Michigan's Proposed Spam Law Called Toughest In U.S.

goats_in_boats writes "A new bill (PDF or HTML) was presented to the Governor of Michigan that would require spam sent to residents of the State to be identified as such. Highlights include the requirement that unsolicited email 'Include in the e-mail subject line "ADV:" as the first 4 characters' and that 'a person who violates this act is guilty of a misdemeanor punishable by imprisonment for not more than 1 year or a fine of not more than $10,000.00, or both.' An article in the Detroit Free Press calls the bill 'the most stringent anti-spam law in the nation.'"

Comments

Out-of-state

[phorm]

How does this apply to out-of-state offenders Vs in-state recipients, or in-state offenders Vs out-of-state recipients. I've never really figured out how US law works... too many different states with local discrepencies :-)

Would sure be nice if you could nail any spammer from anywhere in the US if you're a Michigan system... I bet it'd be a good place to set up an email server too.

How is "unsolicited" defined?

[autopr0n]

Well, I have to say I finally got a Bayesian Spam filter when the Outlook plug in came out so, for now, it's like back in the days when no one knew my email. Only 1 in 20 spams scores less then 98%, and only one in a hundred regular messages score more then 3%. It's fantastic!

That said, I'd still be for this law, as long as it was fair. That is to say, if the sender had a 'reasonable' expectation that the person expected to receive mail from them (i.e. opt-in, or if you signed up for a service from them and never opted out). Similar to the 'business relationship' in the Telemarketing laws.

One important thing is to make it clear that you can't sell "lists". I've been sent spams that said "Cd of Opt-in emails" or whatever. It's like, come on. I don't know if I would want to send people to jail for screwing up like that. Jail and very harsh Spam fines should be reserved, IMO for habitual offenders, you know the lowest of the low types like Ralsky, etc, who relay and proxy scan, forge headers, etc.

Re:Props!

[cookiepus]

I wonder where spammed pick up your e-mail addr.

This is just a disguised opt-out proposal

[pslam]

This is not a good thing. Oh yeah, everyone can simply filter out by "ADV:" - like that'll stop people actually sending spam, stop the enormous bandwidth usage (the majority of email is spam for some ISPs), and make the whole practise less attractive. On the contrary, I expect nothing less than the big spammers sending even more, and when their ISPs turn on them they'll sue with reference to the legitimacy as written in law. I expect no less than every single business in the afflicted states sending you endless amounts of spam. After all - it's legal, so it must be ok. The boards of directors can sleep well at night, marketing can happily smoke some more crack, and the only people with a frown on their faces are the few who remember a time when you didn't fuck with the beautiful creation that was the internet and the people that inhabited it.

Don't believe the hype - it's just another opt-out proposal. Opt-out is a flawed scheme only ever pushed by people who are naive to both the technical and practical issues. It's an enormous waste of resources (bandwidth, energy, people's time), and at the end of the day it's only partially solved just one of the issues at the expense of ensuring that we'll never solve any of the others. This really is a case of "the slippery slope exists and it will happen".

Like all the other opt-out schemes, all you have to do is opt-out of those 50 million emails you're about to receive. Legitimately. Enjoy your day.

Re:Most spam uses a forged sender address

[RT Alec]

Section 4 of the bill covers this:

• (a) Use a third party's internet domain name or third party e-mail address in identifying the point of origin or in stating the transmission path of the commercial e-mail without the third party's consent.
• (b) Misrepresent any information in identifying the point of origin or the transmission path of the commercial e-mail.
• (c) Fail to include in the commercial e-mail the information necessary to identify the point of origin of the commercial e-mail.

I think it is essential that these sorts of requirements be part of any anti-spam bill. While requiring that the header contain ADV: is nice for the user, what about the operator of the user's ISP? And in particular, what about the operator who runs an honest ISP, does not allow relaying through their servers, yet still gets overloaded with incorrectly directed complaints when a spam shop uses their domain in part of the forged headers? I don't see nearly enough attention paid to that concern (disclaimer: I operate an ISP).

Re:Can this be effective?

[Hao Wu]

A commercial is a commercial. I don't care if you're selling deoderant, furniture, or penis enlargement pills. I want none of them on my property or obstructing my view in any way.

If you with to place them peripherally, that's a legitimate ad. If it's directly in my line-of-vision when I'm trying to do something like check email or sort through my snail mail, then you are asking for a retaliatory response from me. This law is one such response.

Re:the detroit free press and fearmongering.

[timeOday]

and that's the basic tone of the whole piece: spam is a trojan horse rolling sexual material into the living rooms of godfearing, wholesome americans.

Which part of the above do you disagree with?

..if it's enforced

[Happy go Lucky]

There's a good reason why this was written as a criminal statute rather than civil. Good for the spambags, anyway.

A criminal statute allows for jail, true. However, only one class of people can actually file criminal complaints: law enforcement. Peace officers and prosecutors.

You can call your local police department to make a complaint. However, except for certain types of crimes (Domestic violence and protective order violations in my state-most are similar) there is no law prohibiting us from sending the complaint straight to the shredder. As a point of Federal law (Federal district court ruling for WA DC, sustained on appeal) the police and prosecutors do not have a duty to any one particular person.

In other words, not much will change. A few cases may be filed. Most, however, will end up sitting in some detective's inbox until the statute of limitations expires. My department doesn't even have enough detectives to cover all of the stuff that needs detective followup: if a burglary/auto theft/just about any nonviolent property crime isn't thoroughly handled by the patrol officer taking the initial complaint, it'll languish marked "inactive-open pending leads" forever. The info-hogs can only follow up on the leads in the bluesuits' reports.

Now, take a wild guess how many patrol officers are qualified to handle these. I may be the only one here. And I spent today (a relatively quiet Monday dayshift) taking cold crime reports, three neighborhood disturbances (two of which weren't even criminal and one was petty enough not to charge anyone with anything) one unwanted subject (started screaming in a McDonalds and didn't leave when the manager invited him to eat elsewhere) and a drunk driver.

When I work swing shift, my normal shift, I'm running from call to call to call. It'll be close to midnight before I have time to follow up on a funny email. I think my time from 11 PM to end-of-shift is better spent on drunk drivers.

In other words, most cops will consider this to be a waste of time that could be better spent on areas where someone might actually get hurt.

That's why it's CIVIL spam laws that actually matter. The clown who wrote this law knows we won't be able to really do much, living in the real world and all. A civil law, OTOH, with a private right of action, would make the spammers shit themselves with fear and consider career changes. That's because a victim with the legal power to act may actually do something, when the police don't have the resources.

Some will complain that it's not their responsibility to do anything, even when the whiner is also the original victim. Who has the moral responsibility to act is an open question. However, the real question IMHO is 'if you don't give a shit, and you're the victim, then why should I care?' And if someone can't be bothered to take an interest in his own life, then I've got better things to do than fix his minor annoyances for him.

Spam is a growing problem

[gvc]

I've had the same email account for 20+ years. Two years ago, spam was a minor annoyance. One year ago it was annoying enough that I started using spamassassin. This year it is annoying enough that I can cope only by using spamassassin with a bayes filter. Next year?

Let me quantify my statements. In June 2002 I received 732 legitimate email messages and 375 spams. In June 2003 I received 683 legitimate email messages, and 1872 spams. in June 2004, I expect to receive 700 legitimate messages; how many spams? Let's start a pool!

Technology is cool but not a panacea. I ran a personal version of Spamassassin 2.60 on my last 15 months' email. Every decision was fed back into the automatic learning process, and every incorrect decision was corrected manually. Here are the numbers:

total legit: 13726
total spam: 11441
false positives: 11
false negatives: 272

These numbers look good (2.3% of spams slip through under the radar and 0.08% of legit mail gets trapped). But they aren't that good. The numbers mean that one or two spams a day get through right now, and who-knows-how-many next year. Hardly an adequate approach to keeping offensive material from my eyes. The numbers also mean that I would have missed 11 legitimate messages in the last year or so had I not sifted through the crap.

While I'm not holding my breath for a legislative panacea, I believe that something has to be done to check the uncontrolled growth in the volume of spam being sent. Receiver-end controls won't cope.

As I have mentioned in a previous comment, I believe that the volume can be abated by prohibiting deceptive email, as opposed to trying to adjudicate the consensuality of the relationship between sender and receiver.

Why this won't work (an example from Japan)

[achurch]

Aside from the significant limitation imposed by this being a state law (who can tell if a particular E-mail address belongs to a Michigan resident or not?), this law will likely fail because as soon as users (or providers) start to filter ADV:, the spammers will stop putting it in the Subject line, and there are too many of them out there for law enforcement to go after.

Japan enacted a law similar to this in July of last year, requiring that all UCE have a subject beginning with the Japanese equivalent of "ADV:". Spammers started following the law pretty quickly; so far so good. Then, last October, cell phone provider NTT DoCoMo started up a service that would let users reject such mail at the server. Having been subjected to lots of cellphone spam until then, I was very delighted at this, and as soon as I switched it on my spam level dropped to roughly zero.

Until this past May, when spam once again found its way to my phone. The spammers seem to have realized that adding the mandated text makes their mail not reach its destination, so they've decided to just ignore the law completely. I spoke with someone at the agency that handles spam complaints, and was told that "we're doing what we can, but there are so many of them it's hard to keep up."

C'est la vie, I guess--or should I say, shikata nai desu ne...

Re:This is a bad law that will be misused

[forkboy]

I don't think a personally written message destined for one recipient is considered spam, it's just salesmanship. The problem isn't with individuals mailing other folks based on some sort of market research or indication that they might be interested (i.e. from your example above) the problem is with people hawking their wares by sending out millions of emails to randomly harvested addresses.

I don't think even OUR shitty justice system could mess this one up.