FTC Chief Bashes Anti-Spam Bills

teutonic_leech writes "According to an MSNBC report FTC chairman Tim Muris has indicated that the antispam laws being considered by Congress 'just won't work and may even be counterproductive - some of the proposed laws could be harmful, or at best useless.' He further concluded that 'In the end, legislation cannot do much to solve the spam problem, because it can only make a limited contribution to the crucial problems of anonymity and cost shifting.'" Other spam bits: an anti-spam service has a funny interview with one of their users, and reader der.hans submits a story and some pretty pictures discussing the quantity of Sobig.f virus emails.

Comments

bash?

[selfabuse]

My boss, Bill, bashes spammers. No really, he does. We're one of the first ISPs to sue spammers. Check last months (2months ago? don't remember) Time magazine. Awwwh yeah.

Re:bash?

[letxa2000]

That's a good idea.

New laws to outlaw spam are, as the FTC director said, probably useless. Most of the spam being sent is fraudulent or deceptive in some way--or porn spam that is also being sent to minors. Spammers aren't bothered violating current laws, why does anyone think they won't ignore new anti-spam laws?

Re:bash?

[selfabuse]

and here's the text of the article, for those of you that don't have time subscriptions Jun. 16, 2003 Cable-TV descramblers! FDA-approved diet pills! Viagra without a prescription! Instant access to XXX movies! Dramatically enhanced orgasms! If you have ever received e-mails advertising products and services like these -- some quite within the law, some clearly outside it -- chances are they came from a guy like Howard Carmack, professional spammer. Using three computers and working out of his mother's home in Buffalo, N.Y., Carmack sent an impressive 857,500,000 unsolicited e-mails in one year, something that is perfectly legal in New York State. But Carmack crossed the line, according to EarthLink, his Internet service provider, when he set up 343 accounts using stolen credit-card numbers to send these e-mails. EarthLink took notice and began a year-long cat-and-mouse game to discover Carmack's true identity. "My name's not on anything," he boasted at one point, according to investigators, when they reached him on his uncle's cell phone. "You'll never catch me." Fingered by his upstairs neighbor and a former employer, Carmack went to ground. A private detective was hired to stake out his mother's house. Carmack was finally caught running from his car to the front door and was served with a complaint. Now out on bail, he has been found liable in a $16.4 million civil lawsuit by EarthLink. Charges of criminal fraud filed by state attorney general Eliot Spitzer are still pending. "There are many more like Carmack," Spitzer warns. "This sends a message that we are pursuing them." Spitzer, a man who knows how to put himself in the spotlight, was the avenging angel of Wall Street last year. Now he is on a cybercrusade against spam. And no wonder. In the space of a year, according to research firm IDC, the number of uninvited entries into U.S. In boxes has shot up 85%, to a total of 4.9 trillion. Driven by cheap technology and the promise of easy profit, spammers have gone from pests to an invasive species of parasite that threatens to clog the inner workings of the Internet. For the first time last month, according to MessageLabs, more than half the emails received by U.S. businesses were unsolicited. The time we spend deleting or defeating spam costs an estimated $8.9 billion a year in lost productivity. Sensing an enemy as unpopular as al-Qaeda, lawmakers are pondering a plethora of solutions -- some of which, spam watchers say, could end up doing more harm than good. Why do spammers flood the Internet with ads nobody wants to read? Because some people do read them, and a tiny fraction actually respond -- which in the world of direct marketing is like money in the e-bank. Take former spammer Scott Hirsch of Boca Raton, Fla., who sold his e-mail marketing business last year for $135 million and retired at the age of 37. Florida is home to more spammers than any other state, and Hirsch -- who started his first bulk e-mail list way back in 1996--likes to take credit for helping make Boca Raton "the spam capital of the world." Hirsch filled his mailing lists with the e-mail addresses of people who had "opted in" by checking (or forgetting to deselect) one of those ubiquitous boxes on website order forms. "When people want to receive [e-mail]," he explains, "you get a much higher return." But for an increasing number of Hirsch's imitators, spamming is a numbers game that rewards excess. "The more times they deliver the message, the more money they make," says Charles Curran, general counsel for America Online, which last week filed lawsuits against more than 100 spammers. "They all want to get as close to infinity as possible." This is getting easier all the time, as high-speed Internet access gets cheaper and computer processor power continues to double every 16 months. Meanwhile, the software tools for spamming continue to improve. Web crawlers harvest e-mail addresses en masse from chat rooms and newsgroups. Dictionary-attack programs string together words or names in multiple languages, random numbers, an "@" and

Re:bash?

[schon]

Spammers aren't bothered violating current laws, why does anyone think they won't ignore new anti-spam laws?

The thing is, if you ask spammers, they'll tell you that they're not violating any laws..

That's why we need a clear message that what they are doing is wrong - they need to be shown, without any doubt, that they are indeed breaking the law.

Re:bash?

[4of12]

excessive concentration on the supply side.

You're quite right.

There has to be a concentration on the demand side of the equation.

Clients of the spammers need to feel it in the pocketbook for a solution to really work.

Unfortunately, a 98% effective boycott of the spamhaus clients by recipients of spam won't do much, considering that response rates are less than 1% already. Rather than attack the spammers directly, the clients should be made to pay big time if they've employed a spammer for advertising.

I don't trust Michael Powell. After caving in to media interests and allowing further consolidation in the face of absolutely zero public support for such measures (and widespread opposition once the results of his hearings became known), his current position on spammers seems to be an attempt to position future policy to insure that there is no possible anonymity on the Internet. I dislike that solution to that problem because whistleblowers, politic dissidents in repressive regimes, etc. would be silenced alongside the despicable spammers.

BTW, along the same lines of supply and demand, there's a recent article about current and former law enforcement officials that want a different approach to the "war on drugs" than what's been not working for the last number of decades.

Re:bash?

[Brian Kendig]

They need to be shown, without any doubt, that they are indeed breaking the law.

And then they'll stop, just like all those people who used to download music, right?

Legal action can help curb spammers, *if* it's pursued aggressively -- but technology still has a lot more it can do. For example:

- Why do mail servers accept email whose sender address is invalid (malformed) or gives a domain which isn't resolvable?

- Why do mail servers accept email which is sent in violation of the SMTP protocol -- for example, 'spam blasters' which dump a whole lot of commands on the receiving server then disconnect without waiting for a response?

- Why don't mail servers automatically check services such as Razor? If an incoming message happens to have the same checksum as a message which has been reported to Razor several thousand times within the past half-hour, why accept the message for delivery?

- Why don't mail servers have a built-in 'tarpit' feature? In other words: if there's an incoming message, and if system resources aren't tight, the mail server could sit on it for sixty seconds before accepting it. If the sender disconnects before sixty seconds, the mail will be rejected. This obeys the SMTP protocol, and it will be unnoticed by anyone except people who want to blast tens of thousands of emails in one shot -- suddenly it becomes more time-consuming to spam, and the spammer can be stopped before he can get very far.

Re:bash?

[Jodka]

"I don't trust Michael Powell."

You didn't read the article. This has nothing to do with Michael Powell. The article regards comments made by Tim Muris, chairman of the Federal Trade Commision. Michael Powell is chairman of the Federal Communications Commision.

After caving in to media interests and allowing further consolidation

That is a strange article to site in support of your belief that government should regulate broadcast communcations, which makes me think that you did not read it either. If you had, maybe you would have noticed the excerpts of congressional testimony. Democrats Byron Dorgan and Barbara Boxer site their own concern about the growing popularity of conservative political ideas in radio and TV broadcasting as justification for government regulation. It gives a good sense of their horror that the free speech permitted by under-regulation will allow conservative ideas to become even more popular. Boxer specifically uses the Fox News reference to France and Germany as the "Axis of Weasels" as an example of an undesirable political statement. Regardless of how the the public conceives of this issue of goverment regulation of communication, on the political level is not really about media consolidation, it is about censorship and free speech.

Comments..

[mumblestheclown]

• Anti-Spam bills being considered currently inadequate: 100% correct
• Anti-Spam legislation not a primary solution: 100% incorrect.

Legislation is the ONLY way to get rid of spam. Effective legislation and prosecution, that is. The "they will all go offshore" excuse is BS. Sure, some might, but many won't. And then, the country that harbors the offshore spammer is squeezed just as korea was (do you see any korean spam any more? well, yes, but nowhere like the torrents we all received a year ago).

Spam is a social problem, not a technological one. Social problems can only be solved by social contracts or laws. Technological solutions fail. Even bayesian filters, those much heralded bleeding edge anti-spam flavor of the moment, are being beaten regularly--my SpamBayes filter catches still a good deal, but more and more slip through despie over 150,000 'training' emails as the spammers get smarter. And, bayesian filters (even at the ISP level) don't begin to address the crucial problem of bandwidth use.

Legislate Now. Not big brother, not slippery-slope BS about john ashcroft in your inbox - just reasonable, progressive legislation to eliminate the spam epidemic.

Re:Comments..

[HowlinMad]

I never get spam via instant messenger

I have, I leave my IM up all the time, I;ll come home and have a few IM from some lonely sorority babes that have a free cam, and I should come chat with them.

Why not add offline storage capabilities to an IM style of communication? In this respect, people can send me instant messages when I'm online, and send me stored messages when I'm offline.

Many IM protocols use this. Yahoo does. ICQ does. Jabber can.

Problem solved.

I'm actually baffled why an enterprising individual hasn't implemented this as of yet. While you've certainly got the problem of getting people to move to the new solution, it wouldn't be *that* difficult for most services like Hotmail to switch. In order for this to work, we'd need:

1) Open standard for all to use (i.e. - IM interoperability)
2) Free of charge / bundled with ISP service


Ahh how idealistic, now lets come back to the real world. There have been some implementations like you suggested. They were not accpeted mainstream, and servies like Hotmail won't just switchover, they want to be the ones dictating.

Re:Comments..

[letxa2000]

Legislation is the ONLY way to get rid of spam.

Absolutely incorrect.

The "they will all go offshore" excuse is BS. Sure, some might, but many won't.

You probably have it backwards. Many will go offshore, but some won't.

Plus, it might not be necessary. There is so much spam and spammers are constantly dodging bullets to keep themselves anonymous I'm not sure if it'd really be necessary to go overseas. There are not enough resources to track down spammers that are covering their tracks unless some "public bounty" is authorized that gives the *public* an incentive to track them down themselves. Even then I think you'll find many of the shadier spammers will just use stolen credit cards and/or free ISP trials to send their spam. The trail is going to get awfully cold for a civilian trying to track down a spammer when you run into stolen credit card numbers or need to find the phone number that dialed into the ISP at a given date/time.

Spam is a social problem, not a technological one. Social problems can only be solved by social contracts or laws.

Spam is NOT a social problem any more than junk snail mail is a social problem. It takes advantage of available technology to serve a business purpose and as long as the technology is available to take advantage of, it will continue. The problem is that in the case of email the technology makes spam free.

The solution is make spamming not free (with lawsuits based on existing laws) or make the technology harder to abuse (with filters, etc.). New laws are completely unnecessary and, as the FTC director said, most would be counterproductive.

Technological solutions fail. Even bayesian filters, those much heralded bleeding edge anti-spam flavor of the moment, are being beaten regularly--my SpamBayes filter catches still a good deal, but more and more slip through despie over 150,000 'training' emails as the spammers get smarter.

Then get a better Bayesian filter. With just 3000 good and 10,000 bad emails my Bayesian filter is running at 99.8%. 5 spams have gone through my Bayesian filter so far this month out of 2415 spams--2 were in a foreign language and the other 3 were on-topic enough that they got by and might have even been something I was interested in. My Bayesian filter accuracy has been going up constantly for the last 4 months.

I'm willing to do deal with 1 spam in my inbox every 3 or 4 days to avoid federal legislation that will probably be less than perfect and certainly will not eliminate 99.8% of the spam.

And, bayesian filters (even at the ISP level) don't begin to address the crucial problem of bandwidth use.

Overnight, no. But if more and more people and ISPs implemented Bayesian less spam would be seen my users--including the dumb ones that respond to spam. In time the motivation to spam will decrease and that will decrease the bandwidth problem.

Legislation is NOT the answer.

Re:Comments..

[Otter]

How does a US law stop spam from other countries? You can't get *all* other countries to adopt US policy.

Read what he said -- there's nothing about getting *all* countries to stop spam. If adequate laws were passed regulating spammers (and more importantly, the businesses they advertise) in the G7 countries and a few others, that would make the problem much more tractable for anyone who can live without mail from China or Russia.

Re:Comments..

[kevinz]

Legislation is the ONLY way to get rid of spam. Effective legislation and prosecution, that is. The "they will all go offshore" excuse is BS. Sure, some might, but many won't. And then, the country that harbors the offshore spammer is squeezed just as korea was (do you see any korean spam any more? well, yes, but nowhere like the torrents we all received a year ago).

So the spammers move their relays to another location, while they still cash the checks in Florida and Louisiana. How does that help? Even if we grant your Korea example, and I am not sure that I am willing to do that, we still have a number of other countries available to spammers with many targets for relay abuse. The number of third world countries that will improve their connection to the rest of the world without thinking about security is huge. Further, let's pretend that you are a small ISP in one of these thrid world contries. A spammer offers you the equivilent of 3 years profit to host a relay. What are you going to do? Even better, tech savvy spammers will respond to any law by increasing their reliance on virus spread residential gateways. Sobig could be the tip of the iceberg.

Spam is a social problem

No, spam is an identity problem. As long as you can get into my inbox without allowing me to know who you are I will get spam. By moving caller ID to email we can verify that the email was sent by a known sender. I've found that by requiring that senders authenticate the identity and agree to my terms of service that my spam problem is totally gone. No change to the law. No training a spam filter. No dealing with the few that slip through the filter. The only problem I have is those few people who don't know how to reply to an email, and there aren't many of those.

Re:Comments..

[Kjella]

Legislation is the ONLY way to get rid of spam. Effective legislation and prosecution, that is.

There are already laws. But we're nowhere near a technically feasible way to gather evidence to prosecute, or even blacklist. Let's say Joe Q. Average gets a SPAM. How does he deal with it or report it? Something that doesn't take more of his time than to hit 'delete', and would lead to something effective?

In case you haven't noticed, in the MS blaster fallout there's kazillions of "You've been sending virus email" when in fact the sender is spoofed. I've gotten those earlier myself. I'd be happy for a system that made me sure that mail "from" joe@hotmail.com actually came from the user joe at hotmail. Right now, that's not the case at all.

Kjella

Re:Comments..

[schon]

You probably have it backwards. Many will go offshore, but some won't.

I think you have it backwards. Spammers are sociopaths. They have turned to spamming as an alternative to other types of fraud.

Would you move to another country - turning your back on your family and friends, just so that you could continue harrassing innocent people? I doubt most spammers would either.

Spam is NOT a social problem any more than junk snail mail is a social problem.

Spam most definitely is a social problem - most spammers are (by any definition) sociopaths.

It takes advantage of available technology to serve a business purpose and as long as the technology is available to take advantage of

And the technology will always exist - or are you advocating the dismantling of email? That's why it's a social problem. Because there are sociopaths that take advantage of it.

make the technology harder to abuse (with filters, etc.).

Huh? How do filters make the technology "harder to abuse"? It's just as easy to abuse, and (more importantly) you're still paying for it (yes, you do pay for all the spam you filter, whether you like to admit it or not.)

Then get a better Bayesian filter.

A "better filter" will only help you to avoid the problem, it doesn't make the problem go away.

5 spams have gone through my Bayesian filter so far this month out of 2415 spams

Oh. My. God. You consider that you pay for 2420 pieces of email that you don't want a good thing?!?!?!

Re:Comments..

[jimfrost]

Generally speaking I agree with your commentary, although we do need legislation if only to give a lever that individuals can use when tracking these people down.

Right now if you want to track down a spammer you're pretty much SOL because you can't get a subpoena to extract identity information out of the ISP. You claim that it wouldn't help because they'll use stolen credit cards and whatnot; that may be true, however I was involved in a tracking operation where we tracked the guy to his office telephone because the ISP logged incoming telephone numbers in conjunction with call time and ID. It didn't matter if the ISP had his real identity, the phone company did.

This was a harassment case and obtaining a subpeona was no problem; had it been a spammer it would have been impossible. Giving us a legal foundation for tracking these people is the first step.

The important thing, for me, is not to outlaw spam outright; there are too many gotchas in doing that. We need legislation that normalizes it. Mandates things like no graphic sexual content in the mail message, no anonymity, and mandated opt-out capability. Moreover, the latter could be used to add a tax to spammers; create an opt-out database that they have to pay to access, for instance.

If such legislation is enacted I'm sure we'll see some operations move offshore, but the thing to remember is that an offshore operation raises the costs of doing this substantially. Anything you can do to raise the cost of doing business, even slightly, is going to help dramatically in the case of the really bad spammers. The profit margin on a lot of those spams has to be razor thin.

In the end, though, I think we're going to need technological solutions -- primarily an authentication mechanism for mailers. If all we do is require an authenticatable signature to SMTP traffic (eg signed "from" line) we will vastly decrease their ability to operate anonymously. For that to work all that needs to happen is a few large ISPs buy in on it and start denying unsigned traffic. You'll get a cascade of migration because if you don't migrate you lose a lot of connectivity. Moreover, the infrastructure to do this already exists, it was developed for browsers, all we have to do is leverage it with a small extension to SMTP.

What's clear at this point is that what doesn't work is ignoring the problem. I'm seeing SPAM increase at the rate of something like 25% per month on my personal account. At that rate even with sophisticated filtering technologies -- my filter system is exceeding 97% accuracy -- the 3% that get through will start to be a real burden in less than 18 months (to say nothing of the cost of the traffic that's being automatically dumped in terms of my DSL bandwidth).

I don't expect that legislation will be 100% effective, but if it takes out a few spammers and blunts the growth rate overall then it will be dramatically effective.

Re:Comments..

[letxa2000]

I think you have it backwards. Spammers are sociopaths.

I think you are using the definition of "sociopath" very liberally if you think that all--or even most--spammers are sociopaths. I hate spammers as much as the next guy, but sociopaths? The definition of sociopath is "One who is affected with a personality disorder marked by antisocial behavior." Spammers are insensitive and thieves, but I don't think that most of them suffer from a personality disorder.

Would you move to another country - turning your back on your family and friends, just so that you could continue harrassing innocent people? I doubt most spammers would either.

If the spammer is making a few hundred thousand per year I don't think a move to Cancun is going to hurt that much. After all, if they are sociopaths are their links to families and friends going to be all that important? They're sociopaths after all. :)

And the technology will always exist - or are you advocating the dismantling of email?

No, I'm advocating that we lock our doors before we ask Congress to do something about people breaking into our houses. We have the technical means to pretty much solve the spam problem and I think we should obviously exploit those technical means before we go crying to Washington for help that, frankly, they probably won't do a very good job at anyway.

How do filters make the technology "harder to abuse"? It's just as easy to abuse, and (more importantly) you're still paying for it

It's harder to abuse if the spammer has a harder time delivering his message to his intended victim. Filters make it less likely that a spammers' message will get through, thus less likely that a dumb idiot will respond to the spammer, that reduces the profits of the spammer which lowers the incentive to spam in the first place. It's not a silver bullet that will solve the spam problem in one day, but Congress isn't going to be able to give us a silver bullet either.

A "better filter" will only help you to avoid the problem, it doesn't make the problem go away.

See above. You're looking for instant gratification. As they say, the spam problem didn't hit us overnight and we won't defeat it overnight. But widely implemented effective spam filters will reduce even further the response rate of spam which will mean less motivation to send it in the first place. So, yes, a better filter will eventually help the problem go away as long as it is widely implemented. And we have the technical means to implement them widely.

Oh. My. God. You consider that you pay for 2420 pieces of email that you don't want a good thing?!?!?!

Those 2420 pieces of spam consumed 11MB of bandwidth. If I go over my bandwidth allocation (which I don't), I pay $2/GB. So if we assume that I'm paying $2/GB those 11MB of spam cost me about two pennies. Now I'm not saying that I think that it's good that I have to pay anything at all, but my time is much more valuable than the bandwidth cost of spam. And people need to understand that. The bandwidth is annoying, but the real cost of spam is in the time that everyone has to spend dealing with it.

So, yes, the fact that in the last 3 weeks I've had to manually delete 5 spams instead of 2420 is a good thing. If we can get rid of spam and save me three or four pennies per month, great, but I'd rather lose a nickle per month in bandwidth than invite the Federal government to start regulating aspects of email.

Re:Comments..

[bafu]

It makes me sad to see someone who thinks "technological solution" == "filters" get a +5 Insightful, but whatever. If you are a troll, derive whatever personal satisfaction you can from the fact that I am taking your post at face value...

Spam is a social problem, not a technological one.

You are missing the point of the spam problem. The fact that there are people who have no ethical problem engaging in spamming could be seen as a social problem, but their ability to engage in it is a technological problem. Spam exists because of the way our email system is designed, and that system is not some immutable force of nature. Change the system of incentives in that email system and, without changing human nature or the number of scam artists in existence, you will change the amount of spam in the email system. IOW, they currently use it because the technical design of our email system makes it easy for them to engage in their particular form of antisocial behavior. If and when it doesn't, they will not disappear (or, in most cases, give up antisocial behavior in general), they will just stop sending spam through the email system.

So, I agree that filters and so on are not solutions... after all, they only treat the symptoms. That isn't an argument against a technological solution, however. The people who are proposing "technological solutions" to the overall problem are actually talking about changes to the system itself, not filters slapped on top of it.

Anti-Spam laws are the only way to go

[Marxist Commentary]

As long as there is profit to be made, there will be an enterprising capitalist there to take advantage. Especially in the case of spam, where there is no real barrier to entering. If you get a miniscule response, you can make a huge return on a limited investment.

It's akin to regulation of the traveling snake-oil salesman of the nineteenth century. That sort of charlatan is no longer allowed (by law), and the same could happen with strong (and strongly enforced) spam laws.

Re:Anti-Spam laws are the only way to go

[boatboy]

The illogic of your comment is that it ignores the other side of the coin. As long as there is profit to be made stopping spam, capitalism will find the cheapest, best way to do so- much cheaper and much better than any politician ever could. It also, as this century has proven for marxism, ignores the fact that where there is profit to be made, there will always be an enterprising politician to take advantage.

Your analogy is also incorrect. Snake oil salesmen were frauds. Fraud became illegal, not snake oil. I may buy snake oil (or magnet bracelets or crystals) as long as the seller is honest about what it is. Spammers may be frauds also, but the point is, if they are frauds-or in violation of other existing laws- then they should be prosecuted under those laws. If new laws are needed to clarify what sorts of advertisement are illegal, they should not deal with the technology but rather the core issue (ie. it is illegal to advertise indecent material to minors.)

I have a feeling most /.ers, if they thought about it, would trust technology over a politician any day...

Wow...

[InfinityWpi]

A government figure who actually admits there's not a whole lot they can do. Nice to see a guy with a little common sense (on this issue, at least) giving voice to his oppinions. Let's face it, he's right. Outlawing spam is -not- goingg to have an yeffect whatsoever. Look at underage drinking, pot use, etc. It's illegal, it still happens, and quite often. The 'spam bills' won't have any effect beyond making people think their senators are tech-minded.

Re:Gee, whouda thunk

[BillFarber]

And if this administration wrote laws to stop spam, the other half of slashdot would be whining about Ashcroft taking away our right to free speech.

You don't like spam? Hit the delete key. Don't make a law about it.

Re:spam is becoming a problem like pollution

[BWJones]

spam is becoming a problem like pollution.... we can not get rid of it, so we will just have to live with it

No, most spam is distributed by a few known individuals. Make laws against distributing spam with harsh penalties (especially for porn spam that kids can be exposed to) and the problem will go away. After all, after the do not call registry went into effect, we have had almost zero telephone calls in the evening from people looking to sell us stuff.

Two evils

[ArmenTanzarian]

Going to read an article about anti-spam legislation and being bombarded with pop-up ads

best quote

[RevDobbs]

best quote from the Knowspam.net interview:

Q. What are you doing with all your extra time now that you aren't getting spam?

A. . . . Petting the cat. Not a entendre, by the way. Real cat. . . .

Headline Misleading

[kunsan]

At first glance, it sounds like the FTC cheif has his head up his ass. After reading the article, I realised the man just does not want to pass a lame ass law that makes it HARDER to prosecute spammers. He is looking for a simpler plan to make it EASIER to shut down mass-spammers. Sounds like he needs our help, not our hostility.

JP

Challenge/response spam filtering

[Mwongozi]

Is it just me, or is C/R spam filtering, really, intensely, annoying?

If I e-mail someone, and I get one of those "I think you're a spammer, prove you're not" messages back, then fuck it, you're not getting my e-mail. Challenge/response breaks the whole concept of e-mail.

I personally use SpamAssassin to drop mail scoring 5-10 into a crudbox, and 10+ just gets bounced.

I don't get much spam anymore.

Re:Challenge/response spam filtering

[KMitchell]

If you email me and get my "prove you're not a spammer" TMDA autoreply then you've never corresponded with me before (with the email address you're using). Any previous correspondence (to or from) and you won't get the autoresponse.

If you care enough to send email to me, you care enough to "hit reply" one time for a "new address". If I started the "conversation" you shouldn't ever get an autoresponder message.

Challenge/response breaks the whole concept of e-mail.

No. Spamming broke the concept of email years ago. The only question is how to fix things. Based on the hoops you're going through with SA, your email sounds just as broken. Been there, done that. If you don't want to email me, I'll cope somehow.

Re:Challenge/response spam filtering

[letxa2000]

No. Spamming broke the concept of email years ago. The only question is how to fix things. Based on the hoops you're going through with SA, your email sounds just as broken.

I agree with grandparent, C/R is a lame response to spam. It puts the burden of your spam problem on those legitimate users that may want to mail you. Forgetting the technical problems, that's just rude. I am *not* your spam filter and, like parent, if I receive a C/R response I will just ignore it.

Technically, C/R is also lame. So you're getting, say, 100 spams coming in per day to your C/R system. Most of those are coming from non-existant addresses or addresses that belong to someone NOT involved in the spamming. So your C/R system is faithfully sending challenge messages to those 100 senders. Perhaps half fail because they are undeliverable, the other 50 find their way to innocent parties not involved in sending spam.

So for you to enjoy a spam-free email experience you've annoyed your legitimate senders, some probably decided not to bother (false positives that you don't see), you've attempted to deliver 1 challenge message for every spam you received (increasing spam-related traffic), and have managed to annoy 50 innocent people just because their email address happened to be forged by a spammer. But I guess the important thing is that you weren't bothered by the 0.5% of the spam that might get past a good Bayesian filter.

So... can you explain to me again why C/R is such a good thing?

Technology legislation cuts both ways

[Anonymous Coward]

Listen guys. You can't have laws saying "It's OK to be anonymous and post anything you want anywhere and threaten to do anything to anybody and download anything you want and it's all free and nobody can touch you; but spamming is bad. Then you go to jail." Trying to limit everybody else's actions while giving yourself complete freedom is known as "fascism".

Re:Technology legislation cuts both ways

[0123456]

Exactly. The only way to eliminate spam is to force everyone to include real-world indentification data in every single email and Internet posting. Do you really want your SSN on every post you make to Slashdot and the natalie-portman-fantasies mailing list ready for future employers and partners to find?

The price you'll pay for anti-spam laws is the complete end to anonymity on the Net: personally I think that's a pretty lousy trade compared to local filters and ready use of the delete key.

Returned mail: Service fr_cking unavailable!!!

[Anonymous Coward]

Since they are taking the time to scan email for viruses, you would think they would take a second to check the validity of the "from" address. Or at least not send bounces to domains which have diff ips than the sender.

Now I get piles of bounces from people with viruses.
Great.
Hard to filter since I want to see bounces from my own mail.

Always funny

[cubicledrone]

How people spend so much time complaining about spam (unauthorized use of bandwidth) yet have no trouble at all making unauthorized use of someone else's data (file trading).

There shouldn't be much problem with a spam policy provided the proper definition of spam is included: bulk, unsolicited, commercial e-mail.

Defining spam as "any e-mail I don't want" is probably part of the problem with having a working anti-spam policy. It is also an incorrect definition of spam.

It also makes it impossible for people to do business, since it will be impossible for people to introduce themselves through e-mail.

Re:Always funny

[garcia]

using someone else's data is beneficial to you, getting spam in your mailbox is nothing but an annoyance.

Re:Always funny

[letxa2000]

It also makes it impossible for people to do business, since it will be impossible for people to introduce themselves through e-mail.

Unless it's personal, one-to-one conversation from a friend of mine recommending some company for something my friend knows I'm interested in, I don't *WANT* to be introduced to any company via email. If I'm interested in a company's product, I'll go Google and find it. Then we can have an email exchange if necessary. But I positively never want to receive a "cold call" via email.

My email address is there to serve ME, not to serve others in their efforts to get-rich-quick at the cost of my time.

Re:Always funny

[Hayzeus]

It also makes it impossible for people to do business, since it will be impossible for people to introduce themselves through e-mail.

I agree completely. So please allow me to introduce myself to you. I am Thomas N'Gemba, formerly of the Ministry of Finance of Nigeria. I and my associates have recently discovered aporximately USD$10,000,000.00 in unsecured funds...

I understand it, even though I don't like it.

[mark-t]

From the article:

"Proposals in both the House and the Senate require us to prove knowledge to bring an action against a seller that hires a spammer," Murin said.
Proving such awareness could be nearly impossible, he hinted.

It may suck, but it's right on the money... how can you possibly prove that the seller ever advocated the spamming? The *most* they could expect from a seller is for them to pull the spammer's account (if the spam was done as some sort of referral program), but often even that's not possible.

What the government CAN do....

[weave]

What the government can do and should do is pass a law that says the matter should be handled by the private sector, and affirm a mail system owner's right to decide what gets delivered, and also word it so third party services like spamcop are legal so they don't have to be threatened with legal actions.

Put an end forever to these bogus claims by spammers that their free speech is being interfered with, that businesses have to pay to provide means to deliver their crap, and that to do otherwise is to interfere with their business and all of their other bogus claims.

crucial problems of anonymity? Clue bat!

[twitter]

What crap! Anonymity is a crucial part of free speech. Atempts to eliminate it from email are about as unAmerican as unique CPU numbers or bar-code tatoos. They are also technically unnecessary. IP numbers do not have to reveal a user's identity to be blocked. Laws that attempt to elimiante spam by making it technically imposible are about as sensible as making murder technically imposible by outlawing privacy and pointy metal objects. I'm sick of such stupid shit.

The solution is to outlaw spam outright. Spammers will be caught the same way murders and and crackers are cautht today. It does not require a fundamental loss of privacy or anonymity on the web. Spamming will be reduced to a tollerable level the same way speed limit laws reduce traffic deaths. Spamming and the "cost shifting" involved are simply wrong and it's right to make laws against things that are wrong regardless of how well they work.

Re:spam is becoming a problem like pollution

[ihummel]

Ah, but much, if not most, of the spam that gets passed around on the Internet comes from outside our borders and therefore outside the reach of any anti-spam law. I don't think the same is true for telemarketers.

Passing Laws

[aking137]

Spam is a big problem, but I think we should be really careful about pushing our lawmakers to pass laws that are that specific to computers. Whenever someone suggests introducing a law that could possibly invade someone's privacy, we're up in arms about it and claim that such problems should be solved a different way - that the lawmakers should stay away from what they don't understand, and that we could solve them by technical means, or by interpreting more general, existing laws to apply to computers.

When we're pushing for anti-spam legislation, we're saying it's suddenly okay to pass laws that specific just because it suits us and we can't see any possible way to lose out. Is this a fair way of doing things? Are we really decided on how far we want laws to extend into computers, and where we draw the line?

Re:spam is becoming a problem like pollution

[Trigun]

It is more problematic than just stopping the spammers. Any legislation should be based upon these criteria.

1) Spam cannot be routed via spurious methods.
2) Spammers can not blanket-target domains.
3) The companies who emply spammers should be held responsible.
4) The advertising should follow current laws and guidelines, with the consideration that minors may be using the internet. In general, follow the guidelines for movie trailers.
5) Transactions between companies and these 'advertising agencies' must be recorded.
6) Both the spammer and the company which sells the product must be held culpable.

Any deviation from these guidelines will only prove to make the anti-spam legislation exactly what the claims state it is, useless and filled with loopholes.

Very insighful

[mericet]

I agree wholeheartedly. There are a lot of laws which are not activly enforced, but their existance in the books sets a social standard.

Moreover, a law which is not enforced by itself is useful when the authorities catch them for something else which is hard to prove (in the case of spam, probably fraud, misuse of other people's computers) or have jurisdiction problems. And it helps civil litigation too (I don't know if the US have a civil criminal litigation procedure, but it helps either way).

Automate the challenge/response ...

[tessaiga]

There's no need for a human to get involved. Have a protocol whereby in order to the receiver's machine automatically issues a small, dynamically-generated math problem which requires the sender's computer a few seconds of computing time to solve. The email only gets "authorized" if a correct solution is received. This would have very little impact on a regular user, but a spammer who sends out hundreds of thousands of emails would be facing some pretty prohibitive computational costs.

Re:Automate the challenge/response ...

[iainl]

A few seconds of computing time on what, exactly? My 28MHz Amiga A1200 does a perfectly acceptable job as a Pine station, but I'd really rather not have it solve something the Athlon 2800+ takes 'a few seconds' over every time it sends an email!

Re:Automate the challenge/response ...

[Tarrio]

"This would have very little impact on a regular user, but a spammer who sends out hundreds of thousands of emails" -- or a legitimate mailing list server -- "would be facing some pretty prohibitive computational costs."

Re:Automate the challenge/response ...

[danila]

Don't say it's the only, or the best, or even good solution. It is not. There is a fundamental difference in approaches to spam. One approach is to leave technology as it is and use legislation (old or new) to smack the spammers. Another one is to use technological solutions to make spam impossible. But technological solutions will not work, because in case of spam it is trying to undo the technological progress itself. Face it, e-mail is free. It is free because of the technology and unless you shut down the fibre-optic Internet backbones, it will remain free. Any attempt to change it will fail (you may not believe me, but it will regardless of that).

Another technological solution is to remove anonymous e-mail, but this won't work. Even now you can trace the e-mail almost all the time to the originating ISP and IP address. That is still not enough. Take the [relative] anonymity and you will flush the baby with the water. It won't help you fight spam, but we will lose a bit of our rights (right to free speech requires the right to anonymous speech).

The second distinct approach realises the technological changes and attempts to work out the problem from another angle. Make it possible to fight spammers in courts and charge them for the costs they incure. It worked for the faxes, it should work for e-mail. Currently there is no way in most countries to charge spammers with anything. They are not doing anything illegal (technically) and the policies of their ISPs never involve fines, at most a termination of contract. Make a law that anyone can charge a spammer, who must then disclose the list of intended recepients. If the nature of the offending e-mail is not obvious, ask the recepients. If enough of them say it is spam, the spammer is guilty. Give ISPs the authority to try to resolve the issue without going to court first (if both spammer and the recepient agree). You CAN make a law that will both work and not be very easy to abuse. And almost anything will be better than the present situation.

Anonymity will be surrendered to fight spam

[FearUncertaintyDoubt]

No spam law that doesn't help investigators find the real sender of the message would be effective he said.

Anonymity is something that I think is one of the things that makes the internet so valuable as a tool to help people fight oppressive governments and corporations. When it is impossible for a spammer to cover his tracks, it will also be equally impossible for a political or corporate dissident to do so as well.

The implication here is that spam can be solved by a technical solution, i.e., one that makes forging identity very very difficult. IPv6 or something like that, perhaps, with additional anti-terrorism/anti-spam identity measures, forcibly implemented (Carnivore anyone?) on ISPs and backbone providers. We'll be so happy to be rid of spam we won't realize what we gave up.

Forget UCE, they need to go after the criminals.

[gristlebud]

I agree that the proposed spam legislation is inadequate to solve the problem, and I commend the FTC for standing up, rather than passing more useless laws and backing an inneffective solution just to be able to say "look what we've done"

However, my problem has lately has not been the tradition UCE spam (Spamassasin does a pretty good job taking care of that); my problem lately has been outright criminal messages reaching my inbox.

Recently, I've been getting more and more messages spoofed as being from Paypal, Citibank, my ISP, etc, saying that my account has been suspended, and I need to verify my password, credit card number, even my mother's maiden name(!) These messages are getting more sophisciated, and appear to have (for example) a paypal.com address for me to click on.

After getting a few of these in a week's time, I checked the headers, and all seemed to come from China. I'm not sophicicated enough to trace them back any farther, but since these are so blatently criminal, I dont think they'd be originating in the US, as the potential for prosecution is so high.

Unfortunately, these messages are the most dangerous, and the hardest to stop (if they truly originate overseas.) I'd like to see some sort of internation cooperation to track and prosecute these degenerates.

So how does one find a spammer anyway?

[einTier]

It seems like these guys lay low so that geeks like us can't find them and harrass them. But, this has always begged the question in my mind, how do their customers find them?

Not that I want to spam mind you, but it seems like they have more than a few customers, and yet, it seems next to impossible to find a point of contact for these people.

It's easy, practical and sensible to outlaw spam.

[twitter]

Oh... and just *HOW* do you propose that we do that? Follow the return address?

Why do people always ask that question?

You catch spammers by, well, catching them! ISPs and other interested parties can trace IP numbers back to the machine that sent them, no matter how "fake" they are set. That's the same kind of detective work and reliance on witnesses that any normal crime is solved by. ISPs constantly cut off these creeps and they have to keep going from ISP to ISP to get their word out. It would be very sweet indeed for an ISP to be able to report their spammers to the police.

In any case, outlawing spamming will get rid of a large volume of crap. Jackasses who brag about the volume of spam they are able to send from their freaking mansions will be shut down right away. So will lots of other losers who have been investing in equipment to annoy the rest of us. Good riddance. It may not get rid of all of them, but it will get rid of a lot of them.

as long as anonymity is allowed to exist in email, spam will exist

As long as people exist, spam, murder, and all sorts of other foul things will exist. None of it will ever be defeated by any police state but the confines of a police state are more odius than pure anarchy. Laws that follow morals are good things. Laws that "surrender to practicality" they way you would are flawed and hateful.

Hmm

[Dark Lord Seth]

That time travel guy, I think. Did you ever get it? That guy who was looking for aliens who had perfected time travel because he needed to go back and fix something? It was a rambling treatise about the nature of time and him trying to convince the reader he was dead serious about this and there didn't seem to be any other point to the thing. No URL, no offer to increase my penis size, nothing.

Did anyone else receive that one? I thought it was nice! It was so full of bullshit (nor noteworthy amongst spam) and... it had no purpose. Spam is usually aimed at stupid and/or gullible people who are willing to believe anything they receive in their mailbox. Even if someone were to believe this one particular spam message, what would one do? Send Mr Fusion to a set of long/lat coordinates IN THE PAST? Is it some kind of joke?

Sender Verification for SMTP?

[Adrian Lopez]

I think the SPAM problem could be largely mitigated by altering the SMTP protocol to include cryptographic signatures which are used to authenticate the email address listed in the email's "From" field. The receiving SMTP server contacts the server listed in the From field to obtain a copy of the claimed sender's public key which the receiving server uses to authenticate the sender's true identity. The public key is user-settable so that alternate From addresses may be used as long as the sender is authorized to use that address in From fields.

Re:Sender Verification for SMTP?

[lpontiac]

I think the SPAM problem could be largely mitigated by altering the SMTP protocol to include cryptographic signatures which are used to authenticate the email address listed in the email's "From" field.

SMTP doesn't know about the From: field. Or the To: field, for that matter.

Re:Sender Verification for SMTP?

[Adrian Lopez]

SMTP doesn't know about the From and To fields? What do you mean? SMTP requires that users specify a From and To field, and while it might not respond immediately with information about the validity of an email address, it is nevertheless possible for SMTP servers to establish the validity of an email address. My server, for instance, does this:

helo caribe.net
250 OK
mail from: me@caribe.net
250 me@caribe.net OK
rcpt to: nosuchuser@caribe.net
550 is not a valid mailbox

SMTP seems like the natural place to verify the validity of a mailbox, but ultimately it could just as easily be implemented as a separate service.

Anti-Spam Services

[Goo.cc]

The interview in the story is from an anti-spam service called knowspam, which works pretty much like Blue Bottle: if you are not on my white list, you have to authenticate yourself to send me an e-mail.

But what happens when two people, both using such a service, decide to send an e-mail for the first time? Couldn't such a setup create a endless loop of authentication requests?

Too bad they don't realize this on every issue.

[Maul]

Legislation isn't always the correct tool to fighting something. Whenever we consent to Congress passing more and more laws, we are sure to lose some of our freedoms along the way.

I hate spam as much as the next guy, but it isn't worth letting Congress think up some hair-brained, rights-destroying scheme that probably won't work anyway.

Too bad they don't realize this on most issues out there.

The guy's right

[amcguinn]

First, in saying some recent bills may be counterproductive, he's only echoing what many anti-spam campaigners have been saying: the bills actually legalise a lot of spam.

Now, a good anti-spam law can contribute by driving spam further into the criminal underworld, but let's face it, it's most of the way there already, and you're not going to cut it down much more in that direction.

The key point is anonymity. If you can send email anonymously, you can send spam, legally or illegally. If you are willing not to receive anonymous email, you can receive zero spam (using whitelisting), or next to zero spam (counting on blacklisting of known spammers by name). Contrary to what some people say, the existing technical SMTP protocols are perfectly adequate for spam-free email: you just need a virtual email network using smtp, to which anonymous users are not admitted. I think it quite likely that MSN, AOL, etc. will be setting this up within the next 12-24 months. They might screw it up by trying to lock out competitors, but it can only be useful if it's reasonably inclusive.

Personally, I want to receive anonymous email, from people who've seen my web sites, or old friends who've looked up my address, or whatever. But to get these emails, I'm bound to get spam as well, legally or illegally, and I'm prepared to live with it.

Not really

[jeroenb]

We can avoid spam if we just collectively start using another system for sending eachother messages. Sound difficult to get that off the ground?

Try finding another planet to live on. Then compare :)

Re:No

[schon]

Legislation is not the only way to go.

I disagree. It's the best way to go.

Consider this article. Spam can be largely solved via technical means.

I read the article - it won't stop spam. The author says that the confimation is a step that spammers "do not and will not take" - how does he come to that conclusion, exactly? What's to stop a spammer from setting up an autoresponder to get past it? - Oh yeah, and say goodbye to legitimate anonymous email, too.

If none of it gets through, then the incentive to spam in the first place is removed.

You're talking about this as if its the first time anyone has tried a technological method to stop spam.. There have been LOTS of other methods tried, and what has the result been? Spammers adjusting their methods to get around them, not spammers quitting.

I think that it's been proven that technological solutions have no effect on spam, except to make email less useful.

Laws don't stop crime, they won't stop spam either.

Laws don't stop crime, but they do reduce the amount of it. Laws may not stop spam, but they will surely go a long way to reducing it.

To paraphrase you;

"If you throw spammers in jail, then the incentive to spam in the first place is removed."

The Problem with "Anti-Spam Legislation"

[rudy_wayne]

I'm all for fighting spam, but so far, there are 3 problems:

First, there seems to be this naive belief among politicians that if they pass an anti-spam law, spammers will actually obey it. The majority of spammers have little regard for the law and their entire business model is based on deception and other activities of questionable legality. Any anti-spam laws will be ignored (and tied up in the courts by legal challenges).

Second, is enforcement. You can write all the laws you want, but they are meaningless if not enforced. If I am deluged by spam that violates an anti-spam law, who do I complain to? Who will investigate my complaint and take appropriate action - all the way through to prosecution? If you think about this for a minute, you quickly realize that *MEANINGFUL* enforcement of anti-spam laws will take a lot of resources -- i.e., it will be very expensive.

And finally, there's the international nature of the internet. Routing spam through a mail server in a foreign country is trivial. The only likely outcome of anti-spam legislation is that spammers will use foreign servers for their e-mail and websites.

Re:spam is becoming a problem like pollution

[-brazil-]

Bad analogy. Drug trafficking becomes the more profitable the more it's outlawed because the addicty will pay literally any price. Not so with spam, where the demand is quite limited and will not put up with inflated prices.

Re:What is needed is a new email protocol

[amcguinn]

What would the new protocol give you that SMTP doesn't?

What allows spam isn't SMTP, it's the way SMTP is used: Any ISP will accept email for their customers from just about any ISP, many of whom in turn will allow just about anyone to sign up as a customer and send email, without proving identity or showing any bona fides beyond payment for the service.

How will your new protocol magically stop that happening?

A slight improvement could be brought about by:

• Insisting all messages have a "sender:" which reflects the actual network origin
• ISPs' outgoing servers accept mail only from their own connected customers (happens already), and that the "sender:" matches the customer sending the message.
• ISPs' incoming servers accept mail only if the "sender:" matches the domain of the server that is sending the message

With this in place, you could whitelist reliably on the non-forgeable "sender:" field. It would cause some reconfiguration, and upset some people. It would require no changes to SMTP.

ISP's would then be able to add a new header field to outgoing mail, indicating "This is a bona-fide idenifiable, accountable customer", if it really was (and remove any such header field if the customer is not identifiable). The ISP at the receiving end could remove the header if it does not really trust the sending ISP to keep track of its users. Customers would then have the option of receiveing from only such "reliable" senders, plus a whitelist. Again, this is only extensions to current mailserver functionality, not changes to the protocol. All the software to run this scheme already exists.

(Corporations, universities etc. who do not send or receive mail through ISPs count as ISPs themselves under this scheme.)

Today, the demand for such steps is not there, but it may be within the next few years.

There are a few details to fill in: obviously ISPs would have to provide filtering options to their customers based on the new headers, to save customer bandwidth, but the gist of the system is all there.

Treat the disease - fraud - not the symptom

[swb]

Spam is predominantly a marketing method for fraudulent or otherwise illegal business enterprises. Without a source of business, the people performing the spamming will be forced to move on.

You *can* easily catch the people running the businesses behind the spam; they collect money, and the money trail is easily followable. Lean on these people, and you can probably get the spammers if someone decides to make spamming illegal as well.

The key point is to not try to attack spam; it's only a symptom. The real cause is fraudulent business entperprises, and I'm mystified why the FTC or the FBI doesn't make them a higher priority. Even the DMA should back this, since it would make them look more reputable without a direct attack on a business practice they'd *like* to use.

Re:Yeah, well they bashed the anti telemarketer la

[gorbachev]

The FTC is not blasting the concept of passing an anti-spam law. They're bashing the existing anti-spam bills that are about to become law. They're essentially saying we need better laws.

You're the one who can't define "spam"

[Len]

I don't care whether spam is advertising a product, or asking for money, or asking for my vote. If it's unsolicited, bulk email then it's spam. Note bulk, not a single email to a single person about a topic that concerns him specifically. I don't see how you could confuse an offer to invest in my company (which couldn't be part of a bulk mailing, right?) with spam.

Anonther Interesting Article on Spam

[twoallbeefpatties]

This story was printed recently as the cover for a weekly indie paper in Boston. The story reads more as a cover sheet for neophytes rather than for the hardcore Slashdot crowd, so you've probably heard most of it already, but there are a few points of interest:

-- Some legislators have built up backing for a "do not email" list, similar to the "do not call" list that can get telemarketers in trouble. However, there's little hope it will pass. Not only would most offshore spammers ignore the list, but a list full of working emails would be gold to most spammers.

-- The article briefly restates the idea that putting a price tag on emails could help the problem. The idea is that spammers make profits only because they can spam freely in such large quantities. If there were a 10 cent bill attached to emails sent, spammers would see greatly diminished returns. Small price to pay?

-- The article also gives this interesting thought in a "do's and don't's" sidebar: Use "plus addressing" (offered at EFN) if you care about who's giving out your e-mail address. Here's how it works: Get an e-mail account. For example, nospam@efn.org. What's different with plus addressing is that nospam1, nospam2, nospam3 and so on will also be sent to you, only they'll each come into individually labeled folders. Next, when you sign up for a Victoria's Secret card and they ask for your e-mail, you give them one of those plus addresses, such as nospam14. If you ever get a spam e-mail sent to the nospam14 folder, you know which organization sold or shared your e-mail, and therefore where not to buy your panties.

Don't compare

[phorm]

Underage drinking, pot use, etc...

What you are describing are actions done by private citizens. Quite often younger citizens.

Now in many cases, spam is a business practice: for both the spammer and whomever he/she is advertising for. While regulating businesses may not have an immediate effect, or a fully-encompassing one, it is generally more effective than regulating private citizens.
Businesses stand to lose a lot. If pushed to bankruptcy and your business is tied to your personal life, you could even lose a house/car/etc. So yes, it could be more effective.

Now, if most private citizens were spamming, it might be not effective (see RIAA: filesharing). I have enough faith in humanity that is just a few evils causing most of the spam.
Getting the laws in place, and more importantly enforcing them should start to affect spam eventually, though.

Target the vendors

[spagiola]

The spammers can and do try to remain anonymous, but their very purpose is to make people buy something, which means that at some point there has to be a way for customers to reach the vendor paying for the spam to be sent. And that's what should be targeted. Fine those who pay to have spam sent, and they'll stop doing it. There need to be some safeguards, of course, so that a competitor does not maliciously have spam sent in another's name, to get their competitor fined, but that should be something that can be addressed.

Re:I just don't understand....

[swordgeek]

Here's the big deal.

1) Bulk paper mail subsidises personal letter mail. They pay well for the privilege of sending out stuff that no one reads.
2) Spam recipients pay for the spam they get. Disk space is used, bandwidth consumed, and ISP bills are higher. Not to mention the fact that we now need extra software (more computer resources, more maintenance, more time, more money) to filter this shite out.

YOU ARE PAYING for every spam you receive, as well as every spam you filter. By the time it's left the spammer's computer, the load has been incurred, and the costs go up.

FURTHERMORE, it's easy to tell the difference between paper junk mail and real mail. It's not always as easy (esp. for filters) to distinguish, and as a result you have spam that gets through to you, as well as real mail that gets trapped by your filters. Worse yet, the spammers are exploiting this--they've turned it into a war of escalation, with better crafted spam vs. better filtering. As long as they have free reign, we will be paying higher costs and continue to have the value of email service degraded.

Of course nearly all of the "I don't get it" comments come from spammers, so you probably already know this and are just trying to excuse your behaviour.

Broad laws. Too broad.

[satyap]

I kinda agree with him. The laws usually leave out important things like the definition of spam. See also laws about copyrights online, piracy, etc.