First Test of Utah Anti-Spam Law Dismissed

fwoomer writes "Apparently, Utah feels that once you've 'opted-in' you can't opt back out as fast as you've opted in. From the story: 'Gillman requested removal on May 14, 2002, from the e-mailing lists his visit to Audio Galaxy a month earlier had linked him to. Two days later, he received a Sprint ad, and on May 28 he filed suit. The court found his attempt to have himself removed from the lists was insufficient to void the pre-existing business relationship.' If he was receiving spam in May after 'opting in' in April, I don't see how it could be unreasonable to expect to be removed from lists as fast as he was added. Unfortunately there's not much detail in this story. A good read, nonetheless." I don't see how signing up with Audiogalaxy establishes a business relationship with Sprint, but, whatever. Presumably some of the other lawsuits filed are against people that have no possible claim to the receiver opting-in.

Comments

collusion

[simpl3x]

so businesses could group together, making the receipt of "email notifications" part of the terms of service... poof, no more opting out.

Re:collusion

[wjvdt]

I, for one, am surprised to hear that the company actually has an "opt-out" policy. I thought that was just a link they put in SPAM to send you to another site where you'll be added to another mailing list???

Re:collusion

[The Turd Report]

With companies/groups that run legit mailing lists, it is very common. It is just that scum-bag spammers have co-opted the phrase and it has soured the term on everyone.

As to be expected

[unterderbrucke]

If you opt-in, it's quite easy to put an entry to the data entry department. If you opt-out, you need someone who's trained to delete (which believe it or not, is a big deal in the data entry industry).

Re:As to be expected

[maddh]

If you opt-out, you need someone who's trained to delete

very true, but i'd expect a well designed system just to use a boolean Y or N in the database as to whether the customer wants to receive mail, rather than deleting the whole record. Just because they can't mail to a customer doesn't mean they can't use the info in other ways.

matt

Re:As to be expected

[FesterDaFelcher]

You don't delete someone from your list when they asked to removed, you flag their account as "do not mail." That way, if they are added again at a later date you know not to mail them.

Re:As to be expected

[Openadvocate]

Uh yeah, it's a real bitch!
If you have a user system on the site, you need to add a check box and a boolean value to the user table.

If you have a mailing list, it is hard to add a url in the end of the mail contains a ID number of the user record and a "random" 32 byte code that can be cross verified with the record in the database.
Or finally maybe just a url with the email as a value, that will send you a unsubscibe verification mail. You know, much like people really should have verifications mails when signing up.(

Not a very good case

[kawika]

Do you think that AudioGalaxy connects to all its partners in real time when it comes to sharing email addresses? If they generate a list for their partners every week, for example, wouldn't it make sense that it also takes at least a week to get off the list? I'm against spam but I'm also for common sense. Which this guy didn't seem to have when he gave permission to be emailed in the first place.

Re:Not a very good case

[iplayfast]

However AudioGalaxy does it, isn't really our worry. They may have a central database, that others use, or they may make a list and send it out world wide. The point is, if you've opted out, from a list, then you have opted out from the list. Perhaps the spammer, should send their emails though AudioGalaxy to be sure that the addresses are still optin.

I don't know the particulars of the case, but it seems to me, that if a company is providing an opt out service, it should work. The details are the companies problems. (but the judge didn't see it that way :(

Re:Not a very good case

[DroppedPacket]

Do you think that AudioGalaxy connects to all its partners in real time when it comes to sharing email addresses?

Good point. The question is what does the law say about how long until the SALE stops? Remember, once somebody has purchased the list, it may not be able to be revoked by the seller. In which case, you have to track down who it was sold too and remove yourself from their bright shiny new list.

And so on, and so on, and so on...

Re:Not a very good case

[Zathrus]

What a load of junk.

Did the guy receive spam the day after he opted-in? The day after that? What if it didn't start for a week? Then why should he expect the opt-out to be any faster than that?

If you bother looking at the various state opt-out programs you'll see that they're handled quarterly - if you sign up for it on Dec 31 then you'll be opted-out starting Jan 1. If you sign up on Jan 1, however, you'll need to wait until the next time the list is distributed - usually Apr 1. The dates may vary, but it's almost always a quarterly schedule.

Now, admittedly, email is a bit of a different thing from traditional telemarketing or snail mail - you don't have the lead time involved in either of those and there's no way you can claim that your computer system doesn't have connectivity. I think that for spam it wouldn't be unreasonable for opt-in/out lists to have a maximum turn-around time of 24 hours (to allow distribution to partners - even connected systems aren't going to be instantaneous).

Re:Not a very good case

[Cruciform]

They also preschedule mailouts to occur so they don't overload the mail server. So your next two or three weeks of spam may have been queued up a month in advance.

I hate spam as much as anyone else I know, but I'll give some spammers the benefit of the doubt. If a legitimate company sends me spam, then I deal with them directly if possible. It might not get me off every list a middleman sold, but at least I know that the legit company doesn't want to piss me off by sending me more junk I don't want.

And after a couple of weeks, it usually stops... just like they promise.

Re:Not a very good case

[IOOOOOI]

Perhaps the spammer, should send their emails though AudioGalaxy to be sure that the addresses are still optin.

Exactly. I used to have a job operating a fax spamming system, and we had a "blocked" database that we would run each and every batch against before it was queued. Occassionally, our queue would get up to 2 days long, so that was the greatest lag time for opt-outs.

Also, that lag time was only because our home grown system didn't have the ability to manipulate the queue. We later purchased a system that did, and that system also had an email spam ability. The point: AudioGalaxy _could_ remove opt-outs immediately if they wanted to.

Re:Not a very good case

[quintessent]

What a stupid law suit. You really do need to give them about a month. This suit just strengthens the side of the spammers (the lowest form of life).

Re:Not a very good case

[iplayfast]

A few extra weeks of spam while his customers sell my email address to the next bunch of spammers. You obviously don't get as much as I do. I've lost important emails because they were lost in a deluge of spam. After several hundred clicks of delete. Eventually you just delete them all and hope there was nothing important. Not to mention the bandwidth that my ISP has to pay for this garbage, that is going to come right back to me. I think any law regarding spam, should be backed up to the fullest extent.

Why Sprint?

[The Turd Report]

I don't see how signing up with Audiogalaxy establishes a business relationship with Sprint, but, whatever

Most likely, the agreement to opting in to AudioGalaxy includes recieving offers from third parties.

Re:Why Sprint?

[jhunsake]

If you'd had the read the article, you would have seen that it did.

what?!?!

[garcia]

Unfortunately there's not much detail in this story. A good read, nonetheless.

A "good read" has lots of details, not media bullshit. Remember that submitters and staff before posting a story please.

Re:Geez

[Eagle5596]

Pretty soon everyone in Utah is going to be getting spammed with extra wives.

Well at least then the people in Utah will find a purpose for the "Add inches onto your member!" spam won't they? :)

Seriously though folks, this ruling can't be good for us, I hope the guy appeals, the last thing we need is precident for spammers.

The argument sounds a little on the weak side too, kind of like saying "You bought a car so you established a buisness relationship with Baskin Robins"... spam is not just spam people.

Audiogalaxy/Sprint Relationship

[Anonymous Coward]

This was clearly outlined in paragraph 7 of page 83 of the AudioGalaxy Terms of Service. It's right below the paragraph outlining the rights to your lungs in case of death by bear mauling. I don't know you could miss it, it was in huge 1pt print.

Re:Audiogalaxy/Sprint Relationship

[dacarr]

Yes, and the document was stored in a file cabinet inside of a bathroom in the basement with a sign on the door that said "Beware of the leopard".

Does it really matter?

[poofmeisterp]

What does it matter if you opt-out of a mail list?
Once you've opted in, the third party can then sell your address again and you then have NO way of tracking it around.
Unless a system identical to the national "Do-Not-Call Registry" can be established for email addresses, there's not a damn thing you can do about spam in relation to opt-in/opt-out lists.

Re:Does it really matter?

[scottm52]

Not far off the mark.... However, if one state does establish a no-spam list (like the no-call lists) a HUGE impact against spammers would be felt.

For example...

1) State has "no-spam" act...
2) You get spam
3) You report spam
4) State gets enough complaints to act (not many really)
5) State AG office actually buys something, traces the $$$, gets the bank acct data.
6) State AG gets Court Order freezing the $$Bank Accts$$ until trial concludes.
7) Trial occurs or spammer settles

Result? Just a couple of these from a single state and since spammers don't know where they're sending email, they're gonna get real scared, real fast.

I only hope the Missouri No-Spam act (pending) will end up implementing an approach like this one.

Re:Does it really matter?

[poofmeisterp]

I can only hope you're right!

Re:Does it really matter?

[Eravau]

It's a good thing all the spammers are here in the U.S. where they can be stopped by a U.S. law like this.

Re:Does it really matter?

[poofmeisterp]

Well there's really only one solution... Trace and execute. I'm talking ultra-bloody here, people. :)

Re:Does it really matter?

[norton_I]

Are you saying we shouldn't try, just because it won't be perfectly effective?

If the US does this, A) it will drastically cut down on spam, and B) it will probably be a step towards lots of other countries doing the same, which will lead to C) the near extiction of spam.

Re:Does it really matter?

[Budgreen]

great system, but it's too simple, and just plain works.

it'll never pass :)

Re:Does it really matter?

[Sylver Dragon]

This sounds a lot like the California system, so far, no results. But on the up shot, the CA AG is actively seeking spam which defies the laws, and we may see some action eventually.

Linked Advertisements?

[Metallic Matty]

I agree with the comment; how does opting in for Audiogalaxy ammount to a Sprint ad?

I may be a member of the ASPCA; but I don't expect to receive credit cards in the mail as a result..

Re:Linked Advertisements?

[poofmeisterp]

See my earlier comment. Simple - they sell the address once they have it. So what if you opt-out of THEIR email list; the rest of the freaking world now has it.
Man that pisses me off.

Dangers of "Opting Out"

[TrollBridge]

I don't get a whole lot of spam, and I suspect it's because when I DO get spam, I NEVER click on the "Click here to remove yourself from our mailing list" link.

For those who don't know this already, all that does is validate that there is a user who actively checks/reads that email account. A list of valid email addresses is VERY valuable to other spammers, who eagerly shell out the $$$ so they can send you MORE spam.

So in reality "Opting out" often will only bring you MORE spam, not less.

Re:Dangers of "Opting Out"

[slamb]

So in reality "Opting out" often will only bring you MORE spam, not less.

Yes, when I get random emails claiming to be opt-out lists or that I opted in, I also don't opt out for this reason.

But this is a different situation. He opted in to a list with Audiogalaxy. A relatively reputable place, and they already knew his email address was valid because he opted in. It was a reasonable thing to do, and the spam should stop afteward. But judge apparently felt it was not practical for them to have distributed that notification to all their partners in two days, so he threw out the lawsuit. Presumably it takes them that long to distribute opt-ins also.

Re:Dangers of "Opting Out"

[deaton]

I Agree that "click to remove" just validates the email address to the spammer.

Since I started using Kmail, I just use the option to bounce the message back.

Re:Dangers of "Opting Out"

[leonardluen]

that only takes more of your bandwidth and your providers bandwidth because many spam that i recieve do not contain valid addresses

Re:Dangers of "Opting Out"

[deaton]

I'm not "replying" to the sender, I'm bouncing it as undeliverable. Just as would happen if my email address no longer exists.

It may indeed use some bandwith, I'm not real familiar with how an MTA handles undeliverable mail, and I don't do it with every unwanted message, just the most anoying and frequent ones.

Re:Dangers of "Opting Out"

[Vladimir9]

There is a flaw in your logic. In theory a spammer might gain some advantage by knowing that a certain address had someone checking it. However, that advantage is minimal because it doesnt provide any other information. It doesnt for example tell how often the account is checked. The spammer already knows that the account is active because compiling a bouncelist is a trivial matter. Because the success of spam is determined by volume of emails sent, no spammer is going to limit themselves by sending only to addresses that get checked. Therefore, once your on their list and they determine your address does not bounce you will receive the spam anyway. On most reputable sites "Opting Out" will set a flag in their database that you do not want to receive email. They dont actually remove you from their list, they just filter you out when it is time to send out emails. You dont receive the email anymore so you are happy. The point is opting out is not going to cause anymore harm than has already been done AND it might actually opt you out.

Re:Dangers of "Opting Out"

[dreamchaser]

There is no flaw in the logic. It's fairly well known that 'opt-out' links on most spam is really just a way to check and see if an email address is valid or not. They don't care if you ever read it, they just want to sell the address.

Re:Dangers of "Opting Out"

[myov]

Except that now, many spammers are sending
So they've got your address the second the mail is opened (if your client defaults to HTML mail. The only flaw in Apple's mail client).

Time to add a new filter...

Re:Dangers of "Opting Out"

[FireBook]

but in most cases it still wont actually get back to the spammer.

Re:Dangers of "Opting Out"

[Vladimir9]

They can tell if your address is valid or not by catching the bounces that result from a round of sending. They then compare the bouncelist with the original sendlist and filter out the addresses that bounced. This gives them a fairly accurate list of valid emails, which they then turn around and sell. YOU WILL BE ON THE LIST EVEN IF YOU DONT USE THE OPT OUT.

Re:Dangers of "Opting Out"

[Electrum]

For those who don't know this already, all that does is validate that there is a user who actively checks/reads that email account. A list of valid email addresses is VERY valuable to other spammers, who eagerly shell out the $$$ so they can send you MORE spam.

No one wants to mail to a remove list. There are plenty of people who will read spam and buy the products. People who want to be removed won't buy anything anyway, so there is no point in mailing them. Additionally, those people are the ones who cause trouble for spammers.

It is simply bad business to mail hostile users.

The real issue is that the minute you submit your email address to a website, it is sold to other people. You can opt out of that site, but you will still get spam from the other ten.

If you don't opt out, don't blame them if they keep mailing you.

Re:Dangers of "Opting Out"

[AnyoneEB]

I used to use the opt-out links on mails to my Yahoo account and whenever I opted-out, I'd never get any more mails from that domain, but I'd get spam that looked identical from another domain. Now I just delete all of it.

when?!?!?!?!

[Gizzmonic]

And what does a "good post" have?

Re:when?!?!?!?!

[normiep]

A good, snarky one liner.

Re:when?!?!?!?!

[asparagus]

I'm fan of hedge, but railroad ties also make good corners. Just remember to put some dry concrete in the hole so that it will 'set' properly. You don't want the thing getting loose once you start pulling the wire.

While we're on the subject, what's your opinion on barbed wire? I'm a member of the five-strand club, but a lot of people prefer the cheaper four-strand variation.

-Brett

Partners bullshit...

[Fnkmaster]

All the opt-out list systems are just encouraging businesses to set up "partnerships" solely for the purposes of exchanging direct marketing data. I don't want calls from AT&T's "exclusive partner" in marketing baubles, trinkets and bullshit. I set up a business relationship with AT&T to provide me with phone service, period. If they call me to offer a new phone plan, fine, I can tolerate that, it's within the bounds of our business relationship. If their "exclusive partner" calls to offer me baubles, trinkets and bullshit ("exclusive promotional offer to sign up with suckourballs.com"), they can blow me.

I plan on taking a stand against this personally by breaking off business relationships with companies that insist on sharing my data with their "exclusive marketing partners" and crap like that. I signed up for the Massachusetts State Opt-Out list for a reason.

Re:Partners bullshit...

[poofmeisterp]

My father tried this already. He's found it impossible to do business with anyone because somewhere in EVERY company's paperwork, there's a caluse that allows them to share your information. Even if there's a separate entry that states they will not share it, it's overridden by another section (or whatever.)
My father and I, through extensive testing, have discovered that the only lists that you can effectively opt-out of are the ones that drones gather as points of sale in stores (phone, email, address, etc.) Everything else is free game.
Even then (as was the case with Radio Shack before they changed their info gathering techniques) some companies will refuse to proceed with a sale unless you provide them with this information.

Re:Partners bullshit...

[Zathrus]

I plan on taking a stand against this personally by breaking off business relationships with companies that insist on sharing my data with their "exclusive marketing partners" and crap like that

So who are you going to bank with? What about insurance? Home loan? Car loan?

I can help you on one front at least - State Farm does not share it's data with 3rd parties. Or at least the branch of State Farm that I still have a policy with - I don't recall which one that is. It was pleasant to read through their notice to discover that, for once, I didn't have to send in the form to opt out.

But other than that? Forget it. Especially the home loan - refi my mortgage just to hope that it doesn't end up getting sold to someone that doesn't share data? That's a laugh.

Oh, there is one way to beat the telemarketers at their own game. It works best with credit card companies and their slimy offers. When they call you up to offer you some discount club membership sign up for it. Then excercise your right of return (usually 60 days). Do this a couple times and you'll be amazed at how quickly they stop offering you these fantastic deals -- it costs too much to sign someone up and then deal with the accounting on undoing it. They'll be sure to flag your data as "do not share" afterwards.

Re:Partners bullshit...

[Pharmboy]

Even then (as was the case with Radio Shack before they changed their info gathering techniques) some companies will refuse to proceed with a sale unless you provide them with this information.

Back when Radio Shack 'forced' you to give info, I would just say 'no. either put in your own info or refuse to take my money and I will just order the parts'. it freaked out many a sales rep, but I never gave the info, and they never refused to sell to me.

And since I am here (OT): What is the deal with 3/4s of Radio Shack salesmen and personal hygene? Is it just here in NC? Is a comb that hard to learn to use? Have soap prices jumped in recent years? Sorry, I just didn't know if it was a corporate policy or something....:)

Re:Partners bullshit...

[poofmeisterp]

It's not just in NC ;)
They've refused to sell to me and my father both before... strangely enough that guy got transferred to a store in the ghetto a few weeks later - no joke.

Spam is a GOOD thing

[Hayzeus]

... because in no other era could my penis have had this much correspondence dedicated to its well-being. We're living in a Golden Age, people, but none of you appreciate it...

Re:Spam is a GOOD thing

[eclectro]

Not to mention all the breast ehancements to go along with your penis improvements.

She-hes never had it so good.

Two points of note

[eaolson]

The Sprint lawyer quoted in the article says, "The purported purpose of all these statutes is mainly to stop unsolicited pornography and scams." Funny, I thought the point of the anti-spam law was to stop spam, not porn.

Secondly, without using tagged addresses, how are we, as end users, supposed to know if we've "opted in" to receiving an email? (This assumes the email in question in this article was not sent by AudioGalaxy on behalf of Sprint, but by Sprint itself to a list it bought from AudioGalaxy.) For example, if I sign up for AudioGalaxy on Monday, they sell their list of addresses to Sprint on Tuesday, and Wednesday I get emails from both Sprint and MCI. The Sprint one is "legit," the MCI one is not, but there's no way to differentiate between them.

Re:Two points of note

[BWJones]

The Sprint lawyer quoted in the article says, "The purported purpose of all these statutes is mainly to stop unsolicited pornography and scams." Funny, I thought the point of the anti-spam law was to stop spam, not porn.

Separating the two is obviously a problem wherever you are given all of the porn that surprises you as unsolicited email. However, you have to understand the obsession that people here in Utah have with porn. Until just a couple of months ago, we (Utah citizens) were paying a "porn czar" six figures to fight porn in the state when she had no real defined objective, yet in terms of per capita consumption, Utah county has the highest rate of cable porn subscription in the nation. This is in direct opposition to the majority religion's stance on the subject and a bit of a difficulty for them given Utah counties large percentage of LDS church members.

Re:Two points of note

[Planesdragon]

Separating the two is obviously a problem wherever you are given all of the porn that surprises you as unsolicited email. However, you have to understand the obsession that people here in Utah have with porn. Until just a couple of months ago, we (Utah citizens) were paying a "porn czar" six figures to fight porn in the state when she had no real defined objective, yet in terms of per capita consumption, Utah county has the highest rate of cable porn subscription in the nation. This is in direct opposition to the majority religion's stance on the subject and a bit of a difficulty for them given Utah counties large percentage of LDS church members.

Okay, call me silly--but why don't they just outlaw porn?

The same arguments for restricting topless bars, cigarettes, prostitution, et cetera should work for stopping the transmission, creation, or solicitation for sale of pornography in Utah.

Re:Two points of note

[Rary]

"Okay, call me silly--but why don't they just outlaw porn"

You're silly.

But seriously, the world really doesn't need more pointless, unenforceable laws regulating what adults can do by themselves (or with a loved one, as the case occasionally is) in the privacy of their own homes.

I do realize we're talking about Utah here, so something like that is unfortunately the sort of thing that could happen, but don't even those who are so obsessed with sex that they feel the need to attempt to erase any reference to its existence from their reality realize that law enforcement resources are better used hunting down murderers, rapists, and kidnappers of young girls than ordinary people who've been classified as "criminals" simply because somebody else has a serious hang-up about all things sexual?

Whew! That was along sentence.

Re:Two points of note

[cheezedawg]

yet in terms of per capita consumption, Utah county has the highest rate of cable porn subscription in the nation.

My bullcrap-meter is pegging. I'd like to know how you can make that claim, especially considering how secretive the companies are about their adult entertainment revenues.

Re:Two points of note

[Planesdragon]

But seriously, the world really doesn't need more pointless, unenforceable laws regulating what adults can do by themselves (or with a loved one, as the case occasionally is) in the privacy of their own homes.

But that's just it. I specifically didn't say "ownership" or "private viewing."

If Utah doesn't like porn, they should just ban cable companies, magazines, et cetera from selling or promoting porn within Utah. Those who really want it will travel across state lines to get it. (The only bug here would be a company not in Utah mailing porno into the state--which should be legal anyway, as it falls back into "in the privacy of their own home" bit.)

And as for promotion--file this between "blocking spam" and "writing traffic tickets" in priority.

I do realize we're talking about Utah here, so something like that is unfortunately the sort of thing that could happen, but don't even those who are so obsessed with sex that they feel the need to attempt to erase any reference to its existence from their reality realize that law enforcement resources are better used hunting down murderers, rapists, and kidnappers of young girls than ordinary people who've been classified as "criminals" simply because somebody else has a serious hang-up about all things sexual?

Actually, I'm a great big fan of sex--but I don't want any mention of it except from those that I'm engaging in it with, or whom I engage in conversation with it over. And doing things that are against the law doesn't automatically make you a "criminal"--some laws are simply codes, and could result in a traffic-court like fine or a FCC-like de-licensing.

Re:Two points of note

[BWJones]

My bullcrap-meter is pegging. I'd like to know how you can make that claim, especially considering how secretive the companies are about their adult entertainment revenues.

There was a big legal case where a local video store was accused of distributing porn and this was part of the findings. See this link for details.

Re:Two points of note

[workindev]

Nice try. The prosecutor in that case hired Private Detectives to get an accounting of the adult intertainment served by Hotel pay-per-view. Stop to think why this may be flawed. Lets see here, the people that stay in hotels are travelling, and thus are not from the community. All that says is that people that are visiting Utah watch more pr0n.

Oh, and from your linked article:

None of the corporate leaders of AT&T, Time Warner, General Motors, EchoStar, Liberty Media, Marriott International, the Hilton, On Command, LodgeNet Entertainment or News Corp. -- all companies that have a big financial stake in adult films and are held by millions of shareholders -- were willing to speak publicly about the sex side of their businesses.

How can anybody claim to know how much revenue is obtained from adult material in Utah when the companies selling it won't even tell?

Re:Two points of note

[BWJones]

Nice try.

Nice try? What do you mean by nice try? I am not taking sides here, only reporting the facts as seen by a Utah citizen.

Stop to think why this may be flawed. Lets see here, the people that stay in hotels are travelling, and thus are not from the community. All that says is that people that are visiting Utah watch more pr0n.

Yes but the studies included more than just hotel rooms. See even a Mormon perspective here on this link. To wit, "To Spencer's shock, they discovered that residents of Utah county bought more pornography per capita than those elsewhere. " and "But the fact is that an awful lot of people here in Utah County are paying to look at porn. What that says to me is that we're normal."

So what's the deal? Mormons are like many other people when it comes to porn. They are no different in their desires and certainly not holier than thou.

Re:You're wrong

[poofmeisterp]

I was referrin' to the average Joe, but point taken.

the article is lacking in details

[Gunzour]

From the article, it seems that this is what happened:

- User signs up on website run by company A (Audio Galaxy)
- company A sells User's email address to company B (Sprint)
- User opts-out on company A's web site
- User gets spam from company B

I hate spam as much as everyone else, but I don't see how this can violate any law. If the User opted-in, which it appears he did, and then later opted-out, Audio Galaxy can't be expected to go around to everyone they sold his email address to and say "Hey, that email we sold to you before? Stop using it!" Audio Galaxy should stop selling his email address at that point, but that would have no effect on the apparent sequence of events here.

If anyone is able to find the actual court ruling I'd be interested in reading it. I don't see where the "existing business relationship" exists (for all we know he may be a Sprint customer), but if the events happened as I listed, I don't think it's relevant.

Re:the article is lacking in details

[norton_I]

He opted in to receive promotional material from Audiogalaxy's partners. He later opted out, but still received promotional material from Audiogalaxy's partners. That is exactly how it can violate a law. Yes, I do expect them to call up everyone they sold his email address to and say "stop using it" If they are going to sell email addresses of their customers, they need to provide a way to do that, or they are being irresponsible.

However, I think there should be some room for a resonable time to process that claim, but I would say that if they can't have the email address expunged from their records and all of their "associates" (and all they way down the food chain, if they allow the list to be resold) within 2 weeks, that is unreasonable.

Re:the article is lacking in details

[lamber45]

This is on the Internet, not in the days of the Pony Express. It's understandable that some companies might sync their data-centers with their business-partners on a daily basis to take advantage of periods of light traffic, but anything less in negligent. I say 24 hours and 59 minutes out to be the time between when I opt out of a list and I get the last message related to it.

Re:the article is lacking in details

[Bronster]

I hate spam as much as everyone else, but I don't see how this can violate any law. If the User opted-in, which it appears he did, and then later opted-out, Audio Galaxy can't be expected to go around to everyone they sold his email address to and say "Hey, that email we sold to you before? Stop using it!" Audio Galaxy should stop selling his email address at that point, but that would have no effect on the apparent sequence of events here.

So every slimeball company would form a second company called "email address holdings [inc]" and immediately sell them your email address upon opt-in. From this point, even if you opt out, EAHI has full rights to keep spamming you and selling your address for ever?

I don't think anyone could sanely call that an opt-out.

Re:the article is lacking in details

[myov]

If I'm signing up with an email list from foo.com, I only expect mail from foo.com. If I want mail from bar.com, I'll sign up on their list *myself*.

If foo.com wants to sell my information, they should make this clear to me when I sign up, as I will re-evaluate if I want to sign up. If not, I consider it their responsibility to take me off bar.com's list (and whoever bar.com sold their list to)

Re:the article is lacking in details

[surprise_audit]

Yes, I do expect them to call up everyone they sold his email address to and say "stop using it" If they are going to sell email addresses of their customers, they need to provide a way to do that, or they are being irresponsible.

Personally, I don't see why they can't use the same distribution method for opt-outs as they use for opt-ins. Naturally I'm assuming that all partners are reputable and would respect the opt-out list...

And that can enforced somewhat - say a user opts out, Audiogalaxy forwards the opt-out to their partners, then subsequently gets a complaint from the user. Audiogalaxy would know which partner didn't comply and could apply sanctions accordingly. Simply withholding future lists would be easy enough, or only providing partial lists.

There is absolutely no reason why the opt-out list can't trickle through the system in the exact same way as the opt-in list - assuming the partners play fair...

Re:the article is lacking in details

[Gunzour]

If they are going to sell email addresses of their customers, they need to provide a way to do that, or they are being irresponsible.

I would argue that simply selling the email address in the first place is being irresponsible, but if their privacy policy discloses that, then it is your responsibility to choose whether or not to give them your email address in the first place.

Let's be realistic, everyone knows there is a lot of spam on the internet. If you can't take basic steps to protect your email account, such as not handing it over to companies that don't have clear, good privacy policies, you are going to get spam.

Re:the article is lacking in details

[Gunzour]

So every slimeball company would form a second company called "email address holdings [inc]" and immediately sell them your email address upon opt-in. From this point, even if you opt out, EAHI has full rights to keep spamming you and selling your address for ever?

Well, yes. How do you think we get so much spam in the first place? Spam companies already do stuff like this; it's how they weasle out of anti-spam rules in acceptable use policies.

I don't think anyone could sanely call that an opt-out.

Probably true, but the spammers will surely call it opt-out, and they will say they are "enhancing customer experience" or some crap like that by "informing them of valuable offers from other companies". How nice of them!

Re:the article is lacking in details

[Gunzour]

Then I suggest you read foo.com's privacy policy carefully before you give them you email address in the first place. If you really don't want them to sell your email address, it is *your* responsibility to make sure they won't. Be realistic: you know many companies sell email addresses, and you know that even if you expect them to take you off of their customer's lists, they won't.

False Assumptions

[dev_sda]

In the article, the sprint attorney Paul Drecksel makes this statement:

"The purported purpose of all these statutes is mainly to stop unsolicited pornography and scams," Drecksel said. "But what we find in practice is that these laws do nothing to stop those two bad acts. Those companies are here today, gone tomorrow, so lawyers can't make any money pursuing them."

Apparently Paul doesn't have enough spam to really help him understand that spam is spam, regardless of wether it comes from a large "deep-pocketed" company, or a small time bedroom spammer.

Coincidentally, his email address is pcd@pwlaw.com

Re:False Assumptions

[cindik]

Judging from how much spam I got within a day of posting on slashdot with my special slashdot email address, I'll bet Mister Drecksel will get plenty of spam at his pcd@pwlaw.com address very soon.

Re:False Assumptions

[Maserati]

It's entirely unfair of you to put pcd@pwlaw.com on a website known to be trawled (and trolled) by spammers.

Re:False Assumptions

[jlechem]

why is that? This case is bullshit and as a Utah citizen the fucker gets whatever he deserves.

"Reasonable" time

[linuxwrangler]

"Arent said her bill's language could use some fine-tuning, included (sic) providing e-mailers reasonable time to comply with requests for removal."

It seems to me that in this connected electronic world the maximum "reasonable time" for removal would be the amount of time it takes to add someone.

If you plan to share the data with your "partners" then you should be damn certain that you have a mechanism in place to effect removals from all associated databases just as fast.

This would of course only apply to time of message origination - you can't unregister on Monday and then sue on Tuesday for receiving a mail sent on Sunday but stuck in an intermediate server.

Re:"Reasonable" time

[stratjakt]

It doesnt figure.

Does sprint give AudioGalaxy read/write to their databases?

Our company has partners too, but they dont have access to our systems, nor us theirs. We share client lists with other vendors we work on contracts with. But to remove a client? We have to call everyone and talk to the account managers and so on and so on.

Not everything is bleep bleep and its done. You know that. It still takes a week to clear a personal check, even with all the shiny new PCs and ATMs.

Re:"Reasonable" time

[linuxwrangler]

I don't accept that argument. It's the veil behind which every slimy company hides: things we want do do we do - things we don't want to do are "technologically difficult/expensive/impossible/etc."

If Sprint accepts inserts then they need to accept deletes (unless the person in question is independently a Sprint contact but that's still easy to maintain). We're not talking about customers and billing info - we're talking about spam lists.

If it's "too hard" to get me back off the spam list then DON'T PUT ME THE HELL ON IT!

Setting up a lawsuit

[4doorGL]

With how quick he was to sue Sprint, I wouldn't be surprised to find out that he had some kind of plan to do this.

Why would he opt-in one month, opt-out the next, and then sue 2-days later the second he gets another piece of spam?

Seems awfully orchestrated to me.

a way to get proof

[standsolid]

buy a domain name (or get a free subdomain from someone -- whatever). I have all my email directed to one account.

so for signing up with any service i use this address

joebob-audiogalaxy@junk.foofoofoobar.com
or
jo ebob-slashdot@junk.foofoofoobar.com

and that redirects to my real email address

joebob@foofoofoobar.com

any email with To "junk.foofoofoobar.com" i direct to a spam folder. If i find a site that vlaims it won't sell my information, but magically sprint is emailing my audiogalaxy address... it tends to perk my ears up. Proof.

Re:a way to get proof

[Zlurg]

This isn't too bad an idea. Maybe we can start harvesting deliberately bad email addresses and deliberately honeypotting those who send to it and publish the list to everyone else with an idle DNS & SMTP server so they can do the same thing. Maybe we could band together and bring the 'Net to a fucking CRAWL with all our nonsene.

I'm only half kidding with this. I have an idle DNS / SMTP server, and we can make up a domain name not likely to be guessed, like dhxlwqgm.com and that way we KNOW anyone sending to it is a spammer.

Problem is, spam isn't going away. If we don't do something LEGALLY to get the authorities bought into our plight, then spammers will do something legally to insure their way of life survives. Until then, we're cutting off our own noses for the privilege of saying "You ca-ANT spam me! Neener neener nEEEEEEner! I'm untouchable; only real mail gets through to me go bug someone else."

If you want spam to stop, then want it to stop for EVERYONE.

Re:a way to get proof

[pinballer]

Good idea, but what do you do about messages where you've been bcc'd - for example some mailing lists do this ligitmately but spammers often do too. Do you blanket ban these or use further filters in these cases?

Opting Out....

[telstar]

I usually just block it instead of opting out, but I've found that SO MANY TIMES when I try to opt out, their servers never seem to respond. Surprisingly, their opt-in servers never have the same problem.

Re:Opting Out....

[poofmeisterp]

The law says they have to have an opt-out method... not that it has to work ;)

According to the Spam I get, I opted in.

[SourceHammer]

This guy wants to opt-out. I never opted-in.

Sometimes when I accidentally get fooled by the sender name and subject line, and accidentally open a spam email, the email says I opted in. At least there is a real business that can be sued in this Utah case. I don't think that the listed PO Box in Florida is really the address of the spammer, do you?



This isn't a sig, I just typed it.

Telemarketers

[stratjakt]

You have to give telemarketers 30 days to remove you from their lists when you ask. I dont see how online spam should be different.

If you opt in, and then later opt-out, and get an e-mail 2 days later, I don't see it as some great evil. You shouldnt have opted in in the first place.

You all need to chill pushing for all these spam laws, regulating the internet is a bad thing in the end. Do you really want your real name and SSN tied to your e-mail account for the sake of ending spam? (Because thats about the only solution the government will come up with).

Beef up your filters and accept it.

Re:Telemarketers

[Anonymous Coward]

You have to give telemarketers 30 days to remove you from their lists when you ask

No, you don't.
There is no provision in the law for any delay.
If they can take an order 'right now' they certainly have the technology to respect "put this number on your do not call list" 'right now' too.

If you tell them not to call (with the exact words the law calls for - telemarketers will obey the letter but not the spirit of the law) and they call again, file a complaint with the FCC. The law was just broken.

Re:Telemarketers

[oliphaunt]

Really, this is ON-topic... just not till the last point i guess :-/ This filter suggestion you have:

Beef up your filters and accept it.

is good. Your logic about the marketers needing 30 days is also reasonable. But since this is a board for nerds, I think it warrants something more involved... you want maintain control over your mailing addresses, and whether or not you recieve mail sent to them. The solutions are out there- you just need to take a few minutes to put the pieces together.

I just started using a new account for my main email address, and I'm taking this opportunity to try to break the chain of spam that I developed over 6 or 7 years of using my last address at a .edu domain. What steps am I taking? (note- of course, this is a linux-centric view. If you're using hotmail/outlook/AOL, and you're really concerned about the spam you get, my only suggestion is "find something else.")

1. Set up Procmail. If you're root, it's a little more involved... if you're not root, odds are procmail is already running somewhere on your system. "man procmail", "man .procmailrc", "man procmailex" should be enough to get you going.

2. Use Spamassassin. Once again, if you're the only user on your domain, it's more work because you have to dl/install/configure the SA program. Lucky for me, i don't have root on my mail domain, and my friendly new sysadmin had it running already- so all I had to do was set up a new procmail recipe like this one. In fact, i think i used that one, exactly.

3. Use sneakemail to generate new email addresses for any public post/contact information. Point the sneakemail account you set up to your real address. Don't ever list your actual REAL address ANYWEHRE that a bot can pick it up off the web. Don't give it out to anyone on the phone. Don't use it to send email to anyone at hotmail. Don't list it in the text on your resume or write it out in your .signature. Don't fill it in on warranty registration postecards.

#3 is the really important one- which is why i brought it up in an earlier post in this thread. You probably have another account that is getting a lot of spam right now, which is why you've read this far. So you .forward that address to your new address, where everything that comes in gets run thru procmail and SA just like any new mail. Procmail lets you set up separate delivery folders for mailing lists, so if you use Sneakemail every time you join a new mailing list, or give your address to another company online, you can direct mail coming to that address into its own folder, because sneakemail tags the "From:" headers with information as to which address someone is sending mail to. SO- to take this particular case in point, you make an "audiogalaxy" sneakemail address, and when you get spam from Sprint on the audiogalaxy address, you know that audiogalaxy sold you out. So you call them up, complain, AND THEN YOU LOG INTO SNEAKEMAIL AND TURN THEM OFF.

Re:Telemarketers

[Zlurg]

You all need to chill pushing for all these spam laws, regulating the internet is a bad thing in the end. Do you really want your real name and SSN tied to your e-mail account for the sake of ending spam? (Because thats about the only solution the government will come up with).

Beef up your filters and accept it.

Don't be an idiot. Your phone number isn't known by everyone, but someone could guess because it's a 1-in-1000 chance they could get it if they know your NPN/NXX. The gummint has your phone number if they want it. You're using the infrastructure of the country you (live in | call home), therefore expecting anonymity on said infrastructure is moronic. Telephone to your ear, keyboard under your hands: doesn't matter. You don't own it end-to-end, you have NO RIGHTS on either medium until the content thereof is removed from the safe haven of its confines and put somewhere different rules apply.

Your SSN is tied to your PO Box, it's one phone call away from your monthly phone bill, getting someone's "real" address from a PO Box costs a whole DOLLAR. Give me a break. You're delusional if you think standing up for the Internet takes away freedoms or shouts, "Ready: take your places!" through a big screen in your living room wall any more than standing up for freedom of the press or freedom from mail fraud.

Re:Telemarketers

[plierhead]

If you opt in, and then later opt-out, and get an e-mail 2 days later, I don't see it as some great evil. You shouldnt have opted in in the first place.

Yep, I reckon the guy filing suit might well be a prototypical /. reader.

"Two days to process my opt-out ? WHAT GIVES !!! Why don't you just set up a real time XML opt-out data transfer so it gets processed in less than 3 seconds ! Thats what I'D DO if it was my web site cos I'm a goddanm IT genius !!!!"

For frick's sake stop moaning ! If only all the spammers making my life a misery would even process a request like this at all !

If this guy had been rescued from the Titanic he'd have sued the rescuers for not letting him bring his suitcases on the lifeboat !!!

Common Sense

[Apple Acolyte]

For the love of God, please don't bring the government in to regulate the Internet! That's a can of worms I wrongly assumed slashdotters would decry. Common sense dictates that one company cannot be automatically beholden to another's privacy policy. Each company dictates its own terms concerning information collection and privacy. And each firm has its own opt out policy. If AudioGalaxy shares your address with Sprint, and Sprint shares information with spammer C, AudioGalaxy shouldn't be held responsible for the spam that you receive from spammer C, D, E etc. . . AudioGalaxy and Sprint could have been acting in good faith.

The majority of the responsibility here belongs to the individual. If a firm handles addresses improperly, it's the user's choice whether or not to continue using the service. No company is forcing any user to subscribe to their services. Use some common sense - protect your main address by only giving it out to those you trust, and give everyone else a separate address. That's how I keep myself spam free.

Return it Right Back

[ShwAsasin]

If the courts have decided that you've got a business relationship, could you send sprint employees mail as well with the message at the bottom which reads "This email is permitted under the terms of the court identying that Spring and ____ person have a business relationship."? Although it sounds very childish, is possible to throw it back in their faces?

Re:Return it Right Back

[adzoox]

Very interesting LA Law style tactic. Good suggestion. A local to me tried something similar. He said that our local paper was invading his private space and trespassing. He claimed that the local paper delivery boy was doing nothing more than scouting the place out for late night heists of our condo property when delivering the weekly free sampler paper.

I believe the local court ruled similarly saying that, one person gets the paper and OTHERs at my place enjoy getting the weekly sampler so EVERYONE should have the benefit of the free paper and delivery to your door. The plaintiff, after losing delivers 50 weekly samplers to the door steps of the court house EVERY week now. About two weeks ago, the city filed a lawsuit for littering. He is claiming that a few people like the repository and actually pick up the paper to read and that a few people inside get regular delivery of the paper. The weekly sampler also includes the arrests listings for Greenville County, he's claiming "informational association" - it's been entertaining to watch.

No way of tracking-- unless

[oliphaunt]

Unless you use sneakemail. Whenever I encounter a webform where it seems like I need to provide a valid email address, e.g. to recieve a tracking number or an initial PIN code or some such thing, I just pull up sneakemail, create a new address, label it with the date and the party who is getting the initial address (March 14 03, audiogalaxy).

That way, if audiogalaxy sells that address to someone else, not only do I know where that someone else got my address from and (approximately) when it must have happened, but (and this is the important part)

I CAN CUT THEM OFF
Sprint can send as many emails as they want to the address from audiogalaxy... that address is no longer valid, because sneakemail let me kill it.

yes, i'm a paying subscriber, and i've been using it for about 2 years now.

Re:No way of tracking-- unless

[IOOOOOI]

Even better... run (or find an email provider that runs) qmail. Create a .qmail-default file. Then, when you fill out a form somewhere use youremail-identifyingstring@blah.com.

Not only will you be able to track who sold you out, but filtering becomes trivial.

Re:No way of tracking-- unless

[zerocool^]

Or, just use the virt user table in sendmail. Create a new alias everytime you give out an address.

Michael strikes again

[poot_rootbeer]

I don't see how signing up with Audiogalaxy establishes a business relationship with Sprint, but, whatever.

I don't see how being a Slashdot Editor gives you justification for attaching your comments to the story submission instead of leaving a comment like everyone else, but, whatever.

Time, I think, to go to Preferences and banish Michael to the bit bucket. I'm sure Jon Katz would be glad to switch places with him.

Re:And...

[dev_sda]

What lesson would that be? Thats my special public email address anyways. Just collects spam to be used for my filters and hopefully result in a few unsolicited spam lawsuits.

Thanks for the help!

It's a matter of time.

[whoopass]

The judge was 100% correct. The technical part of what is happening is that site P (Provider) gets your email address and adds it to it's database.

Site P's database is sold to company B (Broker) on a monthly basis. Company B replicates the information from the database once a month on a given date.

Company C (Consumer) buys the rights to send email to company B's list once a month.

If then you request not be be spammed from site P a month later, you must not expect that this change will be reflected immediately in Company B's database.

This kind of sucks

[Trolling4Dollars]

As much as it would have inconvenienced this guy to have to go through the process of opting out and then just waiting to see if it worked, it would have gone a long way to validating his case. If he was, indeed recieving mail from the people he intended to opt out from.

What did bother me about the article was that they somehow seemed to make a distinction between unsolicited commercial e-mail and commercial e-mail from third parties whom you've had contact with. I think what bother me about it is that opt-out only works for people who read the contract/agreement/license they are OKing. the problem is that (as they well should know), NOBODY ever reads this stuff. That's why old people will always get scammed by people selling things they "need" or the computer illiterate who buys into CD-ROMs purported to teach them how to use a computer.

What is really needed is a blanket non-commercial sign up list which basically says:

"I do not wish to receive any commercial solicitations of any kind (electronic, published, etc...). This applies to opt-in and opt-out lists as well as unsolicited ads. For any, and every bit of communication that I recieve of this nature, I will charge no less than $25."

But that would never happen since it stomps over what people percieve to be the American Way: "Profit at any cost or inconvenience to everyone else".

Oh well... hopefully someone will come up with a more interesting case in the future.

Denver Snuffer

Here is the scoop

[.....]

The basic facts in the article are right: Gillman opted-in to GroupLotto's list to receive stuff, then some time later opted out. A day after he had opted-out, a received an email from Sprint, an GroupLotto "partner". Gillman sued.

Sprint moved for summary judgment on four grounds:
1. Sprint itself did not send the email
2. The email was sent unitentionally
3. Gillman had consented to receive the email
4. Gillman had a preexisting relationship with Audiogalaxy that made the email not "unsolicited."

The court decided as follows:
1. The law defines the spammer as either the sender, or the one who causes email to be sent. So Sprint is still a spammer.

2. This argument calls for a factual judgment, so it isn't appropriate to rule on as a matter of law.
Sprint basically said that it was GroupLotto's fault that it was sent -- Sprint only wanted to send to opted-in people. Thus the sending was unintentional. However, there are several issues about what the different parties obligations are, so this claim was rejected.

3. Sprints third argument was also not suitable for summary judgment. Sprint argued that at the time Sprint contracted with GroupLotto to send the email, Gillman was opted-in, and had therefore consented to receive the spam. This argument was partially based on a "two-to-three day" unsubscription time that Sprint claimed was standard -- Gillman could not have expected that he had opted-out until several days had passed. However, there was no such temporal disclaimer from GroupLotto, and it was granted that Gillman had unsubscribed by the time the email was actually sent. This issue of fact was unsuitable for summary judgment. Therefore, it is explicitly undecided if the fact that the email was "in the pipeline" when Gillman opted-out makes it spam or not.

4. For this argument, Sprint argued that Gillman had a preexisting business relationship that made the spam not "unsolicited." Unfortunately, they were right. The Utah law reads as follows:

"commercial email is not 'unsolicited' if the sender has a preexisting business or personal relationship with the sender."

The law makes no provision for discontinuing a business relationship. Thus, you have a "preexisting business relationship" with *anyone* you have ever done business with under the Utah law.

The judge noted that this is probably not what the legislature meant, but still, she was constrained to follow what they actually passed into law, not what she thought they meant.

There were a few other problems with the case, but that one flaw was enough to grant summary judgment.

Re:Here is the scoop

[PigleT]

"commercial email is not 'unsolicited' if the sender has a preexisting business or personal relationship with the sender."

Yeah. That's naff, alright. In this case, from what you say, it raises the whole question of what to do about bastards who sell your name on: you don't have any direct business relationship with them, so you can't have opted in... hmmmmm.

"but still, she was constrained to follow what they actually passed into law, not what she thought they meant."

Pretty pathetic, if you ask me. There I was, hoping judges and legal systems were designed to uphold what was *right* rather than what was *written*...

Spam Is Like Junk Mail

[Not The Real Me]

Sometimes, doing a blind mailing is the only way you are going to get customers. This applies to snail mail as much as e-mail. Much like junk snail mail, if you don't want it, trash it.

Opting out should always be included with spam.

Europe's solution against spam

[D4C5CE]

There are ways to get rid of spam without banning all business eMail (or reinventing Yet Another Mail Transfer Protocol to include billing or authentication) - simply make sure that senders

• do not trade address lists
• do not disguise
• have to honor opt-out requests immediately

If the companies you do business with are trying to make extra money on your data, lawmakers will have to make sure this happens only on terms that protect your privacy.

What worse do spam advocates want to wait for? To have their own Blackberry pagers rendered useless as Herbal Whatever, Nigerian Scams & Enlarged Everythings etc. get advertised 800 times a day even to everyone working on Capitol Hill?

Europe also did not react until damage figures had reached the $10 billion mark, but then this is what they finally came up with (Attention: Legalese@length ahead):

Directive 2002/58/EC (excerpt)

(40) Safeguards should be provided for subscribers against intrusion of their privacy by unsolicited communications for direct marketing purposes in particular by means of automated calling machines, telefaxes, and e-mails, including SMS messages. These forms of unsolicited commercial communications may on the one hand be relatively easy and cheap to send and on the other may impose a burden and/or cost on the recipient. Moreover, in some cases their volume may also cause difficulties for electronic communications networks and terminal equipment. For such forms of unsolicited communications for direct marketing, it is justified to require that prior explicit consent of the recipients is obtained before such communications are addressed to them. The single market requires a harmonised approach to ensure simple, Community-wide rules for businesses and users.
(41) Within the context of an existing customer relationship, it is reasonable to allow the use of electronic contact details for the offering of similar products or services, but only by the same company that has obtained the electronic contact details in accordance with Directive 95/46/EC [i.e. the General Data Protection Directive]. When electronic contact details are obtained, the customer should be informed about their further use for direct marketing in a clear and distinct manner, and be given the opportunity to refuse such usage. This opportunity should continue to be offered with each subsequent direct marketing message, free of charge, except for any costs for the transmission of this refusal.
(42) Other forms of direct marketing that are more costly for the sender and impose no financial costs on subscribers and users, such as person-to-person voice telephony calls, may justify the maintenance of a system giving subscribers or users the possibility to indicate that they do not want to receive such calls. Nevertheless, in order not to decrease existing levels of privacy protection, Member States should be entitled to uphold national systems, only allowing such calls to subscribers and users who have given their prior consent.
(43) To facilitate effective enforcement of Community rules on unsolicited messages for direct marketing, it is necessary to prohibit the use of false identities or false return addresses or numbers while sending unsolicited messages for direct marketing purposes.

(47) Where the rights of the users and subscribers are not respected, national legislation should provide for judicial remedies. Penalties should be imposed on any person, whether governed by private or public law, who fails to comply with the national measures taken under this Directive.

Article 13
Unsolicited communications
1. The use of automated calling systems without human intervention (automa

spam forum

[dirvish]

Check out this new forum for discussing spam: http://antispamist.dyndns.org/forum/index.php

This NEVER happens on slashdot

[spells]

Perfect for a Friday. Somebody calls bullsh*t and the original caller actually posts a link backing up his claim!
Doesn't he know he's supposed to say - I'm too busy right now, but if you do a google search on Utah sex...

Re:Geez

[Maserati]

"I hear chopping, but I don't hear digging..."

Two days?

[John Harrison]

First off, hooray to the submitter for slandering the entire state of Utah. We need more of that on /.

Those of you who read the article will note that the guy asked to be removed and then two days later got "spammed" by Sprint. Two days is not enough time to be removed. This is something he signed up for. It doesn't mention if he continued to receive spam afterwards.

The truely annoying spam is the spam that you never sign up for. Where your email address has been snatched by a spider and there is no way to unenroll. That was not the case here.

This was simply a bad test case.

Re:Two days?

[clonebarkins]

No, you misread it. He never signed up for Sprint's email. He signed up for email from another company, which then sold his address, along with others, to Sprint.

As for how long it should take to be removed from a systematic email--it should be immediate, or at least within the same 24 hours. It is so easy to provide a "reply to this email with the subject 'remove'" message in the email that's there's no reason companies shouldn't be doing it, or some other method such as providing a link to an opt-out HTML form. And this can be set up as an automated process to update any databases real-time. In fact, for those states that have spam laws, perhaps folks could suggest that to their legislatures. In addition, if a company sells my email address and I later opt-out of their email program, then they should be required to inform those companies they sold my address to that I no longer wish to receive such emails. I should not have to track down Sprint to have them stop sending me emails because if I never signed up for them in the first place.

Re:Two days?

[John Harrison]

I didn't misread it, but the point you bring up is relevant. The list was sold to Sprint. If there isn't an infrastructure in place to delete unenrolled adresses from the DBs of all the companies that have purchased the list then there is no way that his name could have been taken off in two days. Even if there were such a system it would probably only run twice a week. Certainly not instantly. What do you think the odds are that such a system is even in place? I would be shocked if one exists.

Given that this system exists only in my imagination I agree that there should be a link to an opt out form included with any legitimate business spam. Yeah, he would have to opt out of the Sprint list (even though he didn't sign up for it directly) but that isn't so terrible. That process should be instantaneous and permanent.

You are right that you shouldn't have to track Sprint down, but again, this was a bad test case. If he were still getting spam two months later his case would have been much stronger.

Also, legitimate email lists that you sign up for (and he did sign up for this, though not from Sprint directly) are not where the spam problem really lies. It is fly-by-night unprofessional, non-corporate email grabbers, most of whom seem to be trying to sell me email adresses.

Re:Two days?

[clonebarkins]

The list was sold to Sprint. If there isn't an infrastructure in place to delete unenrolled adresses from the DBs of all the companies that have purchased the list then there is no way that his name could have been taken off in two days. Even if there were such a system it would probably only run twice a week. Certainly not instantly. What do you think the odds are that such a system is even in place? I would be shocked if one exists.

I agree: I'm sure such a system doesn't exist, and if it did, then you're probably right that it would run at some interval greater than a day or two. I guess part of my problem with the whole thing is that, how would a person know that Company Y got their name from Company X? There isn't any way, unless you go through a whole slough of "customer service" representatives. So to say that the guy didn't give Sprint enough time isn't really valid, in my opinion, since he had no way of even knowing that Sprint had gotten his email address "legitimately". To him, it was unsolicited.

I pretty much agree with your reply, so there's not much more to say.

Not exactly.

[guardian-ct]

To extend the analogy a bit... I don't normally receive 40 junk snail mail messages at random times each day, with all of them appearing (or claiming) to be "important". Nor do they tend to include envelopes mentioning body parts that most people only talk about to doctors and really close friends.

The only good part of junk snail mail is that it can be used as fuel for a properly modified wood stove.

Opting out of snail mail spam has had the effect of greatly reducing the amount I receive.

Opting out of email spam has had no noticeable effect on the amount of email spam I get, other than possibly increasing it.

See the difference yet?

Re:Utah: OK to marry a 14 year old, but no porn?

[swb]

The LDS church has *recently* taken a more public stand against polygamy, but the fact that its so widespread (a recent NYT article suggested 10s of thousands in Utah are in polygamous marriages) indicates that church "opposition" to it has been muted for a long time. The recent Elizabeth Smart case will focus some rather unpleasant publicity on LDS practices and attitudes, even if they aren't "official."

Besides, as a parent poster noted, they had an anti-porn czar. If polygamy is so bad, why wasn't there an anti-polygamy czar? Sounds to me like it was more ignored or looked over than actively banned.

Something to try:

[interstellar_donkey]

Not that it's worth anything, but who knows. When I get spam from a reputable company, I typically try to find their customer service email address and send them this little form letter. I doubt that it does any good, but if enough people showed the larger corporations that we don't want spam, perhaps the meat and potatoes of the spam mailing list scumbags would be dropped just a little.

Dear: Company

Today I received an unwanted, unsolicited email from your company (spam). I always believed that your corporation was honest and forthright, and it is beyond my comprehension why you would decide to set yourself alongside pornographers and scam artists by using unsolicited spam email.

Regardless of what your spam mailing company has told you, I have never consciously 'opted in' to receive email from them, you, or any of their partners. They have either gained my 'approval' using deception or trickery, or they have simply lied and found the email address somewhere on the Internet. In either event, I have never, nor will ever want to receive unsolicited spam email. In other words, I don't want to get this type of mail. Ever. And I have never actively asked to receive it.

Spam mailing companies such as the one you use are corrupt and crooked. These are not honest businesses. And I cannot with good conscious do business with any company that chooses to partner with near criminals to conduct marketing. As such, I will not do business with you until you stop associating with these shady organizations.

Please do not forward this to your spam mailing list provider in a show of 'good faith' to 'opt me out'. All this will do is inform them that this is a valid email address, and place me on numerous other mailing lists. Like I said, these are not honest business people. If you doubt this, ask them exactly where and where I 'opted in' to get this junk. Ask them why they often use different and misleading domains to get around my 'block sender list'. They will be unable to provide you with an answer, because I have never actively 'opted-in', and they will try every trick in the book to get their junk through. Again, this is because they are dishonest.

If you decide to stop using this sort of unethical marketing, please inform me. I would be more then happy to continue doing business with you.

Re:Something to try:

[meringuoid]

Please do not forward this to your spam mailing list provider in a show of 'good faith' to 'opt me out'. All this will do is inform them that this is a valid email address, and place me on numerous other mailing lists. Like I said, these are not honest business people. If you doubt this, ask them exactly where and where I 'opted in' to get this junk.

Otherwise excellent and bang on-message, but I suspect this bit needs some more thought. Company C are to ask spammers S when and where recipient X opted-in, but in doing so they must not divulge the identity of X. How, then, even if S is running a fully correct confirmed opt-in system, are they ever going to be able to answer?

you're still not getting it

[sirshannon]

Spam filters, certain ISPs, hotmail, etc, will often just delete mail, not bounce it. With no bounce, they just know it didn't bounce and will keep using that address. however, when you click the opt-out link, (or even open some emails that have images tied to dynamic pages) you just verified with 100% certainty that they have found a real, in-use, and monitored email address.

Re:you're still not getting it

[Vladimir9]

If a server doesnt generate a bounce message then it is not compliant with RFC 821. Most mail servers follow the RFCs, because if they dont they can be blacklisted. There is a valid reason for a server to generate bounce messages after all. Hotmail for example definately generates bounce messages. Check it yourself.

Re:you're still not getting it

[Batou]

Where do you think it goes if it bounces? That 'reply-to' tag is a sure bet to be made up and non-existent.

Even if it does bounce and go to a real return address, do you really think that anyone's processing the bounces and removing them from the mail database? When they're sending millions of these at a time? It's a little hard to automate this unless you own the mail server that's receiving the bounced mails. Next to impossible to do with a throw-away hotmail account.

Re:you're still not getting it

[Vladimir9]

Most bulk mailers let you set the "reply-to". You can send the bounces wherever you want. You can then use something like this to automate the bounce handling. It will retrieve bounce messages from any POP account.

I bet someone else had this idea before...

[perlchild]

But doesn't that "SCREAM" that selling "email-based permission" lists illegal?
After all, if business A sells your email address for 2.95, and business B sells it to C for 5.95 and business C does something illegal with it, how would business A sue business C for illegal use? It can't, and that places the burden on the customer. But since you can't limit WHO they sell your "permission to" (obstruction of commerce) that means you're writing them a blank check, with little to zero chance of ever having your rights respected. (the amount of spam makes prosecution for a single spam unlikely in the extreme) YET each spam is an individual crime, that must be investigated seperately.
There is also the question of just how "valid" the permission you gave to A for purpose X be translated to C for any purposes other than X... And with X usually being "promotions related to a product I bought" X is of little sale value to C... purpose Y is however, very valuable... Hence C wants to buy address "blue" from business A, for purpose Y, now if purpose Y wasn't known at the time permission was given, how can permission be considered to have been given(say permission to advertise an invention that didn't exist when blue gave permission to A)?
Doesn't the burden it places on the victim(the person whose rights have been abused, by receiving mail whom in most other contexts would be considered illegal) signify to legislators that

1) to properly track when a permission is given, when most spammers close up shop within a few days and just reappear with the same list, under a different company, require an independant registry of permissions?
2) to be able to correlate permission with origins of spam, you require to be able to track the origin of any single email message. By that reasoning wouldn't sending a message with forged header be considered illegal until proven otherwise(a bit like how a radar detector or any other device that allows one to bypass enforcement of a law illegal)?
3) Since permission would have to be tracked by purpose and by sender, shouldn't access to that single registry be paid for to cover administration costs? And once headers are fully considered thrustworthy again, shouldn't it be possible to bill per spam sent?

I think those are all valid questions, that the legislators should consider

Re:I bet someone else had this idea before...

[cindik]

It's been a long time since I took algebra, and I'll admit I got a little lost in the A B C...X Y Z of your post.

I remember reading AudioGalaxy's agreement saying that selling the list is how they support their service. Unless legislators want to make it illegal for me to enter into such an agreement, these agreements are going to be around.

Here's the thing: If you give me permission to sell information about you, and I sell it to someone who does something illegal with it, am I complicit in the illegal act for selling the information? Are you complicit in the crime for agreeing to let me sell it?

Re:I bet someone else had this idea before...

[perlchild]

Considering how hard spammers make it to track who I gave permission to(hint... it doesn't matter how little permission you give, people are going to take a lot) I'm saying that unless audiogalaxy SENDS all those emails for all those people, how can I know who they gave it to? Unless they PROVE they got my permission from audiogalaxy(in the original spam of course, so if it's false, into the spam bin BOTH go)
then they are misrepresenting their commercial intent, which was a felony in most countries last I checked... I'm not saying audiogalaxy can't get funding that way, I'm saying the burden of proving that email is spam shouldn't be on the receiver, because the receiver pays the connectivity, and therefore the bill.
The spammers are sending me a bill to pay, which I can only contest by generating an activity that makes me pay more...
Talk about a circular loop.

As for complicity in a crime for agreeing to sell it... if it's illegal to sell a "permission based marketing target" then it's also illegal to sollicit permission to resell an address.

Hence, we go back to I gave my permission to audiogalaxy, if anyone wants to use that permission, they have to use audiogalaxy's mail server, and clearly state that is how the spam got to me.

The other part of the solution

[smcv]

The other part of the solution is data protection law - as with the parent post, this is a European Union law, meaning it applies to governments and not to individuals (the EU law is like a specification, EU governments have to impose laws that "implement" it).

Google for "Data Protection Act 2000" to see the UK's version, which came into force in 2001 (an earlier version, which was a bit less restrictive, has been around since the early 90s) and places specific restrictions on storage and use of "personally identifiable information". As far as I can see, this makes trading e-mail lists without specific permission illegal - it also has other nice effects, like preventing companies from sharing any other information they've gathered about you without your permission. (So your bank can't tell any other companies about your spending without your permission, for instance.)

The USA doesn't have a similar law, which actually means companies in Europe aren't allowed to send personal data to their American branch without the subject's permission.

SPAM from or for a reputable company...

[Kjella]

...the problem with this is that if your approach becomes common, you can "anti"-spam your site. If you own foo.com competing with bar.com, simply send out lots of spam for bar.com. Since they won't know jack shit about the spam, they won't be able to prove anything one way or the other, causing customers to move to foo.com instead.

The key issue is, you need to get to the senders. Punishing the company will eventually lead to wrong conclusions if the spammers are smart enough.

Kjella

Re:Geez

[Guppy06]

Think about all the use a polygamist would have for a penis enlarger, though!

NO! It's like junk faxes!

[Xtifr]

Junk mail is paid for by the sender; spam, like junk faxes, is paid for by the receiver (directly or indirectly, though higher ISP bills). This is why junk faxes were made illegal, and its why spamming should be illegal.

I'm always glad to see junk mail, because I know it means that someone out there is helping to fund the post office, and making it cheaper for me when I want to send snail-mail myself. I'm furious as hell when I see spam, because I know it means that someone out there is costing my ISP money, making it more expensive for me to be able to send email.

Re:NO! It's like junk faxes!

[Xtifr]

Spam legislation will never work.

The junk fax laws haven't been 100% either. But it would certainly result in a huge reduction in spam.

A lot of my spam already comes from overseas. Either someone has found an open relay in Asia

Which is irrelevent; a red herring. If a junk fax is sent from a company with a business presence in the US, that company can be sued, even if they actually sent the junk fax from their Tokyo offices. Granted, they wouldn't because of long-distance charges, but the point is that if they did it still wouldn't help 'em.

or the spammers themselves are international.

That's more of a problem, but as I said above, if the company has a US presence, then they can be held liable in US courts. So we'd be limiting spam to companies which are entirely outside the US. And since most spam comes from the US (whether or not it's bounced off of asian relays - something they do only because asia has more open relays), and anti-spam law could cause a huge reduction in spam.

Note that I'm not advocating that we only use a legal approach here. I simply think it's a good idea to use a multipronged attack.

Obviously anti-spam laws aren't going to stop people who are already breaking the law (frauds and scams), but it will kill the business of the professional spammers (who lure small companies into believing that spam will earn them tons of money), and that can be nothing but a Good Thing. The amateurs aren't anywhere near as good at disguising the origin of the spam, or devising ways around filters and blocks.

we're talking about spam

[sirshannon]

you send me a spam at my hotmail address and you will not get a bounced message. Your message may or may not get to me, though, it depends on my filter rules. You send an email to me at my aol account and you prolly won't get a bounce message, more or likely, but I won't get your email.

Compliant? Who cares? I'm talking about the real world.

Re:we're talking about spam

[Vladimir9]

Not sure what your trying to say here. Yes, if you send an email to a valid address it does not bounce. It is a valid address!!! The filtering is secondary. All the filter does is hide it.

The point is spammer wants their database to be as big as possible. The only addresses that will be removed are invalid ones. They dont really care about your filtering.

Uninformed irrationality

[thefinite]

I'll bite Troll.

First, a full text search of Utah Code Annotated only pulls up the word "anal" in reference to children and rape. I assume those aren't the laws you call screwed up. Show me the law you are talking about, because I don't believe you.

Second, A full text search of all Utah state and federal cases brings up *not one result* for Universal Life Church, which means no case was tried involving it. The same for a full text search of Utah Code Annotated. Again, I don't belive you, so you will have to show me.

Finally, if you read the article and other posts here about the case, the reason he lost is fairly reasonable. Also, the clause exempting a previous business relationship is found in other state statutes, including Colorado, Delaware, and Ohio.

While your claims about Utah law are so far entirely unfounded, the message your post is stating pretty clearly is that you have some sort of emotional objection to Utah and the people there. I suggest you get over it, but the least you could do is verify your misinformation before spreading it around.

Give me a break!

[redgekko]

Actually, I think the bigger issue is that most companies hire out third parties to spam their mailing list.

For example, some of my web design and hosting customers pay me to send out their newsletters (strictly opt-in). Say company X sends me their newsletter and mailing list on Feb 25th to be mailed out on March 1st... if somebody decides to opt-out on Feb 28th, they're still going to get the March newsletter because I don't maintain the list.

I think it's only fair to give companies a few business days to sort things out in an opt-in/opt-out scenario, as outgoing mail may already be in a sense "queued".

Let me also head off any insistance that the large spam brokers be responsible for handling the opt-out requests and maintaining a live database: this service usually involves large setup fees, and the client may not want to get married to one spam broker right away... so they will often send a static mailing list for a one-time mailing instead.

I personally think it's rediculious that this article even found its way onto slashdot. For chrissake, it might have taken two full days or more to process a single LARGE mailing list if they are contending with SMTP flood thresholds at large ISPs with lots of opt-in subscribers. You can't just rapid-fire 10,000 emails to MSN accounts from one server and not expect to get your IP blocked! Infact, most companies even tell you when you opt-out that it may take a few days before you stop receiveing emails.

Now, watch me get modded down by the idealist slashdot spam nazis for having a potentially unpopular opinion.