Slashdot Mirror
Who Is An ISP?
happynut writes "Last Friday there was an article about the new anti-spam U.S. legislation that might become law.
Within this bill, the only non-government party that can sue for damages is an 'Internet Access Service' (Page 44, line 1 (Sec 7(g)), and Page 8 line 15 (Sec 3(11)) of
the bill). Some reports have treated 'Internet Access Service' as the same as
an ISP. But if you follow down the definition listed in Sec 3(11)
(see
47 USC Sec 231(e)(4)), it defines an Internet Access Service as: '(4) Internet access service --
The term 'Internet access service' means a service that enables users to access content, information, electronic mail, or
other services offered over the Internet, and may also include
access to proprietary content, information, and other services as
part of a package of services offered to consumers. Such term
does not include telecommunications services.'
My question is: isn't this definition so broad as to cover all of us who run
a mail server? It doesn't mention commercial, or for money, or to the public;
it just says 'as part of a package of services offered to consumers.'"
I suspect that the answer to this is something which will only be decided by high paid lawyers standing before an appeal or supreme court.
The way I read it, this would cover a home page as well, as it offers customers (family) access to information (your pictures of the kids, blogs, whatever). Does this make sense to anyone else?
No matter where you go, there you are. So Enjoy it.
Er, no you can sue spammers directly. Well, probably you can't, but it looked like you had the subject and object backwards, so I just switched them for you.
Definitely covers me - I have a co-located server with clients websites running on it. I rent all my bandwidth though - would never really have thought of myself as an ISP, although I guess I fall under the auspice of "Internet Service Provider" - the typical image is either a dial-up merchant, or someone like Colt/BT/Level3/(insert huge company here)
Simon
Physicists get Hadrons!
That's true. however, litigation may be avoided by donating $699 to your friendly local unix provider.
The term 'Internet access service' means a service that enables users to access content, information, electronic mail, or other services offered over the Internet, and may also include access to proprietary content, information, and other services as part of a package of services offered to consumers.
How are "consumers" defined? Members of the general public who pay money to receive these services? If it's something like that, then those of us who run mail (etc.) services only to non-consumers shouldn't be affected. Right?
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
...access to proprietary content, information, and other services as part of a package of services offered to consumers. Such term does not include telecommunications services.
As I (IANAL) read it, it seems narrowly tailored to include AOL ("proprietary content") and exclude DSL-providing Baby Bells and possibly cable companies ("not... telecommunications services") (I'm not sure whether cable companies are "telecommunications services".)
Opinions on the Twiddler2 hand-held keyboard?
as part of a package of services offered to consumers.
It doesn't mention commercial, or for money, or to the public; it just says 'as part of a package of services offered to consumers.'
Consumers = the public in this case.
Internet access packages = typically non-free.
Selling it on any appreciable scale = often commercial.
I believe these are the interpretations they're aiming for, and the ones that will be upheld should they ever be taken to task.
The coolest voice ever.
Hey, I run the linux box that is the firewall between our home LAN and the cable modem. I provide internet access to my wife (and our parrots, when they play with the keyboard). I do all the troubleshooting of things like email and web-access problems. So can I am obviously qualify as an ISP, right? It'd be fun to be able to sue the spammers for DoS of our cable modem and wasting our time.
Those who do study history are doomed to stand helplessly by while everyone else repeats it.
I RTFA but i'm not sure if I qualify. I supply a cable modem connection to 12 students in rental rooms. If I use a switch and charge a monthly rate, does this make me an ISP. Does there have to be a server involved? Does reselling access count?
Stay tuned for new sig...
Can I sue the RIAA for spamming the Kazaa network?
Time for me to declare myself as a non-profit organization since they make ANYBODY running a server sound like a business or an organization in itself.
Should be proud of a 5 year old kid now, he runs a quake server, he's a businessman in his own right. Go government! Doing their job to encourage my kids to get into business!
"a service that enables users to access content, information, electronic mail, or other services offered over the Internet"
reword it to...
"a service that enables users to access...the Internet"
I think the list of "things" confuses the definition. but it only says things that ALLOW this access, not the services themself.
does this mean it includes MS as an IAS since they provide IE6?
PS: I hope my comment makes sense now. I posted the first version of my comment without previewing first!
Support the Chagossians
i wouldn't go spouting off about that if i were you. if your isp finds out that you are running as an "isp" they're likely to cut off yr service.
read the t&c of yr bandwidth provider!
2 1337 4 u!
Granted, I still haven't even been able to find the full text of the bill anywhere in order to verify this.
Do you really need reason for beer? Wingman Brewers
"Far more worring, is the provision of an opt-out list. If the world can see that my e-mail, even if only so that I can say I don't like spam"
A technilogical solution to this problem would be a one way hash algorithm. The government would keep a list of email addresses which are converted into one way hashes. These hash lists are given to mail list operators (read spammers). These mail list operators only have to convert an email they have and see if it's hash matches another. Thus they can't get email addresses from the opt-out list only compare with addresses they already have in their possession.
it looked like you had the subject and object backwards
Don't blame him. He's probably just from Soviet Russia.
I think Napster would have liked the definition offered. If memory serves me correctly, they tried to define themselves as an ISP to use the safe harbor clause of the DMCA...and it didn't hold up in a court room.
Ron Paul
Why should it make that distinction? A university providing access to its students, or a "free" (i.e. advertiser-supported) dial-up provider differs fundamentally from AOL or Earthlink or MSN or your local independent ISP only in its economic model.
"it seems narrowly tailored to include AOL ("proprietary content") and exclude DSL-providing Baby Bells and possibly cable companies ("not... telecommunications services")"
Broadband services usually provide e-mail service to residential accounts and assorted other services (e.g. DNS) to business accounts. I think this phrase is intended to single out the backbone operators, folks whose customers are all other ISPs.
Someone mod this up. If RIAA is spamming Kazaa, AND you are deemed an internet access provider by virtue of your allowing others to access your files, then it sounds like you could do that.
Of course, there are many reasons you might not want to do that. For instance, if you are sharing copyrighted music, they may file a counterclaim against you.
a service that enables users to access content, information, electronic mail, or other services offered over the Internet, and may also include access to proprietary content, information, and other services as part of a package of services offered to consumers.
You could consider a protocol (such as HTTP or FTP) to be a service that offers these very things, so could we possibly glean from this that only a protocol can sue? Damn sneaky if you ask me...
"I like you, but I wouldn't want to see you working with subatomic particles."
I agree... that is one downfall to my proposed solution.
However, that would require a bruteforce of going through a list (calculated or static) and creating addresses and then checking them in the hash. If they can do that (and they do already, I'm certain) then why bother with checking the list anyway to see if an address is on there or not? Unless they really do want to abide by the list, they wouldn't bother with the check and instead would just use the method you describe to send messages to.
My impression of the "anti-spam" legislation is that it is pro-spam, and one more example of U.S. government corruption.
Dave Letterman said, "When you make out your part of the check for $87,000,000,000 to help Iraq, remember that there are two Ls in Halliburton." (Halliburton is Vice-President Dick Cheney's company.)
You run a "server". It provides service through the internet. You are an internet service provider. What is the difference between your computer and any of the boxes at Google? None. You should expect and demand all the rights and privleges that your "ISP" expects and demands.
The problem is that your don't have those rights. My ISP explcilty prohibits "servers" of any sort and then blocks ports inbound and outbound to enforce the difference. It's an abuse of a public network, built with monopoly protection (cable), and an outrage.
Friends don't help friends install M$ junk.
If you read a law and can't understand it, it is by that very fact a corrupt law. The reason you can't understand the "anti-spam" law is that they don't want you to understand it. It is intended to accomplish some hidden purpose.
... it is easy to take a dictionary of common passwords (or e-mail addresses), hash it and store on a CD, then match hashes from CD with hashed e-mail list. It is much harder is hash includes even a short 'salt' prefix (for 2-letter salt your encripted dictionary will require 1,024 CDs).
OTOH, I understand that you were talking about something which is (slightly? substantially?) different, but it might be useful to keep those simple tricks from the old days in mind.
Paul B.
is it possible that if a spam relay gets placed on a public access terminal in a public library (and many rural ones don't have expertise to handle this) ...
I understand the accountability issues with this but can we deprive the public of access to information they would not otherwise be able to get.
We are at a point it seems to me of having to make hard decisions but are looking in the wrong places.
TG
That's a very good point, but you should always remember that the one thing that you should never do under any circumstances is
Mod me down and I will become more powerful than you can possibly imagine!
As with most things in American law, it isn't what is right that matters, it is who has the most money.
Because as with most things on the web, it isn't what is right that gets heard, it is what more suckers are willing to repeat.
If your service enables users to access content over the internet, then you are an IAS. That service can be part of a package that includes a dial-up/broadband internet connection, but if your only service is a "telecommunications service" then you are not an IAS.
The reasonable interpretation of this is that you have to provide something more than a mere connection to the internet. If you provide email, newsgroups, your own web portal... or any other of your own content, then you are an IAS.
This likely includes all the baby bells, all the cable companies, AOL, MSN, Yahoo, etc... It probably also includes anyone running a mail server, website or usenet server if they allow other people to use that service.
Note that it only says "package of services offered to consumers." It says nothing about charging a fee or being a publicly traded megacompany.
I am not a federal judge. What I say is only what a reasonable human being would think the statute means. As we know, the law is not always interpreted by reasonable human beings... look at that 10 Commandments guy in Alabama for instance... D'oh! He's not a judge anymore though is he?
MD5 would be a bad idea since it's optimized to be EASY to compute. For the opt-out list an EXPENSIVE strong hash can be specified. Again, remember how old UNIX crypt(3C) function was deliberately slowed down to prevent this kind of dictionary attack. Solaris manpage still says: "It is based on a one-way encryption algorithm with variations intended (among other things) to frustrate use of hardware implementations of a key search".
Actually, making this function REALLY expensive is a good way to move some $$ from spammers to chip makers and maybe even make spam unprofitable! Update list often enough and change salt values so that before every e-mail is sent an expensive hash has to be actually _computed_ (rather than looked-up in a huge database).
Paul B.
I don't even think you need to go as far as kazaa, from what I can tell a web browser would satisfy "a service that enables users to access content, information, electronic mail, or other services offered over the Internet".
As I have been reading the above comments people have said, "HEY! I am an ISP!" But there are certian legal problems with that statment. If you happen to be under a Terms of Service, like I am, they prohibt such things. So even if you do happen to get yourself declared an ISP then you are opening up yourself for a law suit from your ISP or being disconnected from the internet.
From Cox Communications acceptable use policy: "Servers. You may not operate, or allow others to operate, servers of any type or any other device, equipment, and/or software providing server-like functionality in connection with the Service, unless expressly authorized by Cox. "
Further invesitagtion revelled simular acceptable use policies. So thus the problem remains -- you claim your an ISP, your connection provider says you must not be, and then your in a quandry.
Some things to think about...
The views expressed are mine own and do not express the views of my employer.
He MAY have meant that his woody box allows HIM to access the internet, just as mine does. Also most ISPs now accept multiple users per houshold and will even supply a router to help you do that if you wish. Some people use a Linux box to do the NAT function as well. Nothing wrong with that.
If you are an ISP and want to sue, you can only sue violating spammers. But this bill defines what "spam" and "spammers" are, and it's probably not the definition you or I would use.
According to this new bill, so long as the email has an "opt out" link and is not sent to anyone on the Do Not Spam list, then that email message is not, according to the proposed law, spam.
In other words, nothing will change. And, if you live in California or Virginia, this new bill has less protection than state laws, and will override and _decrease_ your legal protections from spam.
So, the question of whether you fit the definition of an ISP is somewhat moot. Sadly, the law specifically prevents consumers and businesses from suing.
IANAL, but it seems more like a "Pro-Spam" bill than an "Anti Spam" bill to me.
Hopefully the "Do Not Spam" list part of the bill has some teeth.
from what I've gathered the law can also easily be used against grassroots political campaigns through email. E.g. postal address must be present, all headers must be correct (you sent the mail from your laptop through your gateway PC.. well.. you seem to have been forging headers..., think about NAT, ...).
It's full of traps and not in our favor. Was on DemocracyNow (dot org) with a guy from EFF yesterday. Guess most of you freedom fighters here are not very active in informing yourselves let alone fight (err, for?) freedom.
And those who now start elaborate threads about headers and all, I'm shorting the tech fluff down because it's about the POINT I'm trying to make. Discuss the point.
A part of you ("Might be a good idea", "Any law better than none", "Kill the spammers", etc) have fallen for the same propaganda that got people to accept the patriot barbe wire thing cheered at and approved of. They play on your (often righteous) complaints or fears and sneak in a traversy of a solution. Which is not designed in your interest but delivered as such surely it is.
One would think people wisen up, but it appears that "we" as "intellectuals" are actually much more susceptable to this kind of honey smearing. That should be some food for thought.
The devil is always in the details but people seem to not be able to shake off the idea that details == small things.
Well, since I have my linux machine, which is always connected via DSL, set up to also provide dialup ppp service, I am an ISP.. I set this up so that if I'm out and around town and need dialup access, I can dial into my machine and NAT through my DSL connection while also having direct access to resources on my network.. It works very well.. Since I also have accounts on my servers for my friends and family, and all of them can dial in and use this service, even under a more strict interpretation I would be an ISP..
You don't have to be a business to generate spam. All you need is a single mail server.
Are you arguing that your right to operate a personal mail server trumps my right not to receive spam?
Well, maybe you're right, maybe you're wrong.
So, welcome to the land of politics and the courts. That's how things work around here. Sometimes you win, sometimes you lose. Living in a democracy obliges you to accept the outcome, or keep on fighting for what you believe in and be willing to accept the consequences.
The alternative is to anoint someone to decide what's right and wrong. I don't like that option.
As James Madison argued, the U.S. Constitution is a means to balance conflicting interests to the benefit of the most people most of the time. It isn't a means to determine moral correctness.
-- Slashdot: When Public Access TV Says "No"
Look at pg 47, line 16:
This law kills all the state's remedies that have been developed to provide recipients a way to sue spammers. This law has lower fines. This law frekin' sucks!
What changed under Obama? Nothing Good
you meant Russia Soviet, right?
No, saying it over and over does.....
Clearly SpamCop is a service provider. No problem there.
Services like Spamcop see many copies of the same spam, so they can aggregate them up to the $1 million limitation. They see enough addresses that they can detect dictionary attacks (an "aggrivated offense"). If they use spam trap addresses, they can detect mining, another aggrevated offense.
Because SpamCop routinely informs spammers that they're spammers, they can even meet the high standard under the "special definition of procure" that places liability on advertisers only if they have "actual knowlege, or by consciously avoiding knowing,whether such person is engaging [in spamming]".
But none of this will stop the coming flood of "legitimate" spam. That, though, can be automatically filtered.
So what we need now is a service like SpamCop that sues spammers aggressively.