Slashdot Mirror
Spammer Sentencing Guidelines Released
jfengel writes "The United States Sentencing Commission has issued its guidelines for punishment under the CAN-SPAM act (PDF, beginning on page 155). You can get 5 years for a second offense or if you're spamming for fraud, child porn or other felony, or 1 to 3 years depending on how much spam you send. If Congress doesn't say otherwise, it goes into effect November 1."
Only one punishment is suitable for spammers: Death by Fisting.
Trolling is a art,
For plain advertising - Five Years is actually a decent sentance. It's really too bad that, technically, it's so difficult to catch a spammer. Especially if they route through international hosts. Sadly, this is likely to have the worst effect on those that are not technologically savvy, and know the least about how Email works.
To me, those types of people are the least of the SPAM problem.
Kinetic stupidity has a new brand leader: Allen Zadr.
What to you count as an "offense"? I would expect all spammers have sent more than 2 spam messages. Do you have to be caught, let off scott free, and then caught again before anything happens? Sounds like an easy ride to me...
They need the 2nd offense to be punished by chemical castration, as in the pourig of the gentals in caustic chemicals.
3rd offense death
Unenforceable overseas.
Still those spammers have to be caught don't they? I think it's time for all of us to see that just introducing a new law will never again be enough to stop determined, persistent, and, worst of all, quite clever folks among them do what they can. Compared with the money you still can make spamming around, 5 years are nothing, and for child porn you get even more (money, that is...).
Black holes were created when god tried to divide by zero
I'm more concerned with the rules of evidence that we need in order to bring these losers to court. The judicial system needs to produce a more concrete set of guidelines for what the average joe needs to bring to a law enforcement official (and which law enforcement office) in order to get convictions!
I place spammers right below murderers and birthday party clowns, but aren't these sentences a bit overkill?
Sometimes I wonder if the prison overcrowding problems aren't because they toss out 5 year sentences like candy to spammers (soon), hackers, and people who get caught with a single joint. Meanwhile the cliche of "rapist out in 3 years" continues to remain valid.
Is it all becoming about profits?
Lately I've been thinking about sentencing, and I see people complain about how it's unfair that non-violent crimes get just as much time as, say, a man plowing over another person at 90 mph. And then we see the CAN-SPAM act, and think that these people should get MORE time than that. It makes me wonder if our view of sentencing being linearly or otherwise correlated to the aspect of the crime is wrong.
I completely agree with the spirit of the law. I disagree on how it's being implemented. The law should also go after the idiots paying the spammers to send their unsolicited verbiage. The current laws are completely toothless if the spammer decides to start sending spam from servers out of US jurisdiction. The companies offering the products or services clogging my INBOX should be fined/prosecuted as well. There is no incentive to stop spam as things are. There is incentive to find a spammer who will be out of jurisdiction. How long do you think it will be before the better financed spammers move their servers to India or elsewhere? How long before some entreprenurial Mexicans, Czechs or Russians decide to offer their services?
(Disclaimer: I'm Mexican. I speak Russian and spend a lot of time there. I'm familiar with their technical capabilities and motivations. So don't start on "why did he singled those nationalities out?" Because in my opinion it's likely to happen. You're welcome to your opinion based on YOUR experiences.)
When the law starts going after the product or service pushers, or their credit card payment processors, I'll cheer it. I doubt the law will be applied correctly until then.
Cheers,
Eugene
http://eugeneciurana.com | http://ciurana.eu
people well stop sending me emails reminding me that my penis is too small and I have trouble getting it up. However, I'd rather the senate put in a bill that shuts up whoever it is that keeps telling all theses marketers about my small penis and erectile difficulties.
"People demand freedom of speech as a compensation for the freedom of thought which they seldom use." - Soren Kier
After all, these [naughty description]s rake in a gizorkabajizalafillion dollars from thier, erm, activities...
The problem with socialism is that they always run out of other people's money. - Margaret Thatcher
What we need is some truly old school punishment for these scum. Especially for recidivist spammer slime. I'd add :
1. Public flogging
2. Draw and quarter
3. The Rack
4. Impalement
5. Pillory
I don't know what kind of email accounts you all have, but I rarely get spam, and when I do, the filters pick it up. Sure it's annoying, but it's really not that big of a deal. We need better filtering, if anything, not 'better' legislation. I can't understand how the same people who want to keep the internet free of government influence are supporting laws to crucify spammers. Maybe after we tackle the spam problem, we can lock up those damn haxorz for life and censor all that indecent content out there. And, actually, let's do it for the whole world, not just the US.
As sick and hateful as we all find it, legit spamming (in large numbers) does seem to produce income, although it also produces dire hatred by all. It's disgusting, because the real truth here is that spamming actually targets the demigraphic of people who are truly most likely to spend their large quantities of hard-earned, overvalued, stamped, signed paper & plastic: old people in retirement, impressionable people, and young people with access to $. ... hmmm ... (imagine Gameworks spamming people with deals to take to the nearest arcade ? Or I remember for awhile that the Toyota dealer in my area had an insane family deal, buy one actual car, get the next for a dollar -- truth ! I wanted to split the cost with a friend, but neither of us had enough to pay.) Initially, I thought, "hey, this is great ... if they're just going after spammers who scam, I'll have to read more on it," but if you spam, then you're either ignoring the demigraphic, or don't care about it.
I wouldn't have much of a problem with it if it were not for the malicious nature that is ingrained within those who use it. (And in fact I analyzed what I would need to do to start it, until realizing that the services would be abused to take advantage of those who can't help themselves.) If it were more reliable and better structured, I'd feel okay with it. After all, there are hands down, enough ways to efficiently deal with it and cut down on it. A legal protocol for a spam-newsgroup system where people can filter them to various folders would be of interest to me
I hate spam, not for the fact that it hounds many of my emails with 3-10 messages per day, but because of the people who are literally preyed upon by it for their money. That is reason enough for spammers to spend jail-time, and lots of it. The government didn't go far enough.
--I gots 99 problems but a new machine ain't one!
AMD! Asus! Whoot! 6 years!
Capital punishment also happens to be barbaric according to the standards of most civilized nations on earth.
The owls are not what they seem
How about tacking on a little "not allowed to use computer systems" after the 2nd offense?
To prosecute, just follow the link.
I would agree, but in my view, at least two of these punishments should apply for each offence.
Sent from my ASR33 using ASCII
This is by much too little.
I want spammers tortured. I propose they be tied to a low voltage electric chair which is connected to a button on a website. The populace will be invited to come by and issue a non-terminal zap to the offender whenever the mood stikes them.
The War on Spam sounds great, and I'm sure every citizen is happy their politicians are taking such draconian measures. Ditto for the spam fighters, who will get nice shiny boxes and new powers to help in the fight. But it won't work and for simple reasons.
One: spammers have huge networks of zombied computers at their disposal and can send spam almost entirely undetectably.
Two: this legislation does not affect the companies actually selling their products via spam. Thus it simply acts as a darwinian filter, eliminating the spammers stupid enough to remain in US jurisdiction and allow their identities to be tracked (see point one).
Three: there are already more effective ways to get the consumers' attention, and by legislating against spam, these will simply become more used. Mainly, I'm thinking of spyware/trojans like CoolWebSearch.
A realistic attack on spam and the rest must be focussed on the people paying for such services, i.e. advertisers. They must be liable for the cost and moral damage their marketing causes, as in any other domain. Further we need some changes to the policy of "receiver pays" which is the basic reason why spam exists at all.
But as so often, this attack on spammers is too little, too late, and ignores what is a much more serious problem: spyware, trojans, and worms that spread via security holes in MSIE and Windows.
Ceci n'est pas une signature
Perhaps administor 1 ppt of arsenic for every 1 spam?
2,500,000 spams would yield near-immediate results
while half a million parts per trillion would be a slower,
but more painful death for the spammer later that week.
This is a bad, dumb, wrong law that won't work and will only be used by crackhead prosecutors to harass their political enemies.
Real spammers will simply move their base to a country that won't extradite them and has good broadband connections. Like maybe some island in the middle of the Pacific that acts as a supply and maintenence station for the major trans-oceanic internet cables. So this law won't do anything to reduce the amount of spam that gets to your PC.
I call it a 'Yuppie' law because it's one of those 'feel good' laws that make Baby Boomer mommies believe that they're solving a problem but in reality has exactly the opposite effect of what they're trying to achieve. Because the definition of spam here is so broad, the law can be used by prosecuters ( in the USA these are the government's lawyers who file charges against citizens in the courts. Unlike most other countries, in the USA, the courts are a seperate division of government from the police and the police are subject to the law as interpreted by the courts) to go after people for their lifestyle. For instance anyone sending an e-mail about an out-of-favor political position or an announcement of a demonstration could be sent to prison under a broad interpretation of an anti-spam law. And the present government of the USA is really big on broad interpretation for laws against people that it doesn't like.
So this law is stupid and worthless for what it's supposed to do, and provides a broad weapon to be used indiscriminately against citizens.
So why would anyone on Slashdot support it?
I know they're spammers, but don't you think you're being a little too harsh. I mean, imagine what it would be like to be Clippy's bitch: "I see you're picking up some soap... Would you like some help?"
Decode these
RickHunter wrote
The problem with fining the companies offering the products/services is that you've then handed their competition a great way to get rid of them. Having trouble beating a rival in the market? Hire a direct marketer in Russia, say, to send out ten million mails, carefully targetted to include government and law enforcement officers in their jurisdiction claiming to be selling their service. Watch them implode under the fines.
Kjella wrote:
Quite simply, it's neither practically or legally possible to skip establishing the chain of events. To take a classic example, referral scams. It's the referer that is misleading them to the site, not the site itself.
I disagree with both of you. All I have to do is follow the Deep Throat Watergate Principle: follow the money. All I have to do is purchase one of the products or services and follow the chain through the payment processors all the way to the source. There will be a nice money trail. That's why I said "the vendors or their payment processors in my previous post.
Cheers,
Eugenehttp://eugeneciurana.com | http://ciurana.eu
A 'Yuppie' (from 'Young Urban Professional') law is any emotional law that is passed to enforce a lifestyle affection primarily of the young and upper-middle class on the poor and lower-middle class people. It gives the Yuppie do-gooders the impression that they have addressed what they precieve to be a 'social problem' without actually doing anything about in the real world and often making the underlying problem worse.
An example would be the law that requires all children to wear bicycle helmets. Fine for yuppie mommies, they're the first to buy anything that might help protect precious little Megan and Justin. But bad for the children of the poor.
Say a cop sees a poor kid on a bicycle without a helmet. He stops the kid and gives him a big (more than $100) ticket that his parents must pay or lose their driver's license. [I know, there's no connection between the two in the real world. But yuppie mommies love to come up with creative and nasty little ways to make the poor people improve themselves i.e. see things from a yuppie mommy prespective]
The parents can't afford a $100 helmet for the kid -and- pay the ticket. So they tell the kid on the threat of a beating not to get caught by the cops for riding around the neighborhood without a helmet.
So the next time that the cops are around and see the kids riding without helmets, the kids take off in the opposite direction. Being kids, they don't look where they're going and dive right out into traffic where they get hit by a car.
The good yuppie mommies point to this incident as a reason for all kids to wear helmets and to increase the penalities on the parents of the working class children to 'encourage them to make the right choices for their children's safety'.
I know, I know, that you're all going to tell me what a shit I am and how this doesn't make any sense and , of course, kids NEED helmets and what a stupid jerk I am and how I have a serious attitude problem and how I could certainly benefit from counseling and how my own kids deserve a better parent than me and everything else...
It doesn't change the fact that we don't need any more yuppie mommie laws. You need to consider the possible side effects of any law will have before you endorse passing it.
Thank you,
We should put these guys to work doing human spam filtering. Sure, it sounds like a recipe for disaster, but just tie their pay to their performance. Let through an ad for grey-market software at huge discounts? Looks like you're gonna have to get friendly with Bubba if you want your cigarettes this week. Of course you also spot-check their rejects. Drop the email from the ex asking if you wanna get drinks some time? TWO WEEKS IN SOLITARY!
In all seriousness, 5 years ago I would have said that multi-year prison sentences for spamming would be extreme, at least in cases without other crimes involved. On its face, it's still extreme, but these guys now hold an entire communication system hostage. If sending several of them to prison for their transgressions (which ARE transgressions) can be a deterrent, then I'm for it. I think it really will be a deterrent if we can get some convictions. It's not like people spam in a brief burst of anger. These people generally have some business or technical skills that could find them legitimate employment (perhaps somewhat less lucrative, but above the poverty line) even in the lousy tech economy. I hear the porn industry does well when the economy is lousy. I'm sure my mom would much rather I manage a (legitimate) porn server farm than a spam server farm anyway.
WARNING: there is a trojan on your
Your post advocates a
( ) technical (*) legislative ( ) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
(*) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
(*) Microsoft will not put up with it
(*) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
(*) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(*) Asshats
(*) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
(*) Technically illiterate politicians
(*) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
(*) Outlook
and the following philosophical objections may also apply:
(*) Ideas similar to yours are easy to come up with, yet none have ever been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
(*) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
(*) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
( ) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
(*) Nice try, assh0le! I'm going to find out where you live and burn your house down!
sulli
RTFJ.
... or work for the RIAA.
"Mother, should I run for President? Mother, should I trust the government?"
How about a war on overreaction of an impotent legislature.
We have here a crime (since 2004-01-01) that causes, at most, annoyance.
It's very politically correct these days to hate spam. But, frankly, it's the kind of hatred that's reserved for rude drivers, cell-phone wielding restaraunt patrons and the like.
Plenty of examples have already been posted about the little old lady with the virus-infected computer or the kid with the lemonade stand. I'll not pile on here.
Who among us has asked "we the people" to throw somebody in prison for being a pain in the ass?
Dontcha think that's a little harsh?
Death penalty for parking violations and all that.
It's the responsiblity of "we, the people" to create justifiable penalties for offences, and then enforce them.
The excuse "it's too hard to catch these guys" does not justify cutting the balls off of the poor bastard we do nab.
Society at large (we call "the law") has to follow some rules, too. No unreasonable search and seizure. No cruel or unusual punishment. No taking of life, liberty, or property without due process.
"War on" [drugs, terror, drunk driving], and now spam seems, however, to absolve "we, the people" from restrictions against abuse of the individual.
"Reality is that which, when you stop believing in it, it doesn't go away." - Philip K. Dick
For a long time, I agreed spam is a problem, but I never had more than a couple dozen a day, easy enough to delete. Until this year... now I've had the same email address on my site for years now, and I always disguised it to help against spam bots, but something happened in the last six months. I started getting 10-12 spams EVERY TIME my mail client checked my mail at ten minute intervals. and I was only getting worse.
I switched hosts and had access to install SpamAssassin. Now it catches about 600 spams mails and spam mails to addresses that don't exist on my site a DAY. And still, more and more are making it through to my inbox just because of the sheer volume. And SpamAssassin has gotten a couple of real mails caught in it, but now the volume is so high I can't skim the sorted spam to double check, so I just hope anything that gets caught isn't important.
Unless they either find a way to stop it via legislation, or changing how email works to make it more secure and harder to abuse, and ISPs are pressured to not let spammers use their services, they are going to render the email system completely unusable. My business is online, I can't use a whitelist -- I have to be able to get email from potential clients and customers easily. I shouldn't have to go to this much trouble just to use email, it just isn't right.
My Webcomic: Asylum on 5th Street
A senseless waste of our tax dollars. This won't work because spammers know how to hide behind hijacked computers and open relays, etc.. Having glanced through these guides I couldn't help thinking how easy it would be to distrubute spam containing child pornography while posing as your competitor.
It's ironic that our elected officials can't take on tough issues like health care but seem to have plenty of time to pen 161 pages of rendantly abominable extraneous verbosity.
We've had the DMCA, now it's CAN-SPAM. What troubles me about these laws is that they're ineffectual. People will copy DVDs and distribute them, others will send unsolicited advertisements to any email address they can get. Relax people. This is no biggy. For the domains I manage I get about 1500 emails/day (webmaster, postmaster, admin, etc.) but I use a spam filter and a procmail script to deal with it.
What we're asking here is for the government to control what comes into our inboxes. I'm sure CAN-SPAM will be tied up in the courts for years over it's implications on the First Amendment. The whole thing is a waste of society's resources.
Have a look at the following graph showing the statistic of spam per day during the last year (thanks to Spamcop).
Clearly the CAN-Spam act did in no way reduce the amount of spam.
The 5 year and 3 year sentences are maximums set by Congress. A while back, Congress created the U.S. Sentencing Commission and laws that bound what a judge may do in a given case, based on the Commission's Guidelines. So, although a crime may be a 5 year felony, a judge can only sentence someone to 5 years if he meets the criteria set in the guidelines.
Congress was actually interested in pushing sentences up, because it wanted to appear tough on crime. Therefore, at the same time, it abolished parole for federal crimes. There is no parole for federal offenses, only a small amount of time off for good behavior, calculated through a formula.
The Guidelines end up working like Dungeon & Dragons. The crime has a base offense level, say 6. Then there are "enhancements" for various kinds of conduct. So, if you're caught (somehow) and used an innocent person's computer, you could get +4. If you use the word viagra, +1; if you misspell viagra, +2, etc. [Like, I'm wearing my leather armor, but my armor class is improved by 2 for my dexterity and 4 for my magic ring] See The Fraud Guidlines
A defendant also has a criminal history score, based on how many times he's been convicted before.
There's a table in the guidelines that cross-references offense level and criminal history to give a sentencing range in months. With a criminal history of I (they use roman numerals for the criminal history), you need an offense level of at least 11 to be certain of any actual jail time (because zone B sentences allow a convict to do "home detention"). See The Sentencing Table.
The thing is, I can't find what exactly the Commission has sent to Congress, i.e., the proposed offense levels and enhancements, so its hard to tell what the Commission has actually come up with. From what I can tell, they have decided to incorporate this offense into the the fraud guidelines. (according to this ZDnet story). The fraud guidelines are based on the amount lost and are notoriously squishy--because it is difficult to estimate exactly how much a given scheme cost.
On the other hand Italy has a law (since September 2003), which seeks up to 3 years in jail and fines up to 90.000 Euros!
Guess, which law I find better? Jail-time would be payed by us, the innocent citizen, while fines weight on the offenders pocket!
I know perfectly well that this is probably illegal. However, we all know that now spammers generally send their trash through 0wn3d Windoze computers. Is is not possible to write a slowly-propagating virus (One that will NOT cause the network to slow to a crawl) that will search out and destroy spam/spy/ad-ware on the computer?
There is no way to find the bastards or stop them from sending their trash without getting rid of their zombie networks. If you eliminate those, you might as well break their electronic kneecaps.