no faith in legislation against spam. Look at how well the junk fax law is operating -- I've even gotten the things on a dial-in Debian box without realizing the getty package added fax reception. The worst case penalty if you can actually track down the sender is a slap on the wrist. I guarantee spam legislation will be every bit as half-assed, exempting all sorts of special-interest groups and even in the best scenario doing nothing to stop spam originating out-of-country.

Before discarding hashcash out of hand, however, give the concept some more thought:

False positives are a major concern for me; I don't want to find out that I've been ignoring someone for weeks because of an overzealous spam filter. Bayesian filtering is great, but not perfect. Barring a server outage or something similar, if a hashcash message is sent properly you know it won't be silently discarded at the recipient's filter.

Spam likely creates a larger overhead on the system than hashcash would. Billions of messages flying through the network nightly isn't cheap, and is costing all of us in responsiveness and bandwidth. Filters in the mail client mean that in many scenarios the recipient is paying to download spam even if it gets removed before it is read. While spam could still be sent in a hashcash environment, the reduction in volume would probably offset the overhead of hashcash generation.

I haven't looked at the algorithm, but it's probable that checking the hashcash signature on a message is negligible (which is the only operation mail servers need to care about -- generating a hashcash signature on outgoing messages would probably be done on the sender's computer in most cases or handled with a cheap peripheral). Most places have decided that virus scanning every incoming and outgoing message is worth the performance hit, so it's possible they'd be willing to compromise when it comes to unsolicited commercial e-mail too.

In the cases where someone is using a phone or handheld system to send e-mail, having a server that generates the hashcash would probably be necessary. It's also likely in these cases that the people with these devices would appreciate more than the rest of us not receiving spam, given the costs of airtime.

I recognize this isn't a perfect solution, but I think it's a very workable one given some thought. Alternatively, the amount of time it takes to send a message could be decoupled from processor speed by doing something like changing the process by which e-mail is sent on the Internet (have the client connect directly to the remote mail server) and having the server delay the reception process X seconds/mail.

Re:First problem with this solution:

[Eivind]

This is an existing problem. People need to add all mailing-lists they are on to the "white" list.

Actually, people need to in general make sure that no auto-responders respond to mailing-list messages. On a mailing-list I'm on, each time I send a message I get a dozen or more messages back, from people I've never heard of stating they're "out of office" or whatever.

something missed

[neildogg]

They missed the link to his idea

Since sentiment, but...

[Chester K]

While I appreciate Lessig's intentions here, it usually takes a bit more than a wager to get Congress to pass a law. Perhaps if he backed it up with some cash, Capitol Hill might pay attention.

Re:Since sentiment, but...

[shaitand]

The soviet russia things are supposed to be backwards sheesh. In the US the law violates you, so in soviet russia it should be you violate the law ;P

Re:Since sentiment, but...

[pHDNgell]

While I appreciate Lessig's intentions here, it usually takes a bit more than a wager to get Congress to pass a law.

Yeah, like an act of congress...

Re:Since sentiment, but...

[AndroidCat]

The danger of getting laws passed is that the Direct Marketing Association always makes sure that clauses get added to redefine what they do as not spamming.

I don't trust that any law wouldn't be mangled by the DMA's powerful lobby. (Also the number of politicians dipping their toes in spamming is increasing. Any bets that they would define what they do as spamming?)

First problem with your suggestion:

[achurch]

Fix the technology (or lack thereof), and you've fixed the problem.

Right up until someone comes up with new technology to get around your technology.

On a *national* level?

[kfg]

Larry, I like you and all, but what on earth has email over the *internet* got to do with the national level?

KFG

Re:On a *national* level?

[brain159]

I'll answer that in one word:

Ralsky.

He's no fool... international?

[angst_ridden_hipster]

Because he knows that the legislation won't pass.

But if it *did*, he'd be majorly screwed, since a large percentage of the spam I receive, for example, comes from regions outside of the jurisdiction of U.S. National Legislation.

The spammers who are U.S.-based would merely move offshore. (Just think of the headlines -- evil legislation driving away lucrative American internet jobs ... joke, joke).

Re:He's no fool... international?

[JoeBuck]

Even today, a large fraction spam that appears to come from China, that arrives in Americans' email boxes, really comes from the US. It's US spammers bouncing it off of open relays in China.

Under Lessig's bill these US spammers can still be prosecuted.

Re:He's no fool... international?

[smallpaul]

The spammers who are U.S.-based would merely move offshore.

It isn't the person pulling the trigger on the spam that matters. It is the business sponsoring it. For most of these marginally profitable businesses, (penis extenders?) it would be easier to do something else rather than move offshore. Plus, the money has to get from US consumers to the people offshore. There may be legislative ways to make this difficult.

Re:He's no fool... international?

[Kragg]

Point still stands. The poster didn't say that the people currently running the business would more offshore, just that the business would. And it would, the marginal profits would still be there for people outside the US to take advantage of.

Re:He's no fool... international?

[smallpaul]

Point still stands. The poster didn't say that the people currently running the business would more offshore, just that the business would. And it would, the marginal profits would still be there for people outside the US to take advantage of.

If the US law is emulated in other developed countries then the businesses can only be run from under-developed countries. This is much more difficult and expensive for a variety of reasons (e.g. bandwidth, distribution, ...) so I would expect volume to drop.

Why I'd take the bet

[stand]

What I don't understand about Lessig's proposal is how would he enforce the bounty part of the law against off-shore spammers. Suppose I get an unlabelled spam from someone and I manage to track down the spammer as originating in Mauritania. How do I get my $10,000 from this guy. Is the US going to invade Mauritania to get it?

Re:Why I'd take the bet

[mcc]

What I don't understand about Lessig's proposal is how would he enforce the bounty part of the law against off-shore spammers.

The only sane thing to do would be to make it just as illegal for a U.S. company to hire said offshore spammers as it would be for that U.S. company to send the spam themselves. Spammers can never completely be eradicated becuase they follow supply and demand; however, the people hiring the spammers don't. That is to say, if you take out a spammer, another one will appear and fill its place. If you make someone stop hiring spammers, it isn't like someone is going to take that place..

But that said: does it really matter? I mean, what lessig proposes would still substantially help against spam. Look at it this way: both the black-list and smart-filtering methods of stopping spam become exponentially easier to do once you can assume spam comes from outside the U.S. Look at it as just isolating the spam to a known area.

At the least, it means that the "collateral damage" from blackhole lists no longer effects americans. Which is a good thing, and also means that people in europe, etc, will become bothered by the fact that they still sometimes get put on the RBL, but americans don't-- making it possible they, too, will then petition their governmental representatives for a required-labeling spam law. So yeah, they'd go off-shore. But over time, only the

I for one don't agree with lessig that this is a good thing to do in place of blackholing, but as part of a Larger Spam Strategy i'm certain it would indeed lead to a massive decrease in spam. Especially if it was illegal for americans to hire offshore spammers that don't follow the labelling protocol.

Re:Why I'd take the bet

[kirkjobsluder]

I think the law would require not only making the spammer liable, but the advertiser buying the spam service as well.

don't worry, he won't resign

[I Want GNU!]

Because the politicians in DC would never pass a bill that would so blatently please American consumers. The average American doesn't have much money for campaign donations.

And hm, I wish we saw Lawrence Lessig post on Slashdot more, like the way Bruce Perens does. That would be cool.

NATIONAL law will stop third-world spammers?

[BigBlockMopar]

You *don't* need LEGISLATION to fix this problem (isn't that what technology is for?).

Especially since the legislation will do nothing.

Here goes: So (a) if a law like the one I propose is passed on a national level, and (b) it does not substantially reduce the level of spam, then (c) I will resign my job.

The problem is it's being addressed on a national level. That won't stop the African scam artists "whose money is tied up" - hopefully their oppressors will beat them in the face with a rusty camshaft - or the Chinese wishes of good fortune and prosperity that I was continually getting from some shitty company selling latex products until I finally decided to blackhole China from my mailserver.

This might keep the Florida 21-year-old unwed mother of 6 children from spamming me from her dial-up ISP of the week. But the funny thing about national laws is that they don't apply outside the nation...

Re:NATIONAL law will stop third-world spammers?

[kien]

The problem is it's being addressed on a national level.

That's a valid point. It leads to what I personally call a "slashdot paradox". I'm outraged that a Russian programmer (and then, the company that employed him) was prosecuted here in the US for software that is legal in Russia. Yet if Prof. Lessig's law is passed in the US...paradox. It could be argued that laws passed in the US have typically been adopted in one form or another around the world (which sucks...ref: DMCA) but that could be countered by the jurisdictional nightmare that the RIAA/MPAA have run into while trying to prosecute Kazaa.

The blessing and (for right now at least) the curse of the Internet is that it globalizes the public commons. We're only now beginning to confront all of the issues that are raised by this fact.

--K.

Re:NATIONAL law will stop third-world spammers?

[MacAndrew]

But the funny thing about national laws is that they don't apply outside the nation...

Not true. Do you think the drug laws have no effect against third-world shippers of illegal drugs? Our laws apply to foreign actions with domestic effects, the classic example being someone who fires a gun across the border.

The laws will apply; the problem lies in enforcement. Americans and American assets are easy to reach. Foreign ISP's that aid spammers can also be tracked; many foreign gov'ts want to help us for friendship or aid. Also, haven't you noticed how the worst spammers are always American? Perhaps they'll flee and renounce their citizenship, but that would be a plus anyway. :)

Re:NATIONAL law will stop third-world spammers?

[Tassach]

Especially since the legislation will do nothing.

I disagree. A properly-written law would be effective. The primary flaw of the current laws prohibiting spam faxes is that while you can file suit in your local small claims court, the defendant has the option to escalate the case to Federal court, making it effectively impossible to prosecute. In order to be effective, a Federal anti-spam law would remove this loophole. While you can't force it to be in small claims court (small claims is a juryless trial, and the 7th amendment guarantees the right to a jury trial if the amount is >= $20.) I don't see any Constitutional reason why a Federal law couldn't force a suit to be tried in the State courts.

You can't deal with all third-world spammers this way, but being able to sue the advertiser as well as the spammer will go a long way to discourage companies from spamvertising. Naturally, there would have to be some burden of proof to show that the advertisement was actually sanctioned by the advertiser; otherwise someone could send out bogus spams on "behalf" of, say, Microsoft, and have MS be liable for the spam.

Re:NATIONAL law will stop third-world spammers?

[poot_rootbeer]

Especially since the legislation will do nothing.

This might keep the Florida 21-year-old unwed mother of 6 children from spamming me from her dial-up ISP of the week.

So are you saying legislation won't reduce spam, or it will reduce spam? Make up your mind.

A Fairly Safe Bet...

[Greyfox]

I'd say that's a safe bet since Congress has shown no inclination to legislate anything about spam. Even if they did, they would undoubtedly go for some half assed bill with no teeth which would not qualify as anything he suggested. And even if they did, the next day every spammer on the planet would relocate to china.

A cute gesture, true, but ultimately pointless.

Re:A Fairly Safe Bet...

[Mustang Matt]

"And even if they did, the next day every spammer on the planet would relocate to china."

I like this idea. I've already got China firewalled.

Rubbish

[CaptainSuperBoy]

Those are the same tired old complaints against blacklists, but now it looks like a 'visionary' has blessed them so everyone's going to ooh and aah all over again - "Now I get it, blacklists are bad!" Except they're not, and all the arguments he presents against them have been refuted in the past.

The point is, receiving mail is voluntary and blacklists are voluntary. If I'm an ISP, I damn well have a right to block all e-mail from China and Argentina and it has nothing to do with "geopolitics and democracy." Gimme a break! He's saying that developed countries are actually preventing more troubled countries from entering the democratic utopia that's supposed to be the Internet. Because 99% of the e-mail coming from those countries happens to be spam. The way he puts it, RBLs might as well be responsible for all the poverty and oppression in the world - how can we blame people, after all we took away their God-given right to send e-mail!

Listen to him complain about collateral damage - collateral damage is the point of blackhole lists! Damaging a rogue ISP's users is the solution, not the problem. If we didnt' punish these ignorant subscribers they would continue supporting spammers. Every subscriber to a spam-friendly ISP is voting with their dollars - for spam. Rogue ISPs have proven that they will not act against spammers until they are financially threatened, and the only way to do that is to damage their user base to the point that they start losing subscribers. Collateral damage IS the point of blacklists - otherwise they're useless.

He also exhibits a fundamental misunderstanding of blackhole lists, lumping them in with open relay lists. SPEWS doesn't list open relays, and this entire rant is tainted by the fact that he seems to think all blackhole lists do is block open relays. Relays are just one small source of spam. Spam-friendly ISPs are a greater threat to the well-being of e-mail, by far.

Answer me this Mr. Jacob, where will our utopian "geopolitics" be when the entire e-mail system is destroyed by spam? Hey, at least we didn't silence any of the poor starving people in third-world countries who were just dying to send their democratic message of hope and peace. Oh, what was that inspirational message from that wide-eyed Argentinian eager to join the global village? The message is "CUM-GUZZLING SLUTS LOVE THESE HORSES."

Re:Rubbish

[PMuse]

Listen to him complain about collateral damage - collateral damage is the point of blackhole lists! Damaging a rogue ISP's users is the solution, not the problem. If we didnt' punish these ignorant subscribers they would continue supporting spammers. . . . Rogue ISPs have proven that they will not act against spammers until they are financially threatened, and the only way to do that is to damage their user base to the point that they start losing subscribers. Collateral damage IS the point of blacklists - otherwise they're useless.

How is the collateral damage caused by blacklisting any better than what the RIAA proposed to do under Berman-Coble? If we're the good guys, we have to do it right.

We condemn the government when it punishes innocent people because of whom they associate with. We condemn our neighbors when they deride people solely because of where they live or shop. We do not punish the innocent for the actions of the guilty just because the innocent are easier to find and hurt.

Collateral damage is a poor justification for blacklists. Do we evict tenants who rent from slum-lords because the slum-lords are slum-lords? Do we burn down the apartments and cast the tenants out on the street hoping they'll exercise better judgment in choosing a landlord next time?

Of course not. We write laws guaranting tenants rights and do our darndest to see them enforced as often as possible. Spamming ISPs should be required to behave or face a the usual penalty -- fines or jail. If the fines are too low, raise them. If the (net)cops are too slow, set a bounty for private enforcement. Are there no geeks who will turn bounty hunter? I'll bet some of those who maintain blacklists would be just as happy with the business model of suing spammers for $500 /message. Collateral damage is NOT the only way to "financially threaten" spammers. If we can find a way to bomb them out of business and not explode so many civilians, isn't that a good thing?

Re:Rubbish

[shaitand]

If your an ISP you don't have the right to block anything from coming to my box without me telling you to or at least giving you permission to. I'll enforce my right to recieve spam or anything else I please without giving you any right to presume discrimination by taking my money elsewhere (and recommending to all my customers using your service to do the same).

Re:Rubbish

[Guppy06]

"Listen to him complain about collateral damage - collateral damage is the point of blackhole lists!"

And this is a good thing?

Let me modify a few of the nouns in your rant and see if you still agree with it.

Killing US citizens is the solution, not the problem. If we didn't punish these ignorant civilians they would continue supporting Israel. Every citizen of an Israel-friendly country is voting with their silence - for persecution. The US government has proven that they will not act against Israel until they are threatened, and the only way to do that is to kill civillians to the point that they start losing votes. Collateral damage IS the point of terrorism - otherwise its useless.

The ends do not justify the means. Innocent until proven guilty unless spam is involved? No thanks.

(Do I think RBLs are a form of terrorism? No. But I do not accept the idea that collateral damage is OK.)

Re:Rubbish

[sfe_software]

If I'm an ISP, I damn well have a right to block all e-mail from China and Argentina and it has nothing to do with "geopolitics and democracy."

And if I'm your customer, do I have a right to disable this blocking? I sell shareware and a lot of support email (and, though infrequently, legit registrations) come from these countries.

This is why I'm all for Bayesian filtering, since it's customized to each individual user. Not all customers of any ISP, no matter how small, will have the exact same idea of what constitutes SPAM... I don't want my email blocked because it comes from an RBL or a particular country.

Re:Rubbish

[djmurdoch]

And if I'm your customer, do I have a right to disable this blocking?

Of course not. But you do have the right to take your business elsewhere, if they don't give you that option.

Re:Rubbish

[sfe_software]

And if I'm your customer, do I have a right to disable this blocking?

Of course not. But you do have the right to take your business elsewhere, if they don't give you that option.

This is why I like Yahoo mail's method. Though it uses BrightMail, which isn't perfect, mail classified as "Junk" goes in the Bulk folder. I can then scan the subject lines or, if warranted, the email itself, to see if I agree with the classification.

But if I found that my ISP were doing some sort of filtering, keeping me from seeing email sent to me, I'd be furious (luckily I run my own servers so this isn't an issue). It's more like censorship in my opinion.

At the very least it should be *optional* and opt-in. Simply rejecting mail coming from a particular country is rediculous (what if I have friends/relatives there?).

Anyway, I certainly hope this practice is clearly disclosed upon signup for Internet service... and not buried in an EULA-type of document.

Re:Rubbish

[viscous]

The analogy you are trying to make doesn't work. Refusing to accept your electronic mail is not the same thing as killing you. Killing you is immoral and illegal. Configuring my mailer to refuse electronic mail from your ISP is neither.

I suppose the problem here is the use of the phrase "collateral damage". It is an unfortunate military metaphor which does tend to suggest the analogy you are trying to draw. But it won't work.

Re:Rubbish

[Steve B]

But I know of at least one ISP which has been SPEWS-listed due to the fact that they host hosting companies that host freehosting-providers that host an endless stream of small companies that gets replaced as quickly as they get kicked out for spamming.

Other ISPs host subsidiary ISPs without becoming similarly infested. Thus, the problem is clearly with the policies and management of this ISP. Cutting them off until they solve the problem seems fair enough to me.

Re:Rubbish

[CaptainSuperBoy]

Although I suspect that your post is tongue-in-cheek, I will point out the obvious difference. Terrorism is an invasion of my rights - specifically my right to live. System administrators, on the other hand, have a right to decide who can connect to their machines. By blocking e-mail from certain sites, they aren't invading other people's rights - they are merely exercising their own rights. When I plug into the Internet, nowhere do I agree to receive all the unfiltered crap that people decide to send me.

He's toast, then...

[legLess]

I hope he has plans for retirement. Or a good explanation of how a U.S. law will affect spam coming from China.

I think his idea is great, and will (if implemented) have the intended effect on spam originating from inside the U.S. It will have a converse effect on spam from outside the U.S, though - we'll continue to get the same amount of spam, it'll just all come from China. Actually, we might get more spam, since I bet it's cheaper to send the shit from China.

The problem here is not that there aren't ways to stop spam (although that's part of the problem), but that spam makes money. As long as that's true, people will find a way to send it. C'mon - it's a freaking felony to carry a gram of cocaine, but hundreds of people do it every day, and few of them are caught.

Unless Lessig can get laws passed in literally every country with as much as a ISDN link to the U.S, this approach won't help much.

An alternate proposal

[VORNAN-20]

Don't bother making spam illegal - it's a waste of time, there are too many ways around it even with a bounty. Instead, make it illegal to sell a product using spam ads (we need a careful definition of electronic trespass here). AND make it illegal to collaborate in financial transactions for companies that use spam. In other words VISA, MC, Discover, Amex etc, can't collect for any transaction for a product or service that used spam to advertise it.

Hit them where it hurts - in the pocketbook. And don't bother with the senders, it's the people that employ the senders that should be targeted.

Re:An alternate proposal

[sfe_software]

...make it illegal to collaborate in financial transactions for companies that use spam. In other words VISA, MC, Discover, Amex etc, can't collect for any transaction for a product or service that used spam to advertise it.

So, put the burden on Visa, MC, Discover, Amex etc to research every one of their clients to determine whether that client may have, at some point, used SPAM advertising? Do you know what kind of extra hoops legitimate businesses would have to jump through to be approved to accept credit cards then?

Let's see... Second National Bank of FunkyTown, IL, receives money from Visa, who processed a transaction from an online CC processor gateway, who is acting on behalf of an online retailer, reselling for a product vendor, who's affiliate sold a product through his affiliate's Geocities web site, who may have at some point sent an email to someone who reported it as SPAM.

So, by your logic, everyone involved here is punished.

Legislation is not the answer. As long as SPAM is profitable, SPAM will be here. If you don't like SPAM, my recommendation is to use some form of Bayessian filtering/classification on your incoming email. Sure, it's not a complete solution (bandwidth/disk space is still being wasted) but it's certainly the best solution I've seen in quite some time.

When users wisen up (won't happen, ever), maybe SPAM will go away on its own. But the fact remains: Infomercials work, so they continue to appear. Annoying loud and obnoxious ass commercials work, so they will always be around. Product placement works, so we'll always see Sony TVs, Pepsi cola, and Apple Computers in movies/television shows.

Likewise, SPAM works, obviously, or it wouldn't be used as much as it is.

And we all know, educating Joe Sixpack isn't the answer. Joe will happily run the .exe attachment in Outlook, forward the latest hoax to his entire AOL list, insist that "InternetBOOST" really made his 56k modem scream, and buy "mini-RC cars" since they are, apparently, the lastest craze. Joe doesn't want to be educated...

Anyway, my point was simply that crazy legislation won't help, and I think there should be simple laws making unsolicited bulk commercial advertisements via email illegal, much like current FAX-SPAM laws. Anything more, and one becomes scared to send an email to someone we don't know, especially if it involves a business proposition.

Don't like what's coming into your Inbox? Use client-side filtering, not laws. We hate the DMCA, because we insist that technology should be embraced, instead of hiding behind laws. Why shouldn't that apply here as well?

Win-Win For Lessig

[istartedi]

Assuming Lessig really wants to leave Stanford, this is a Win-Win for him. If he "loses" the bet he sticks to his word and can spin himself as a "man of integrity". If he wins the bet he can quit for some other reason. So, the real question in my mind is "What does Lessig want to do after he leaves Stanford?".

Do Bounties Actually Work

[CptnKirk]

Did bounties do anything to curb crime in the Wild West? Significantly? Plus way back then people only cared if the bounty was high. $100, $500, $1000 was a boatload of money back then. Heck if I could make that much now per message I'd be happy. But it won't happen.

We already have $50 per message laws on the books (at least in CA) and with the exception of a hand full of publicized cases, there has been little uptake.

In a world where one should be able to retire off the earnings of a family AOL account, it's a wonder existing laws aren't enough. It's simply too much work for too little return. It's too time consuming to plow through the forged headers, sue Yahoo for account information for user 123jlk213lkj and then still get nowhere.

If there was a tough national anti-spam law I'd support it. But for the love of God, give it teeth. Include a sliding scale for infractions ($500 for first, $5000 second, $50000 third). Include jail time for forged headers, and force persons operating under the "business relationship" clause to offer proof of such relationship in the message (at least a link one can follow to verify the relationship as well as request that the relationship be terminated). Require that the transfer of such a relationship be opt-in.

If this type of bounty system was put into place, the war on spam may actually be effective. Otherwise, good luck.

Re:Do Bounties Actually Work

[shaitand]

I agree with you at least on the sliding scale but I think it should start at $10,000 then increase exponentially by factors of ten from there.

Also this should be relatively routine. I get a spam, I forward it to a .irs.gov mailbox with my name and address. They verify and bills the spammer. It shouldn't be a fine, that would be wrong, rather it should be a processing fee charged to "Determine the need of tax assesment" and should be part of a tax bill. I should be given a 10% tax free reward for my assistance of course. The IRS of course has the right to charge this processing fee for each mail that is forwarded to them from the "potential tax evader"

Re:Do Bounties Actually Work

[shaitand]

And of course, if the mail is relayed, they simply charge whoever relayed it if in the US.

Re:Do Bounties Actually Work

[edunbar93]

Who cares? Just so long as I can set up a honey pot and make a living off of nailing the suckers. :)

THAT would be a dream job.

Re:put in a more /. friendly form

[MavEtJu]

More !a || b => c.

Re:Please resign now

[Anonymous Coward]

I might get moded out of exsistence on this

Ahh, the battle cry of the North American karma whore.

Agreed.

[billstewart]

I doubt the legislation would pass, and particularly that it would pass in the clean, simple form he recommends without getting lots of gunk added to it. Even if it does, it won't be too effective unless the _bounty_ is available not only to Americans, but to _anybody_, anywhere in the world, who succeeds in tracking down the spammer, which I consider to be unlikely.

Some of the non-US spam you get is really sent by non-Americans, but lots of it is sent by Americans abusing non-US machines (either by abusing open relays, or by buying cheap services.) US law can't touch the non-Americans effectively, but it can touch Americans using non-US ISPs. The entertaining thing that would happen if the bill were to pass and non-Americans could collect would be an instant market in Korea and China for mail servers that simultaneously forward mail, track down the sender, and log the recipients so that they can document it for the US authorities. Pretty soon, everybody in Korea with a broadband connection (which appears to be just about everybody) will start getting email ads for servers like this, because for a little while, it'll actually be possible to M4K3 M0n3Y F4$$7 on the Net by tracking American spammers. And $10K per successful event, minus US lawyer commissions, is pretty nice for something that doesn't take too much work.

Re:Please resign now

[smallpaul]

He should resign because he disagrees with you? So much for academic freedom!

Sting the bastards into oblivion

[Black Copter Control]

Some time ago I found that spammers had managed to hijack the Windows proxy set up by one company that I worked for. When I found it, they were essentially using the full 1.5Megabit pipe to pump spam into the universe. Given that they were hijacking the computers for financial benefit, this was clearly illegal -- both in Canada (where I live) and in the US (where they were doing most of their business).

This leaves me thinking: shouldn't it be possible to use the ham-fisted anti-hacking laws against these bastares??? Not for spamming, but for hijacking peoples' computers to do the spamming with. I'd love to treat these bastards to 6-10 behind bars. Far better than a $100K fine that would be little more than a locense fee.

I tried to get an agreement with the company for the right to sue on their behalf in return for me helping to lock down their systems... They didn't go for it. My alternative approach is that I'd like to set up a similar system, wait for them to hack into it, and then do a hunt for the bastards running the scam. Any holes in this plan? (other than the probable difficulty in properly trackingg these people down?)

Re:Sting the bastards into oblivion

[zmooc]

6-10 behind bars. $100K fine. For sending some email. What country are you in? China?

Re:Sting the bastards into oblivion

[Deagol]

In case you haven't kept up with the anti-hacking provisions in the Homeland Security Act (pummeled often here on Slashdot), the original poster's idea has merit. The laws are quite draconian -- like in China, as you say.

Of course, I'd prefer to see the laws be revoked, rather than validated and then entrenched, even on slime such as spammers.

Re:Sting the bastards into oblivion

[ryanvm]

Did they exploit the proxy or was it merely open?

I would contend that if someone configures a machine to provide services to the Internet than that person shouldn't be surprised if people start using it - invited or not.

I don't want to see legislation that turns a typo in your web browser into a federal crime.

Re:Sting the bastards into oblivion

[Anonymous Coward]

As someone who hypothetically works at a Tier-1 provider who hypothetically has many spammers buying bandwidth, I can tell you that any spammers relaying off a 1.5 Mbps pipe are small fish. Most big fish spammers purchase 10-100 Mbps of pipe to the core at a time and use all of it. They don't bum bandwidth off other people's relays.

Of course, this highlights another point I think most people are not aware of. For network providers, spammers can be big business. Many of the bigger spammers purchase fatter pipes than many of the big technology-centric companies out there. As much as ISPs despise the headaches spammers bring them, spammers are also among their biggest clients. Spammers consume backbone bandwidth at rates that few other businesses do and this is translated into profits at a time when the ISP business is pretty rough. Since most ISPs require spammers to pay upfront for their bandwidth, this is a welcome addition to the bottom line. Obviously there are people sending spammers money or they wouldn't be able to afford these network pipes.

Re:Sting the bastards into oblivion

[m1a1]

You don't have to sue if they committed an actual crime. That is a serious hacking crime. The D.A. will probably prosecute it themselves if you reported it. Of course, you should track down the spammer first. I'm not sure if they would take the time to investigate it themselves.

Re:Sting the bastards into oblivion

[herbierobinson]

That kind of stuff is currently illegal to the tune of at least 5 years in jail and $20K in fines (computer fraud and abuse act). Good luck in getting the feds to enforce it, though. They seem to only be interested in nailing kiddies who put dirty pictures up on other people's web sites, not real honest to god theft of service....

Re:Sting the bastards into oblivion

[Ami Ganguli]

I'm not sure what Chinese laws you're referring to, but there's nothing wrong with a heavy punishment for willfully violating the law, provided you follow due process.

Remember that this isn't a crime of passion, it's a calculated attempt to steal on a large scale. The correct solution is to increase the punishment until it's no longer worth it for the thief.

Re:Sting the bastards into oblivion

[Black Copter Control]

Most big fish spammers purchase 10-100 Mbps of pipe to the core at a time and use all of it. They don't bum bandwidth off other people's relays.

What happens is that the spammers' IP address very quickly end up being RBLed by the major E-mail providers -- so what some of them will do is hunt for open and mis-configured proxies. It's script kiddie time. They'll use that 100MB pipe to slave 100 victims with the misconfigured proxies until they get added to the RBLs too -- then they'll go on to the next victim.

If my model is correct, we're talking Wholesale industrial hacking here. My single employer with the 1.5Mbit pipe is simply the symptom of the larger issue.

I went through my archive of 1500 spams. I collect them from a handfull of email addresses. Even though I sometimes get more than a dozen identical spams I've only got a small handfull of IP addresses (or even C blocks) that send me more then 2 or three spams. That and the experience at my employer are consistent with my theory of the industrial script kiddies. I'm now seeing proxy attempts in my webserver logs -- even on machines that don't have any meanignful DNS name.

Re:Sting the bastards into oblivion

[theonetruekeebler]

My alternative approach is that I'd like to set up a similar system, wait for them to hack into it, and then do a hunt for the bastards running the scam. Any holes in this plan?

Entrapment, maybe? Rationally, I can shoot down that argument by saying it's not entrapment to leave your front door unlocked; OTOH I can say it's murder to leave your front door unlocked and rigged to fire a shotgun when it opens.

I'd say go for it. Make sure your honeypit is used for something legitimate, and create a real company to own it, then put a legal-disclaimer banner at the SMTP login, then use existing anti-cracking laws to nail 'em.

Assuming you track them down.

Overseas Spam

[Dredd13]

What will Lessig do when nearly all the spam comes through anonymised concat(relays,proxies)[rand] overseas, where the legislation has a value somewhere between "nil" and "dick"?

It's a worldwide problem. Unless you advocate a world-government that can kick ass on local countries (and I certainly don't), legislation will NOT solve the problem, it simply CAN'T.

Fcc does enforce the law

[DiveX]

Take a look at their web site http://www.fcc.gov/eb/tcd/ufax.html

If they get enough properly formatted complaints, they will issue citations. While generally it is a 'cease and desist', they still will follow through if it continues.

The TCPA (Telephone Consumer Protection Act of 1991) will never be used to cover spam, not should it. If it were to be changed, then it would be challeneged by every major Ralwasky wannabe, thus possibly rendering the whole thing dead for the duration. Telemarketers would love to for this to happen. An often used defense (yet still struck down every time) is the suggestion that it (TCPA) violates the First Admendment. It is struck down because the Supreme Court has repeatedly said that commercial speech is not protected speech. The TCPA has teeth because of the FCCs constant review (they just ended comment period concerning the effectiveness thus far and recommendations for changes).

The TCPA will never be adjusted to include e-mail. Any attempt to do so will be very destructive. I used to think it would be a good way to do it as well until I researched the whole law and went through a couple of my own court cases.

Re:Fcc does enforce the law

[DiveX]

That is why the argument fails in court, but it is still used in court. I actually hope the defense, in my cases, try to use it since I can shoot them down in a matter of seconds. Spam will be much more hard to control and even once a law gets passed, even one with private action, it will be years before it becomes effective. No one would bring and action unles you can afford the time and money to take it through all the paces that will certainly be made. An attmpt to just do it half-assed will get some bad early rulings that will hurt the whole cause.

Re:Fcc does enforce the law

[raju1kabir]

The TCPA (Telephone Consumer Protection Act of 1991) will never be used to cover spam, not should it. If it were to be changed, then it would be challeneged by every major Ralwasky wannabe, thus possibly rendering the whole thing dead for the duration. Telemarketers would love to for this to happen. An often used defense (yet still struck down every time) is the suggestion that it (TCPA) violates the First Admendment.

I don't follow your logic. All the time you have crackpots arguing that they don't have to pay federal taxes because they are only citizens of their individual state and not of the USA. You think that every time someone makes a change in the federal tax code they're worrying about one of these trailer park accountants finally mounting the legal challenge that gets the IRS deported to Cuba?

Of course not. Just because a few people don't like a law doesn't mean they have a good argument against it. They only have a good argument against it if they have a good argument against it.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:Please resign now

[darkov]

He simply refuses to understand that we are quickly entering into an age where either all information will be controlled or all information will be free.

Right. So all your medical record will be free. And how many times you had a wank last week will be freely posted on Slashdot and be modded up or down. And any military or security information will be available for download. For Christ's sake, get a clue.

His position that intellectual property still has a place in the information age while decrying all it's problems is just that.

IP has a more prominent place in the information age, not less. Without it there would be no information age. It's central to running an economy. Having cheap knock-offs of your designs or technology made by China or whoever is fine for consumers, but who put up the money to create the technology in the first place? Even something like Linux is merly a knockoff of technology created by large corporations who rely on IP to make a profit. And no, the next big breakthrough will most likely not be created by some lone geek in his bedroom, but by groups of researchers being paid for what they do.

You shouldn't have been modded up, but your average moderator looks at the psudeo-revolutionary drivel running out of your gob and thinks that it means something. Sheesh.

Re:put in a more /. friendly form

[sfe_software]

a = law passed
b = law fails
c = i quit

(a ^ b) => c

Hm, more realistically would be:

a = law_passed;
b = law_fails;
c = iQuit();

if(a && b) c();

Sounds like this guy is going to be out of a job.

[theLOUDroom]

that is, even if the law was ever passed.

How can this guy forget that the internet is not contained entirely within the jurusduction of the US?

It's nor like the spammers need to move elsewhere anyways, all they need is some non-logging proxy outside US borders and they can post with impunity.

Let's not forget the number of spammers already located outside of the US, either.

The internet just does not work the way this guy thinks it does: there is never going to be a day when everyone just follows the rules and plays fair

The way to handle spam is not with laws, it's with technology. Legislative bodies move too slowly and don't understand the technology, nor the scope of the internet.

What needs to be used is a combination of many different technologies: filtering, blacklists, whitelist, etc.

The internet is a huge shared network. So big, that prentending that you can trust every node on it is moronic. Software needs to be designed to recognize when a node is misbehaving and deal with it as well as possible. This goes for not just spam but other types of internet abuse, such as DOS attacks, trying 100 passwords in a row, etc. If a computer is going to be connected to an untrusted network it needs to be able to properly handle all kinds of unwanted data. To me that's just common sense.

Fraud laws don't stop me from getting Nigerian scam emails, do they?

The best way to fight spam is to develop software that isn't vulnerable to it, just like we fix other vulnerabilities. The reason we have spam is because our software isn't good enough.

Think of an unfiltered email systen as accepting input from a web form without doing any checking on the data it's recieving. It leaves you open to tons of really easy attacks. (If someone puts a meg of text in a field and submits it, your cgi scripts are probably going to go apeshit.) It's just bad design and it's about time we fixed it.

Re:Please resign now

[argoff]

Right. So all your medical record will be free. And how many times you had a wank last week will be freely posted on Slashdot and be modded up or down. And any military or security information will be available for download. For Christ's sake, get a clue.

yes they will be once they're out there - it's something that can't even be helped now. your argument is a good one for using digital certificates rather than imposed centralized record keeping, but not a good one for copyrights. sorry.

IP has a more prominent place in the information age, not less. Without it there would be no information age. It's central to running an economy. Having cheap knock-offs of your designs or technology made by China or whoever is fine for consumers, but who put up the money to create the technology in the first place?

if I loose a million in IP rights but gain a trillion worth if IP from everywhere else in the world then that is not a net loss. ps necessity is the mother of all inovations not IP.

Even something like Linux is merly a knockoff of technology created by large corporations who rely on IP to make a profit.

you mean like how MS innovates by using all the FreeBSD code?

And no, the next big breakthrough will most likely not be created by some lone geek in his bedroom, but by groups of researchers being paid for what they do.

Uhh 90% of the utilities in your kitchen or anywhere else were not invented by a big corporation. not even 1% of the new innovation in music.

Re:Please resign now

[kien]

He simply refuses to understand that we are quickly entering into an age where either all information will be controlled or all information will be free. Information is so easy to copy, modify, and manipulate - there can be no middle ground.

Actually, after reading his book I'm more inclined to think that he understands the issues at stake on a different level.

--K.

Re:Please resign now

[shaitand]

Ah yes, the average corporate troll speaks again. IP doesn't exist, or shouldn't. Innovation does not belong to the innovators whatever you happen to think, it belongs to mankind. Furthering our species in technological advancement comes before your personal pocketbook I hate to break it to you. My medical data is for me to protect, by ensuring I choose a doctor and/or hospital that does so adequately, not for the federalies to come pouncing in. And it should be protected from them as much as any other. You see the concept of "hire someone to come up with a great idea and then live like a fat king forever" is a horrid thing to promote. The only advantage you should have from developing technology is knowing it better because your the one who designed it. Or in the case of a corporation who doesn't design anything, treating the people you pay to do the real work damn happy so you can keep that edge. I shouldn't be able to come up with something and live like a king because nobody else can improve on what I made. I should live like a king because I came up with something and nobody else has been able to utilize or improve on it more than I have.

Re:Please resign now

[tfoss]

And how many times you had a wank last week will be freely posted on Slashdot and be modded up or down.

um, 24. Do I get modded up or down?

-Ted

eat me.

[twitter]

If your solutions were working, our visionary would have nothing to talk about. As it is your nice little list and many consolidated clueless ISPs blacklist my computer because I use a dial up. Nice fix, turkey. As things are, I have to use some "official" mail relay to write my own mother email.
MAPS does not work for me, or the spam heavy ISPs that bounce my mail.

Lessig's position is clear and postive. Yours is negative and confused. I'm glad someone is pushing forward a solution that's more than a tool of consolidation. Thanks for telling me about the equestrophiles. So many trolls, so little time.

I'm surprised!

[Helpadingoatemybaby]

That there's so much negative reaction to this. The posts fall into two categories:

1) The internet is international, so you can't have a US law.

2) A technological fix will fix everything.

These are silly arguments and here's why:

1) The US contains a large quantity of pc's and internet connections (if not most internet connections anymore). A law in the US alone will reduce the flow of spam massively, as these 300 million people use the internet disproportionately. Remember: he's just betting on reducing the flow, no eliminating it.

2) The second argument is a false dichotomy -- you can have both a law and a technological fix. There's no harm in having both, as often neither is a comprehensive solution. Why so negative?

Re:I'm surprised!

[ergo98]

The US contains a large quantity of pc's and internet connections (if not most internet connections anymore). A law in the US alone will reduce the flow of spam massively, as these 300 million people use the internet disproportionately.

While US citizens may "use the internet" disproportionately, overwhelmingly my spam is sourced from Asia as of late. In the days of old people like Spamford Wallace could take credit for the majority of spam, but today I would imagine far more prevalent is distributed spammers in far away lands.

Having said that I'm certainly for laws: Often these spammers ARE profiting off of Americans so it seems fair that seizure of their credit card/paypal/etc funds would be just.

Perhaps the best law of all would be one banning people from responding to or buying stuff from spams...

Re:I'm surprised!

[HyperColor Underware]

You're both partially right.

However, if you step on their balls a little, and keep on doing it, eventually it will become cheaper to move base into another country. For example, I'm sure that some of the South American nations wouldn't mind adding Spam to their list of exports. Hell, that could be quite lucrative for them; the fact of the matter is, laws, lawsuits, and the like will not do anything. I'm a lowly 19 year old state college student, and I can easily have five or ten computers set up overseas - and I don't have resources.

Maybe the spammers would start, somehow, making use of open SMTP ports on unsecure systems? Who would get in trouble then? The fact of the matter is, people will just have to live with spam for the next few years. It's unrealistic to have an "allow only" list, and it's unrealstic to have a "block only" list. I have heard of some databases which store known spammers - perhaps making a client software to automatically filter things from these. The more people who use it, the more success.


Either way, that guy's out of a job.

Re:I'm surprised!

[BCoates]

Just because you're doing something overseas doesn't magically protect you from liability; you could be tracked to South America and right back to the US if you're running the operation remotely.

Even if you're actually based in South America, or wherever, your clients (the companies that sell the products being advertised by spam) might not be, and a good law would let you go after them directly. It's not easy to sell something to Americans without any operations in the US whatsoever; at the very least you probably need to take credit cards drawn on US banks, and the law could do something similar to what was proposed for overseas gambling, requiring the US credit card companies to dishonor the debt. (I don't recall if that was actually implemented or just discussed)

Those "databases which store known spammers" are the RBLs which Lessig is saying are unsatisfactory, and the entire reason for an alternative approach.

--
Benjamin Coates

Re:I'm surprised!

[KjetilK]

Well, most of my spam comes from US sources, quite a lot of it comes from Korea and China too, even in charsets and languages I can't read. I am myself Norwegian. But you're right, if US spam would stop, it would fix the problem because I, and many with me, would block Korea into oblivion untill they acquire a clue. They probably don't want to be shut out of the world.

But this is not going to work. For one thing, I can't collect the bounty. Two, spam will only stop if spammers realize that nobody is reading it. So, you can filter on whatever label US spammers will be required to use, but there will be hundreds of other jurisdictions that each will have a label. It's not going to put a significant dent in spam counts, I think.

I have a deep respect for Larry Lessig in many things he do, and I would hate to see him waste his job on something like this.

Yes, but cocaine is super-profitable

[Goonie]

Whereas spam, from all reports, isn't all that profitable. In fact, it's only profitable because of the insanely low cost of doing business.

If the cost could be driven up just a bit by legal and technical means, that would make it unprofitable and therefore it would disappear.

Finally, whilst pr0n can be served up from anywhere it's legal, there are a lot of products that require a US presence, and thus present a target for civil and criminal law.

Re:Please resign now

[Guppy06]

"He simply refuses to understand that we are quickly entering into an age where either all information will be controlled or all information will be free."

Your assumption is based on the idea that nobody cares about copyright laws and will do anything they want no matter what. We're all born kleptomaniacs. But if that were true, the entire CD industry should have vanished the night Napster fist came on-line. KaZaa should be making serious dents in movie ticket sales. But neither you nor Valenti and Rosen can come up with information that supports your argument.

"He reminds me of the people who thought that the free states could peacefully get along with the slave states, but in the information age."

And you and those who hold similar opinions to yours remind me a little too much of John Brown for comfort.

Not a fool but brave.

[twitter]

You realize that the folks that will block useful legislation will also work to get him fired for having the nerve to contradict them. We all risk our jobs with our opinions but he's gone out on a limb to generate publicity for his cause. It's a dare.

Of the top of my head, I imagine that large ISPs, traditional media and government all would like email to be little more than a marketing and propaganda tool run by a few "official" mail servers. If they get their way the internet will resemble digital TV more than it does a network of peered computers designed to share information and computing resources. Oh yeah, Uncle Sam will get his $.50 for each email too. Shut up, spend and consume they say. Screw off I say. Fire me, says Lessing. I wish him luck.

I don't get it.

[Mustang Matt]

No offense, but this seems like a backwards way to do it.

1. Who is going to qualify what fits under .spam?
2. Who isn't going to block/filter .spam?
3. Who actually WANTS to read .spam?
4. Who pays for all the bandwidth wasted by .spammers?
5. Who's going to revoke their domain/IPs?
6. How are you going to stop them from getting a new domain/IP?
7. How are you going to punish those outside the U.S.?
8. Why not just say we're finished with truly unsolicitied email and put the fine on it right then and there?

Re:Please resign now

[peacefinder]

I don't agree with you, but I certainly hope you're not modded out of existence. Yours is an interesting point of view; I'm going to have to think about your "slave-vs-free state" analogy.

However, I think Lessig's immediate resignation, as you suggest, would be a serious setback to the "freedom" of information. (And it's obvious you don't mean "as in beer". :)

If he is right that the middle way is viable in the long term, and he acieves it, then life will be pretty good. Information will be less free than in your ideal, but it will be much more free than it is now.

If he is wrong as you suggest, and the middle way is not viable in the long term, then his work does not harm your cause. In this case, it will be chiefly relevant for having moved people away from the belief that complete control is viable. Perhaps he will win a non-viable middle way, perhaps he won't... but either result improves the cause of freedom of information. (Keep in mind that this contest will take decades to win; the only close end is defeat.)

Information freedom doesn't have enough prestigious voices, speaking in places that matter, for any of them to be lightly cast aside. Whether you agree with him or not, Lessig is, at the moment, the most viable opponent to the idea of total information control*... and that idea must be defeated before we'll have the chance to quibble over the system that takes its place.

You may have valid reasons for spurning the middle way and its supporters. You should have a care, though, that in spurning the middle you don't end up on the side that you like least, for lack of allies.

*: This is a matter of opinion, of course... there are other candidates. But I haven't heard of anyone else arguing this before the US Supreme Court or other institution of similar importance. And no, /. doesn't count. :)

Re:Please resign now

[argoff]

Your assumption is based on the idea that nobody cares about copyright laws and will do anything they want no matter what. We're all born kleptomaniacs. But if that were true, the entire CD industry should have vanished the night Napster fist came on-line. KaZaa should be making serious dents in movie ticket sales. But neither you nor Valenti and Rosen can come up with information that supports your argument.

no, my assumption is that you can't steal something by copying it, but rather copying is an inherent right.

Who's going to pay for it.

[geekee]

Lessig talks about a bounty for spammers, but doesn't mention who will pay the bounty. Although I dislike spam, I don't want my tax dollars paying bounties to catch spammers. If ISPs want to pay the bounty to save themselves money, however, that would seem more reasonable.

Re:Who's going to pay for it.

[elflord]

Lessig talks about a bounty for spammers, but doesn't mention who will pay the bounty.

The article mentions it. The spammer pays the bounty. Cute, huh ?

Make it Slashdot-specific.

[Anand_S]

What a great idea Mr. Lessig has. I've adapted his legislation to be Slashdot-specific. I'm convinced that if my legislation is passed, there will be a significant reduction in "In Soviet Russia" posts. If a) the legislation is passed, and b) it doesn't work, then I'll forfeit all my karma.

Then make more than one Bayesian filter

[yerricde]

what happens when your filter is attuned to emails between you and your buddies, and suddenly a proposal comes in from an employer, or a partner, or a customer?

Bayesian filters don't have to classify a message only as "Spam" or "Not Spam". You can train them to recognize several categories such as "Work"/"Not Work", "Buddies"/"Not Buddies", etc.

Bayes can create your own whitelist and RBL

[yerricde]

To add to the problem, you can't really make an effective commercial email without mentioning your product and where to get it.

Unless the spammer makes an HTML e-mail and puts the entire ad spiel in a PNG image.

You can't sell me a mortgage without mentioning mortgages in some way

You can't discuss your mortgage with your banker without mentioning mortgages in some way.

You can't ask me to help get your mail out of Nigeria without mentioning Nigeria

Your middle-school daughter can't ask you for help on a geography report on Nigeria without mentioning Nigeria.

I agree that an e-mail classification system can reduce false positives by including headers in the formula. In fact, applying Bayesian classification to specific header lines emulates the already-known spam blocking techniques, possibly with weaker drawbacks. For instance, Bayes on From: and Reply-To: creates a personal whitelist. Bayes on Received: creates a personal RBL.

Re:Bayes can create your own whitelist and RBL

[kirkjobsluder]

You can't discuss your mortgage with your banker without mentioning mortgages in some way.

Your middle-school daughter can't ask you for help on a geography report on Nigeria without mentioning Nigeria.

I agree that an e-mail classification system can reduce false positives by including headers in the formula. In fact, applying Bayesian classification to specific header lines emulates the already-known spam blocking techniques, possibly with weaker drawbacks. For instance, Bayes on From: and Reply-To: creates a personal whitelist. Bayes on Received: creates a personal RBL.

My own experience with Baysian filters is that I can forward spam to myself and it treats it as non-spam email. The whitelisting trend of the algorithm outweighs the spam words.

Re:Bayes can create your own whitelist and RBL

[susano_otter]

And this is, I'll admit, a place where the Bayesian filter is imperfect. I'd guess that there are enough other features of my Banker's email that a good Bayesian filter could probably tell the difference between him talking to me about mortgages and a random mortgage spam, but I'm not certain.

Solving this problem should be trivial. First, any address you send an email to should be logged as potentially good. If you initiate the mortgage exchange with your banker, any replies he sends will be passed through. Every time you accept a message, the filter adds to its "picture" of what valid email looks like. If your banker sends you a follow-up email three months later ("about your mortgage", or something), "mortgage" might be a flag, but pretty much every other word in the email (and in the next generation, word clusters) will flag it as good, as will the email address and headers.

In order to for your banker to generate a false positive, his email would have to start looking a lot more like spam than it normally does, and his mail server would have to be compromised, causing you to flag every email coming from his bank as potentially spam. Even then, his signature, contact information (which your filter knows is typical of legitimate email you accept on a regular basis), and other characteristics would probably keep it safe anyway.

Long monopoly terms are the problem

[yerricde]

Having cheap knock-offs of your designs or technology made by China or whoever is fine for consumers, but who put up the money to create the technology in the first place?

Does the inventor of a novel information technology product (not a drug) really need a 20 year monopoly to pay for the product's research and development?

Does the author of an operating system really need a life + 70 year monopoly to pay for the product's research and development?

Some monopolies do benefit society. But like all things, monopolies should exist in moderation, and this is why Dr. Lessig has gone to court to argue against monopoly term extensions.

Re:Long monopoly terms are the problem

[darkov]

I don't have any argument with the excessive monopoly terms for copyrights being extracted from the lawmakers. The balance is way off.

In the case of IT, maybe 20 years is fair - if I spend 5 years developing a product, why shouldn't I get 20 years protection? Lets say in the case of the original Mac OS, by next year Apple will have almost totally abandoned it - it should revert to public ownership. You might even have a clasue for IP (in the case of IT) that isn't being exploited or developed in which case it reverts to public ownership.

Ramifications

[CptnKirk]

I admit, thinking of new ways of sticking to spammers is fun. What would be the flip side to such a law?

Would it end free E-mail services (or at the very least require a credit card ID)? How would ISP's protect themselves from their users' possible infractions (if somehow they could be found guilty of contributing to the problem by providing the means)? Would this contribute a to higher price at the pumps (Cable/DSL bills)?

In short, could such an agressive law cause more problems than it solves?

Move house?

[yerricde]

I'll enforce my right to recieve spam ... by taking my money elsewhere

It costs roughly six figures USD to move your family to a geographical area where there exists a cable company or a phone company willing to offer you high-speed Internet with no restrictions on what content you may receive beyond the basic restrictions of federal and state law.

Re:Move house?

[shaitand]

There are no content based restrictions right where I'm at now, either on cable or dsl high speed connections. There is about to wireless service that will have no such restrictions either (especially my connection since I'm the one setting it up). So I'm not particularly concerned.

Re:Please resign now

[susano_otter]

He claims to be on our side, but all this time people are discussing it - copyrights and all their consequences are being beaten down our throats all the harder. It is simply time force it so society can get on with the information age.

I'm not sure I follow you. If you said

"He claims to be on our side, but... he's actually working against us",

or

"He claims to be on our side, but... he's actually not doing anything at all",

I'd understand what you're saying. What you actually seem to be saying is that he claims to be on our side, but things are getting worse anyway. You claim to be on our side, but things are getting worse anyway. How come the current state of affairs is his fault, and not yours?

You seem to be against discussion, and in favor of "forcing it". What exactly do you mean? Should Lawrence stop talking and start putting guns to people's heads unless they stop sending spam, or stop claiming copy rights, or whatever? Or do you mean that the government should stop allowing the courts to rule on these cases, prohibit people from debating the issue, and just make a law abolishing copyrights?

You point out--correctly, I think--that you're entitled to your own opinions, but what if somebody else disagrees with your opinions? If they want to discuss your differences, are they "getting in the way"? Is it time to force them to comply with your views? What if they don't want to be forced? Can they force you to back off? How much force is appropriate? How much force do you think is necessary? And isn't there a kind of delicious irony inherent in forcing people to be free?

Finally, it's not exactly clear what Lawrence is getting in the way of. I'm guessing that you mean that all his discussion is giving the false impression that force won't be necessary. I don't know if force is necessary or not, but does the current situation really call for someone to jump up and say "enough talk, time for beatings"? I doubt it.

Overall, I don't really understand your opinion, but I'm very glad it's only an opinion. I'd hate to disagree with you, if your opinions were laws!

Nothing New Here

[markwelch]

First, my immediate reaction was the same as others: Congress will never pass such a law, so Lessig is safe. I'd bet my job on this, if I had one. ;-)

Second, Lessig has been in the "blacklists-are-bad" camp for a while, at least since he wrote a column in 1998 called "The Spam Wars," griping about the unfairness of MIT being blacklisted due to its policies (at that time). He basically took the position that "blacklisters" need to implement an extremely complex and expensive system of notice and appeal (due process) procedures. In other words, we cannot erect fences and gates with locks, unless we agree to schedule a hearing and pay legal costs for every single person who seeks entry, even if there are millions who have no right to enter but ask anyway.

I had a very interesting (if not ultimately productive) series of email exchanges with Lessig after he wrote that column -- starting with my email noting that I might not receive his reply because I'd already blacklisted his employer (then Harvard University) because of its maintenance of open relays and absence of staffing to respond to abuse complaints.

It was that exchange that led me to adopt my "triage" theory of spam-fighting, which remains the core of my belief system today, so he helped me. My position was, and remains, that if hordes of criminals are trying to invade my property, I can erect a fence and I need not listen to individual demands for entry if I choose not to.

junk fax analogy

[MacAndrew]

I agree with this approach and am surprised more people don't promote it. The anti-fax law appears reasonable, constitutional, and strangest of all effective.

The "junk fax" law in enforceable privately in state court, but also by the FCC.

Interestingly, here is a recent Missouri decision declaring the statute a violation of freedom of speech. I haven't looked closely at this aberrant ruling, not because junk faxes aren't speech (they are), but it appears wrong because of the way it analyzes Congressional intent.

Re junk faxes, junkfax.org has some interesting information that would relate to a junk email law.

Re:Sounds like this guy is going to be out of a jo

[MacAndrew]

Jurisdiciton: anything abroad that affects Americans is within U.S. jurisdiction. The primary problem is enforcement, but many gov'ts do want to help, hoping for friendship or aid. Even the Chinese are reportedly beginning to cooperate against couterfeiters -- I'd rather have the U.S. after me than those thugs.

An American pulling the strings of an offshore operation would be fully liable. So would any American assets, fund transfers, or any other domestic presence.

Re Nigerian, multiple routes are being pursued by entities from the Dept. of State to the Secret Service. It's not so much the emails and the millions lost and 17+ people killed in Nigeria over this. The Nigerian authorities are cooperating, to the degree that helps... (news)

Wrong!

[raehl]

It doesn't matter if it comes from out of the country. You're missing a universal truth about spam:

Spam wants your money. In order for spam to get your money, you must be able to send your money to the spammer.

If your spam is in English, it's not not likely coming from a chinaman. That means there is someone stateside bouncing spam off China trying to get your money - and that's their weak point. It's a very simple matter with a law with teeth to shut down the credit card merchant accounts of the spammers, costing them money (those accounts are not free to set up) and eliminating their ability to get money from spamming.

Imagine a DMCA-type law for spamming: You receive spam, you send a letter to that spammer's bank, and if the bank doesn't shut down their bank account (or pay you some fixed fee for their customer spamming you), you can sue the bank for facilitating spamming, just like the DMCA allows copyright holders to sueISP's for facilitating copyright infringement if they leave material up after a DMCA compliant notice.

Of course, whether congress would ever let consumers wield that kind of power is another matter entirely.

Re:One click to patent infringement

[kirkjobsluder]

I agree with a system where works that fall out of print[1] would also fall out of copyright, but the fact remains that the United States is a signatory to the Berne Convention, which guarantees at least life plus 50. How hard is it to get out of a copyright treaty?

Just because copyright exists for life+50 (which I also find excessive) does not mean that one can't give it away. The trouble is creating an incentive system for putting works into the public domain.

Shooting the messenger

[gad_zuki!]

>It is the business sponsoring it.

Great comment and unfortunately this isn't said often enough. Feel free to post the name and address of a spammer all over the internet, but he's only the messenger. If anyone should be harassed its the owners, marketers, etc of the companies which thrive on spam.

Re:Please resign now

[QuantumG]

you associate ignoring copyright laws with theft. You are already lost.

Re:Please resign now

[argoff]

To your credit, there is another old saying, "those who are not against us are for us". Perhaps I shouldn't be so hard on Lessing.

However, consider for a moment the 1st ammendment - and it says "the freedom of speech shall not be adbridged" and not "you have free speech" because it is understood that this right is an inherent right that exists above government. I believe the same is true with the right to copy, and there are compelling facts to back it up - such as the non tangable nature of information, and it's high amount of interdependencies (eg all works derive from previous knowledge).

So how sould I pretend that this right doesn't exist for the comfort of those who don't want to believe it? How shall I pretend that Lessing is just swell because he only want's to acknowledge half my right instead of all of it? Is he a true liberatior, or just a pacifier to keep me and everyone else from the good we really deserve?
If we half to go through all this, shouldn't we really make it count?

Being so close to having this right completely unfettered, why should I give up half of it now for the sake of his beliefs and his percieved security, it was not his ship that has brought us this far so why should we hop on board now?

Interestingly enough, the copyright industries also see him as a threat. Which is probably why things wont work out for him. For the people who really stand to gain or loose from this, neither stands to gain much from the middle ground.

Lessig is not the problem, what are you doing?

[kirkjobsluder]

He should resign because he's in the way, that is an opinion too you know. He claims to be on our side, but all this time people are discussing it - copyrights and all their consequences are being beaten down our throats all the harder. It is simply time force it so society can get on with the information age.

Hrm, in the way? This is the person who actually set out to design a supreme court challenge to the Sonny Bono laws in the form of Eldridge vs. Ashcroft. Remember that short of a constitutional amendment, copyright can't be wished away?

He is one of the brains behind http://creativecommons.org/ a site that encourages content producers to release works into the public domain or under copyleft licenses?

So here is a person who has spent a career beating back copyright and expanding the intelectual commons. What have you done?

Re:Please resign now

[bravehamster]

industry should have vanished the night Napster fist came on-line

Sorry, your post got knocked into my BULK slashdot thread by my Bayesian filter. Added you to my white-list, won't happen again.

Dude!

[edunbar93]

It's information, not people.

Information is replaceable. That's what backups are for. People are not.

If someone nukes Los Angeles, then people are going to have more than just a little bit of a headache sending their e-mail. If someone nukes your mail server, then mail gets bounced for a few days, and that's it. It's not that important.

Collateral damage is *good* in this instance. Yes, people will have problems sending mail. Yes, people will complain to their ISP's about the REALLY IMPORTANT E-MAIL THAT MUST GET THROUGH. Yes, Tech support at said ISP (if there is any) will live through hell. Yes, customers will go elsewhere when the ISP doesn't fix the problem. And yes, people will be irritated, annoyed, and even lose money, but it's all because the ISP in question is run by boneheads who don't want to hire a sysadmin, and think that the spammer market is an untapped resource. Companies like this *deserve* to go broke. People who sell services to scammers are running around with huge blinking neon signs on their backs that say "kick me!"

The collateral damage we're looking for is exactly the sort of thing that unions do when they go on strike. They go out of their way to scare away the very customers that feed them in the hopes that upper management will starve first. When the workers go back to work, the company *will* be damaged in some way by the strike, but in the end, things advance, life goes on, and things improve for the better for everyone. The sooner people see the cluetrain coming, the better, but sometimes the whistle has to blow loud and long before anyone notices.

Re:Dude!

[squiggleslash]

Bollocks.

Collateral damage is just that: It damages innocent third parties. Those people had no role whatsoever in what occured, and they're being punished. And you're making the assumption it's ok to punish them because they might put pressure on their admins - but there's no guarantee that'll actually be the result.

I'm tired of stupid, clueless, "solutions" that just cause damage so that some moronic sysadmins can claim they're "doing something" about spam. I wouldn't throw a petrol bomb into the house of a neighbour or relative of a paedophile. I'm not going to subscribe to inane anti-spamming tricks that punish the innocent on the grounds that they might put pressure on a middle man that's helping the actually guilty. That's two steps removed, it's nasty, it's unfair, it's wantonly cruel and it achieves little or nothing.

The law was created to prevent society descending into vigilantism. It's time we ditched the inane pseudo-libertarian mob-violence bullshit and get the laws we need.

No, America.

[edunbar93]

Where bandwidth costs $6 a gig.

Think about how much money you have to pay when some asshole backdoors your Exchange server and pumps out spam at a full 1.5 megabits per second over the long weekend while you're not paying attention. Perhaps this means you're a bonehead for using Exchange in the first place, but that's a little like saying it's your fault you were raped because you didn't keep a close watch on your drinks at the bar, and some asshole slipped you a roofie.

Re:No, America.

[Black Copter Control]

Where bandwidth costs $6 a gig. At $6/gig for a Gigabyte, we're talking almost $3000/month at 1.5 megabits ($100/day). A spammer with a 100megabit pipe is going to be doing this to about 60-100 people at a time. That's large scale larceny. That's why I'm willing to use the anti-hacking laws to give these people a 5-10 year sentence. If this is what they're doing they deserve that kind of sentence.

These are the kinds of people that lawmakers said that they were aiming these laws at. Time to fire the bullet.

Betting..

[steveheath]

I've some experience of betting (I am currently working in the industry). The first thing I was told when I started here was "What constitutes a bet". Among other things a bet must be time-bounded. This means there must be an end-date at which point the bet dissappears. Mr Lessing probably doesn't mean that he will resign (whatever job he's doing at the time) if the law is passed EVER as part (a) suggests. Presumably there should also be a time-bound on part (b) too..?

Re:Rubbish - Indeed

[Dunkirk]

Be careful of your moral-equivalency arguments. Blocking someone's email hardly equates to throwing them out of their dwelling place and into the streets.

Good luck trying to sue spammers. The reason people don't try it is because it's just not going to work with any level of what you would call "success." It's difficult to track down the sender, and it's impossible to know where else they sent the message in order to aggregate the injury award to the point of being effective. Once you've found the sender, it's a horrible legal mess to prosecute (because all litigation is a mess), and you'll only be suing for perhaps a couple of emails per sender. Even if you ever get money out from behind a corporate veil - or whatever business machinations the sender hides behind - what's $500 per message YOU received going to do to his business? If you haven't been paying attention, spamming is good business. That's why there's so much of it.

In my opinion, blacklisting is akin to moderation. Is it perfect? No, but I'll take something over nothing. I read at +3 or +4 when I'm not moderating. Am I trampling the rights of the dispossesed and downtrodden by ignoring their "FP" and "ate my balls" posts? Yeah? So sue me.

Bad bet

[T.E.D.]

A US law can't have much effect, for the simple reason that most of my spam these days comes from outside the US. If you could wave a magic wand and stop all US-based spam, you'd hardly make a dent in it.

In fact, the majority of my spam these days comes in using one of the various eastern pictographic fonts. Not only can't I read it, I can't even make out the symbols. I might as well be getting 50 emails a day of line noise.

Re:Rubbish - Indeed

[PMuse]

Well said. I agree that blacklisting someone's ISP is not in the same realm as turning them out of their apartment. But, it can ruin their legitimate business, which is a serious kind of injury.

My main point was in response to the parent post that said collateral damage was the point of blacklisting. I actually approve of blacklisting generally. However, the justification for it is eliminating the spam-sender. Harming nearby innocents is something we should attempt to avoid.

As collecting bounties on spammers, I'm sure that I personnaly will never see one red cent of such a bounty. But an enterprising plaintiff's lawyer could make a bundle suing spammers. Those guys are taking down industries like asbestos, tobacco, chemicals, and handguns -- how tough can the fly-by-night spammers be?

Re:Monopoly?

[Rogerborg]

Do we live in Hypothetica?

But OK, we'll play your game. You can't send email. Wow, that sucks. Are you pissed off? Sure you are. Now, are you pissed off enough to do something about it to get your ISP unblocked?

Are you seeing the point yet?

Re:Please resign now

[peacefinder]

[...]there is another old saying, "those who are not against us are for us".

Actually, I think that's a pretty *new* saying, but it beats the hell out of the old one: "Those who are not with us are against us." The world would be a much better place if your version were the dominant one. But I digress. :)

Is he a true liberatior, or just a pacifier to keep me and everyone else from the good we really deserve?

To answer your question I need to clarify some background. Please forgive me while I state the obvious.

In the US, the law is built upon the Constitution, and the Constitution is based upon, for lack of a better term, the objective moral reality. Or, more accurately, upon the founders' vision of objective moral reality. (There is ample evidence that, if such an objective moral reality even exists, then perceptions of it have varied widely enough to allow both Gandhi and Stalin to think they were on the right track. Suffice it to say that the effect is one of moral choices, regardless of the existance of a moral reality.)

You believe that you know a piece of the moral reality, specifically that "information is meant to be free". From this, your ideas about what the constitution means and what should be the law flow quite naturally.

Sadly for you and your cause, the Founders made other choices. Specifically, in Article 1, Section 8, Congress is charged:

To promote the progress of science and useful arts, by securing for limited times to authors and inventors the exclusive right to their respective writings and discoveries[.]

Now, I'm not saying you're wrong, only that you have made a different moral choice than the Founders did. Lessig, being a lawyer, is pretty much obliged to battle on the ground the Constitution gives him, whether or not he agrees with the Founders' moral choice. He knows that he has a better chance of winning within the existing framework than he does of achieving a change in the frame.

As for you, you're not satisfied with the frame. You would like to see the Constitution changed to strike out the clause I quoted, and count all information as protected speech.

The simple answer to your question, therefore, is "No, he's not a true liberator." But the simplicity of this answer hides an essential truth.

You and Lessig are not fighting on the same front, although you *are* fighting the same war. Lessig's success or failure is not in itself relevant to your cause, because no matter what he's not going to achieve the total victory you want. However, by fighting his battle, he influences the opinions of people on a large scale, moving the body politic somewhat farther from the idea that information is inherently restricted. He's not working for your victory, but he *is* weakening your enemy.

To achieve the victory you want, you'll need to move the body politic to the point where the Constitution can be amended to reflect a different moral choice. That's a helluva long way from where it is. If I were in your shoes, I'd take all the help I could get. :)

Re:Please resign now

[argoff]

I don't exactly know what you mean by objective reality. But, when I make my arguments I typically try to assume that existence is rational, it is non deterministic (eg. people have free choice), and it is inherently good (eg. people are not inherently evil by nature) I don't think I'm assuming anything else, but perhaps may miss things because I am finite.

Interesrtingly enough many of the founding fathers were aware of copyright's potential problems, that's probably why they have an expiration date to begin with. It used to be that copyrights were granted by the King of England to publishers in return for not saying bad things about the monarchy. Granting them to everybody thwarted this censorship, but it has its own set of problems.

I don't think going through the body-politic is the only way though. And I don't think weakening my enemy helps me too much. The simple truth is, no matter what they do - those who believe like me are close to having the technology, infrastructure, and ability in place for unlimited and unrestricted copying.

I am much more concerned about my weakened and isolated ally who is tempted to give in to the public mob because his belief seems so out of place with everyone else. It is important to assure them that they are not alone, because the more people are willing to copy (no matter what the law is) the more our community benefits.

Re:What power does an individual have?

[Rogerborg]

• what recourse does an individual in such a situation have when a government-controlled ISP run by appointed officials supports UCE?

Throw a tea party. Civil disobedience is the US approved method for forcing social and economic change. If email is important, it's worth standing up for. If it's not worth standing up for, well, then how important can it be?

Bet?

[po8]

Technically, this is not a "bet". A wager requires that a potential direct consideration accrue to the winning party. Lessig more accurately labeled it a "guarantee", although it isn't clear how his resignation would be helpful to those who might harmed by ineffectiveness of his law.

I hope Larry doesn't have to resign: he doesn't seem to have much future as a professional gambler :-).

How about an email watch dog?

[jhamm]

I've tossed around the idea of doing this many times throughout the past couple of years, but more so now that spam is at a point of ridiculous proportions. How about any new incoming mail being held by a watchdog first without appearing in your inbox, which sends a reply to the sender with a message like: "This is the first time you've sent me email. If you wish for your email to be seen, then reply with the word PLEASE in the subject line." From then on, the watch dog would allow emails from that sender to pass through. Otherwise, the spam emails are never seen. I suppose that there may be some spammers that do reply, but it's a manual act, especially since you could set your own pass subject ("PLEASE"), or even have it change to a random word each time. I bet this would cut down on spam significantly. What do you all think?