Virginia High Court Wrong About IP Addresses

Frequent Slashdot contributor Bennett Haselton writes "The Virginia Supreme Court has ruled that the state's anti-spam law, which prohibits the sending of bulk e-mail using falsified or forged headers, violates the First Amendment because it also applies to non-commercial political or religious speech. I agree that an anti-spam law should not outlaw anonymous non-commercial speech. But the decision contains statements about IP addresses, domain names, and anonymity that are rather basically wrong, and which may enable the state to win on appeal. The two basic errors are: concluding that anonymous speech on the Internet requires forged headers or other falsified information (and therefore that a ban on forged headers is an unconstitutional ban on anonymous speech), and assuming that use of forged headers actually does conceal the IP address that the message was sent from, which it does not." Click that magical little link below to read the rest of his story.
The first 20 pages of the decision, which are all about legal standing, jurisdiction, and overbreadth, made my eyes glaze over. I'm not analyzing those at all except to point out that on most of those issues, the lower court came to exactly the opposite conclusion from that of the Virginia Supreme Court, and there is no reason to think that the higher court is any more likely to be "correct" than the lower court (even granting the assumption that there is an objectively "correct" answer to these questions). Any time you feel intimidated by "experts," it's helpful to step back and ask whether the alleged experts even agree with each other.

Page 21 is where the technical stuff starts that we can tear apart directly. The decision says, in talking about the transmission of e-mail:

The IP address and domain name do not directly identify the sender, but if the IP address or domain name is acquired from a registering organization, a database search of the address or domain name can eventually lead to the contact information on file with the registration organizations. A sender's IP address or domain name which is not registered will not prevent the transmission of the e-mail; however, the identity of the sender may not be discoverable through a database search and use of registration contact information.

These are statements that are only true if you play some kind of parlor game to find a way to read them as "true," not statements that indicate the court knew what was going on. To review: IP addresses in the U.S. are generally allocated by ARIN in blocks to Internet service providers and Web hosting companies; these companies then lease the IP addresses to their customers. You can look up an IP address with ARIN to determine which ISP or hosting company has been assigned that particular block, but the ISP or hosting company generally won't tell you the identity of their customer who has leased it from them. And anybody can register a domain, but most domain registrars give you the option of registering the domain anonymously, so that only the registrar knows the owner's true identity. So the court's statement that a database search "can eventually lead" to contact information is correct only if you clarify that it "can" lead there, but it usually won't. As a finding of fact, this is 100% true, and about as useful as "Obama might win in November. Or he might not."

But it's impossible to defend what the court says next:

As shown by the record, because e-mail transmission protocol requires entry of an IP address and domain name for the sender, the only way such a speaker can publish an anonymous e-mail is to enter a false IP address or domain name. Therefore ... registered IP addresses and domain names discoverable through searchable data bases and registration documents "necessarily result[] in a surrender of [the speaker's] anonymity."

Now, there are two possible definitions of "anonymity" to consider: (1) you can be anonymous to the extent that ordinary citizens reading your content cannot determine your identity without a subpoena; or (2) you can be anonymous to the extent that even the government, armed with subpoenas and wiretaps, can never find out who you are. But under either interpretation of the word, the court's statement that "the only way such a speaker can publish an anonymous e-mail is to enter a false IP address or domain name," is wrong.

By default, almost all Internet users are already anonymous in the first sense, even without using forged headers or other tricks in their e-mails. When you send e-mail through your own Internet service provider's mail server, or when you log on to Hotmail and send messages from a Hotmail account, or when you lease a dedicated server from a Web hosting company and use it to send mails, the messages don't contain any more information about your true identity than you decide to put in them. Only the government could ordinarily discover your identity in those cases, by looking at the IP address that the message was sent from, and subpoenaing the Internet service provider or hosting company for the identity of the person using that IP address at that time.

But there are even ways to be anonymous in the second sense -- such that not even the government could identify you -- without resorting to forged e-mail headers. You can create Hotmail and Gmail accounts without giving the providers any of your true information. When you send messages through those services, they pass along the IP address that you used to connect to their Web sites, but you can obscure your IP address as well, by using an anonymizing proxy or a service like Tor.

Elsewhere in their decision, the court indicated that what they really wanted to protect was the right to send anonymous bulk e-mails that were political or otherwise non-commercial. But even by that standard, it's still possible to use Hotmail and Gmail together with an anonymizing proxy (the mail services do impose limits on how many messages each account can send in a day, but if you want to send bulk mails badly enough, you can always sign up for multiple accounts). And if you only care about staying beyond the reach of U.S. subpoena power, you can always sign up for a dedicated host overseas and send the bulk mails from there.

Apart from the court's misstatement that forged headers are the only way to publish anonymously in e-mail, there is the incorrect presumption that forged headers actually do afford anonymity in either of the senses given above. The court wrote, "[T]he only way such a speaker can publish an anonymous e-mail is to enter a false IP address or domain name." But while it is possible to enter any domain you want in your return e-mail address when you send an e-mail, the court apparently didn't know what it was talking about when it referred to "entering a false IP address." You can't just "enter" any arbitrary IP address when sending an e-mail. If user@domain name.com receives an e-mail, the mail server at domain name.com has to receive the message over a connection made from some other machine, and the domain name.com mail server can always see the IP address of the machine on the other end of the connection. Normally, this machine on the other end would be the mail server of the sender's Internet service provider. Or if the sender has leased a dedicated machine at a hosting company, that dedicated machine would be the one connecting to the domain name.com mail server. Some desktop spamming programs let you turn your home computer into the sending mail server, so that it connects directly with the remote mail server to send the message. In all of these cases, the receiving mail server can see the IP address of the sending machine, so a government subpoena would usually be enough to determine the sender's identity. (I know you all know this, but I have delusions that some helpful clerk will print out this article and explain this to the judge.)

When spammers "enter" false IP addresses in sending mails, that usually means entering made-up IP addresses in headers that are sent along with the contents of the message. However, these would normally only have the effect of throwing someone off the trail who opened the message sent to user@domain name.com and was reading the headers manually. Perhaps they would see some random IP addresses scattered in the headers, would go to ARIN and look up the hosting company or ISP that those IP addresses were assigned to, and would mistakenly file a complaint with that company. But the domain name.com server can always see the true IP address that the message was received from, and for people who know how to read the headers properly, that IP address will be indicated in the headers as the address that connected to the domain name.com mail server to send the mail.

So the court's statement that "the only way such a speaker can publish an anonymous e-mail is to enter a false IP address or domain name" is doubly wrong: because it's easy to send e-mails anonymously without using forged headers, and because forged headers do not in fact provide the level of anonymity that the court said should be protected anyway. The only way to truly obscure your identity by hijacking a third-party IP address without permission, would be to hack into a third party's computer, by infecting a user's home computer with a Trojan horse for example, and using it to send mail. Presumably the court was not contemplating that such an activity should be considered legal, even as a means of sending political speech.

It would presumably be unconstitutional for an anti-spam law to prohibit anonymous political e-mails which attempted to hide the sender's identity -- that is after all what "anonymous" means! You couldn't pass a law outlawing Tor, for example. But the Virginia law doesn't apply to senders merely trying to hide their identity, it applies only to the use of computers "to falsify or forge electronic mail transmission information or other routing information in any manner in connection with the transmission of unsolicited bulk electronic mail" (emphasis added). There is a difference between obscuring one's identity (which Tor and anonymous remailers allow you to do), and actively trying to frame an existing third party by using forged headers to make the mail appear that it came from somewhere else, especially when sending bulk mail, which is likely to generate complaints whether it's commercial or not.

By contrast, the Washington anti-spam law prohibits any mail which "misrepresents or obscures" the origin of the message (emphasis added). This is broader and could be construed to include a wider range of things, such as the use of overseas IP addresses to send bulk mail on behalf of a U.S. company, or the use of anonymously registered domains to hide the sender's identity. It would probably be unconstitutional to prohibit these obscuring techniques for non-commercial anonymous e-mail, which is why the Washington law specifically applies only to commercial messages.

But here I'm getting into issues like constitutional law where different experts might disagree. The clear-cut technical fact is that, contrary to the court's ruling, forged e-mail headers do not provide true anonymity when sending mail, whereas there are other, legal, ways of sending mail that do make the sender truly anonymous.

What is frustrating about the court's misstatements about IP addresses, domain names, and anonymity, is that the judge is obviously intelligent and could have understood the concepts if they had been explained correctly to him. I held some misconceptions for a long time myself about domain names and IP addresses, because the first explanations I read were incomplete or wrong, or I didn't understand them. But the mistakes in the ruling would have been caught if the judge had just showed a draft to an Internet guru and said, "Hey, can you check if there's anything wrong here?" I know, I know, that's "just not done" (and there are probably formal rules in most states against showing a draft of a ruling to a third party before publishing it, even if the third party reviewer is sworn to secrecy, as they should be). But there's nothing stopping the judge from asking a technical expert during the trial, "It seems to me that the only way to publish anonymously on the Internet would be to use forged headers in e-mail. Can you tell me if that's right before I go too far down that line of reasoning?"

I've appeared before judges in Small Claims court who did ask questions about any part of the technical issues that they wanted to understand, and were even willing to revise some prior misconceptions. But all of them, even the open-minded ones, proceed by gathering information during the trial, and then in the conclusion, spell out their argument and their ruling (during which time you're not allowed to interrupt), which is then set in stone unless you appeal. I've never seen a judge say, "Here's the line of reasoning in my head right now, and my tentative conclusion. Is there anything in that chain of reasoning that you want to dispute, before I make it final? I am not promising to change my mind just because you disagree with something. But I will take it into account." This is essentially what scientists do when they submit their papers for peer review before publishing them, to minimize the chance of making an error. Judges could do the same thing -- if not formally, because they're not allowed to show opinions to third parties, then at least informally, by running their ideas past the experts assembled in their courtroom -- to reduce the chance of making a mistake. But have you ever heard of a judge doing that?

The Virginia judges probably did about as well as one could be expected to do, having learned all these technical terms only recently, and then withdrawing to their chambers to form an argument without any feedback from any technical experts. So, given the technical howlers that ended up in the ruling, the moral is that forming an argument in isolation from experts is probably not the right way to go about it.

Comments

summary way to long.

[ZERO1ZERO]

Man, I was gonna read it, but I clicked and then by the time I scrolled down a bit, and a bit, I was too tired and/or bored to continue.

Re:summary way to long.

[rob1980]

Most /. articles that start with Frequent Slashdot contributor Bennett Haselton writes... end up that way. You can always choose not to read them.

Re:summary way to long.

[garett_spencley]

"You can always choose not to read them."

Damn. I wish someone had told me that 20 minutes ago :(

Re:summary way to long.

[nacturation]

Man, I was gonna read it, but I clicked and then by the time I scrolled down a bit, and a bit, I was too tired and/or bored to continue.

There are prescription medications to help with that.

Re:summary way to long.

[electrictroy]

>>>But the decision contains statements about IP addresses, domain names, and anonymity that are rather basically wrong, and which may enable the state to win on appeal.

So who would the State of Virginia appeal to? (just curious)

Re:summary way to long.

[elrous0]

Perhaps some contributors misunderstand the concept of a "summary." I've seen more than a few who could definitely use a primer on the effectiveness of "brevity" as well.

Re:summary way to long.

[Karganeth]

Try using spreeder. It increases the speed you can read at by a lot. http://www.spreeder.com/

Re:summary way to long.

[nine-times]

You don't have to tell us. Nobody here reads the articles or the summaries. Hell, we barely read the comments they're responding to.

Re:summary way to long.

[Obfuscant]

He lost me when he said he thought that non-commercial anonymous spam should be legal.

Re:summary way to long.

[Sloppy]

I think his best and most-core argument is right here:

There is a difference between obscuring one's identity (which Tor and anonymous remailers allow you to do), and actively trying to frame an existing third party by using forged headers to make the mail appear that it came from somewhere else

and I really wish someone had put that sentence right in the court's face.

Re:summary way to long.

[Lostlander]

That's awesome. In addition to being useful for saving time it's a great way to test how fast you can read things and still comprehend them.

Re:summary way to long.

[thrillseeker]

if by "increase the speed you can read", you mean "move eyes across words rapidly without increasing comprehension", then yeah, maybe ...

Re:summary way to long.

[morgan_greywolf]

SCOTUS, especially in a case like this where their are likely federal issues, since it involves a lil' ol' network that spans the entire globe:

Federal courts may only overrule a state court when there is a federal question, which is to say, a specific issue (such as consistency with the Federal Constitution) that gives rise to federal jurisdiction. Rulings of state supreme courts on such matters may be appealed directly to the Supreme Court of the United States.

Re:summary way to long.

[Atzanteol]

You're right. Most of us don't even finish reading the posts we're replying to either.

Re:summary way to long.

[josecanuc]

You're WRONG. It's entirely possible to produce green eggs and ham, the grammatical ambiguity notwithstanding. ;-)

Re:summary way to long.

[Sun Chi]

Of course we have to tell you: no one here reads the comments, summary, or article.

Re:summary way to long.

[omeomi]

I got about a quarter of the way down, and realized it wasn't worth continuing...

but the ISP or hosting company generally won't tell you the identity of their customer who has leased it from them...So the court's statement that a database search "can eventually lead" to contact information is correct only if you clarify that it "can" lead there, but it usually won't.

Unless, of course, you have a subpoena, in which case the ISP or hosting company will most certainly tell you. And they will likely do a database search on their own system prior to telling you. If you're trying to be anonymous, you generally want to be anonymous from the government, too...

Re:summary way to long.

[mcgrew]

I'm sorry, I wasn't paying attention. What?

Re:summary way to long.

[multipartmixed]

> You don't have to tell us. Nobody here reads the articles or
> the summaries. Hell, we barely read the comments they're responding to.

I couldn't agree more. The fact that Barrack Obama thinks he can win the election without being underhanded tells me he doesn't have the stones to be a world leader.

Re:summary way to long.

[commodoresloat]

Huh? Interesting, but it seems to actually slow me down... I think it would for most people unless you're in the habit of reading only one word at a time. But I think for most people it's customary to pick up several words at a time while reading fast.

Re:summary way to long.

[Narlaquin]

You don't have to tell us. Nobody here reads the articles or the summaries. Hell, we barely read the comments they're responding to.

It looks like you didn't even read the comment that you were writing.

Re:summary way to long.

[PPH]

Won't help me a bit. Unless it increases the rate at which I can move my lips.

Re:summary way to long.

[nomadic]

Most /. articles that start with Frequent Slashdot contributor Bennett Haselton writes... end up that way. You can always choose not to read them.

If we're going to have long articles parsing legal issues, why not have an actual lawyer write them rather than a layman like Haselton?

Re:summary way to long.

[danwesnor]

Funny, that's exacly the point I stopped readin, also. Nobody has the right to use my time without my permission, even if it's only the 1 second it takes to hit delete.

Re:summary way to long.

[value_added]

Perhaps some contributors misunderstand the concept of a "summary." I've seen more than a few who could definitely use a primer on the effectiveness of "brevity" as well.

Fair enough, but I honestly think that in this case, the overlong and verbose summary is a refreshing change. What generally and typically passes as a "story" is most often a few scant one-line paragraphs that summarises, or worse, describes and editorialises, a real event or an issue.

It's not unlike what we routinely get from an organisation like CNN, where "news" is offered up in the form of sound bites, provocative graphics, and an absurdly dramatic soundtrack. If it wasn't for the pseudo passionate mumblings and fixed but empty stares of Anderson Cooper, or the rumbling drone from Wolf Blitzer, we could step back and recognise that what's presented is mostly devoid of content.

If you think that's an exaggerated comparison, try reading future Slashot stories with lynx (or just dump it to less, like I do). By the time you find the actual content, you realise there's not enough there to even bother with. In Slashdot's case, it's a truism that what's of most value is found in the contributions of its readers. It's similarly the case that most of us wait for or anticipate a reader offering up the real meat of the story, or some unique insight into it. We don't read the articles just because we're lazy. We don't read them because what's found on the pages of Slashdot is simply better.

Think of it this way -- this may be the one time where we should be modding the summary instead of the posts!

Re:summary way to long.

[ColdWetDog]

If we're going to have long articles parsing legal issues, why not have an actual lawyer write them rather than a layman like Haselton?

Cause you'd have to be an actual lawyer to understand them. And even then, you'd be duty bound to disagree.

Re:summary way to long.

[nine-times]

I'm sorry, what were we talking about? I don't even pay attention to my own comments.

Re:summary way to long.

[Anonymous Coward]

Actually I think the point of spreeder is so you don't have to waste time moving your eyes or deciphering the font.

Re:summary way to long.

[nine-times]

Me too. I get really annoyed wehn people seem to respond half-assed to my comments, and then it doesn't make sense because it doesn't even seem like they're responding to my post or even that they read my post and it doesn't make a lot of sense either. It's I'm all liek, didn't you even read my post? Did you even read your own post?

I don't think people even read their own posts.

Re:summary way to long.

[Ihmhi]

Some of us don't even finish writing the

Re:summary way to long.

[FroMan]

Some of us don't even finish the posts we

Re:summary way to long.

[puppyfox]

Indeed. http://xkcd.com/481/

Re:summary way to long.

[FroMan]

Doh! I guess I should have looked at the other replies before posting mine.

Re:summary way to long.

[queequeg1]

For the most part, the article stays away from the legal conclusions and focuses instead on the factual bases for the legal conclusions. By showing that the factual bases cited in the decision were flawed, Haselton is trying to show that the legal conclusions must also therefore be flawed.

Ordinarily, this is a good approach. Unless, of course, the judge doesn't really care about the facts and recited them just so people wouldn't pester him about his insane conclusions.

Re:summary way to long.

[nomadic]

By showing that the factual bases cited in the decision were flawed, Haselton is trying to show that the legal conclusions must also therefore be flawed.

I think his analysis of the factual basis is a bit off-base too, though later posters have debunked it more thoroughly further down in the comments.

Re:summary way to long.

[allauthors]

To me (and IANAL as will be obvious), the VA court seems to have gotten it completely wrong not just with respect to the technological questions but with respect to the basic question of what freedom of speech entails.

Since when did the right to "free speech" include the implicit right to free anonymous speech? Sure you have the right to speak your mind, especial as part of the political process, and certainly you should be able to do so through any reasonable medium to which you have access, and certainly methods which are intrinsically anonymous are not excluded from this right, but that you should be able to do so in such a way that no one knows who is responsible for the speech via a communication medium which is intrinsically not anonymous is almost certainly not the intention of the founding fathers or advantageous to a healthy democracy.

If I choose to shout my political views down main street, I must be allowed to do so (within limits), but that doesn't mean that I can't be required to take off the Halloween mask (unless the mask is intrinsic to the message, and even then in some cases).

I'm sure there will be a hundred responses with case law that presumes to bring anonymous speech within the protection of the first amendment, so let me forestall such responses by saying that regardless of the relevant case-law, from the perspective of a healthy democracy in the 21st century, I think that freedom to speak anonymously should not in fact be considered a right even if it in law currently is considered so. The only valid argument I can see for anonymous speech is that an antagonistic government can know its enemies if anonymous speech is not protected; but a government that chooses to ignore the rights of the people to be free from government censure for political speech will just as quickly ignore their right to anonymous speech regardless of what the constitution or case law may say

.oO{Hey, that sounds about like what we've got right now anyway}

Re:summary way to long.

[queequeg1]

Could be, but then again, I didn't really understand his analysis all that well. You see, I AM an attorney and have a well honed ability to ignore whatever facts I choose so long as my version of reality is the one that prevails.

Re:summary way to long.

[Anonymous Coward]

Why didn't you use italics on the third paragraph? You're quoting from the article. Oops, I see now that you are not quoting. You are just repeating something that is in the article. Not only repeating, but you think you have made a good point. So sad.

Re:summary way to long.

[spazdor]

Exactly. I'm in the same boat, and it pisses me off SO MUCH when people misunderstand the source of the sub-prime lending crisis. I couldn't agree more.

Re:summary way to long.

[nomadic]

I'm an attorney too, which is why it especially annoys me when people get all outraged about cases that they misinterpret.

I read about 1/3 of what he had to say, but after a point I realized he was quoting way too much to maintain my interest. If I wanted to read the case I would have downloaded it...

Re:summary way to long.

[Anonymous Coward]

Understand, brother. That was one LONG post. The idea that true anonymity requires lying somewhere in a post bears the germ of truth. In an age where sites routinely claim to capture IP's from visitors, one more is required for true anonymity, however. This would mean that one would have to post from an IP that did not belong to the poster, such as an internet cafe, or some 'hotspot'. Maybe these should be protected by the first amendment as well.

Re:summary way to long.

[NoisySplatter]

No, crossing the streams is bad.

Re:summary way to long.

[Man Eating Duck]

Try using spreeder. It increases the speed you can read at by a lot.

You must be joking but...
I think this is valid only if your reading speed is very slow to begin with. People who have normal reading abilities will take in several words at a time. Your eyes are not really that sharp but your brain will help you fill in the rest, or something like that. Seeing only one word at a time seem damn inefficient to me.

The best way to learn to read faster is by reading a lot. I do, and I can easily read 800 wpm for comprehension (have tested myself multiple times), although around 650 wpm is more in my comfort zone. With that thing I have very poor, if any, comprehension at 650 wpm.

Re:summary way to long.

[Hal_Porter]

It's a bit like having Alzheimer's really. People come here to rant about the stuff that happened a long time ago that made them angry, groups they hate. Not so much the facts in the article which are mostly FUD anyway.

But like a stopped clock, sometimes slashdotters will be Insightful since the article is a dupe from a few years back when they still tried to at least skim the article.

Just a random thought ...

[oneiros27]

As much of the issue in this case seemed to involve forged headers, have any of the companies whose domain names were used in a forgery ever tried suing under slander laws?

Re:Just a random thought ...

[gnick]

There may be a few willing to try, but I'm sure they're a minority. I just logged in to my 'spam' box to check the domains being used. The vast majority seem to be legitimately registered domains selling 'R0lex R3plicas' or 'V1agra'. A small subset are from 'bankofamerica.com', 'wachovia.com', or 'easternbank.com' presumably from people who feel sufficiently isolated from a US lawsuit. The rest are from gmail or yahoo accounts or domains that I assume don't even exist. I'd be surprised if there were enough spoofed headers 'slandering' legitimate companies for a successful lawsuit.

Re:Just a random thought ...

[Anonymous Coward]

In recent months, a client of mine has been joe jobbed so heavily that they've been unable to work due to backscatter. Not only is their business name being used in connection with spam promoting online gambling sites but being self employed and relying on email for their work it's costing them money.

You hit the real problem though...

presumably from people who feel sufficiently isolated from a US lawsuit.

If ever there were a class of criminal deserving of rendition protocols and gitmo style internment...

Re:Just a random thought ...

[swingerman]

Actually, there would be no cause of action for slander on these facts -- identity theft, maybe, but not slander. Other requirements aside, slander requires an oral statement, and an email is a "written" statement not an oral one. The correct tort, if it applied, would be libel. However, the other requirements for libel would most likely not be met. The more appropriate tort would be invasion of privacy, either appropriation or maybe even false light, though those may be a stretch.

BWAHAHAHA the joke's on you!

[Anonymous Coward]

There was no such decision by the Supreme Court! I staged a man in the middle attack and FOOLED you with my forged headers!

I don't want any anonymous mail in any case.

[Gordonjcp]

If you aren't prepared to put your name to what you say, then I don't want to hear it.

Re:I don't want any anonymous mail in any case.

[Ohio Calvinist]

I think the problem here is that someday you might want to send anonymous mail of a religious or political nature and most would agree that there is merit in that not being illegal. For instance, I've sent anonymous e-mail (well, semi-anonymous, from some generic gmail account) complaining to the Health Dept. that facilities on site were not up to health code, but did not want my employer to be able to deturmine from the public records who made the complaint.

I wish that public key signing of e-mail on a massive system was possible and inexpensive (or free!) and massively adopted so that I could filter out unsigned e-mail. Right now, there isn't truly a lot of flexibility in filtering messages based on identity (or lack of identity), instead all we get are very sophisticated pattern matching methods which work well for most cases. Poorly when you monitor public facing mailboxes on an international scale where Contry-origin and english language "correctness"/buzzword filters are all you get.

Re:I don't want any anonymous mail in any case.

[PMuse]

If you aren't prepared to put your name to what you say, then I don't want to hear it.

Then, you will hear only those things that no one is trying to suppress by intimidation or retaliation.

If you don't have time for anonymous speech, that's fine. However, anonymous speech too often conveys vital information for it to be prohibited for those who want to hear it.

Re:I don't want any anonymous mail in any case.

[lysergic.acid]

that's your choice. that doesn't mean anonymous mail should be outlawed.

i think that forged e-mail header should be banned, but anonymity is an important pillar of the right to privacy.

it may not be necessary for most people to send anonymous e-mails usually, but we still live in a world in which dissidents are persecuted, sometimes even killed.

even in the U.S., if you're a whistleblower for a powerful corporation, or perhaps a powerful government organization, you may face serious repercussions for your actions. if we prohibit anonymous e-mails then potential whistleblowers might be discouraged from revealing corruption/injustice within their organization.

the fallacious "if you're innocent then you have nothing to hide" argument is naive and shortsighted. communication through anonymous channels is vital to any free society.

Re:I don't want any anonymous mail in any case.

[Anonymous Coward]

Purchase lengthening pills from me; make women happy.

Re:I don't want any anonymous mail in any case.

[brianjlowry]

Sorry about the above post. I felt the dire need to disobey you.

Re:I don't want any anonymous mail in any case.

[Rary]

If you aren't prepared to put your name to what you say, then I don't want to hear it.

Then, you will hear only those things that no one is trying to suppress by intimidation or retaliation.

Note that, according to his subject line, GP was referring specifically to mail. He was not saying that he doesn't want to hear anonymous speech in general, just not in his inbox.

I agree with him. People should have the right to speak their mind anonymously in a public forum without limitation, but I don't want anything anonymous in my private inbox.

Re:I don't want any anonymous mail in any case.

[Anonymous Coward]

Translation:

If you aren't prepared to expose yourself to arrest, detention, and possibly even torture from a potentially hostile and tyrannical government when you present sound, rational, logical arguments that oppose said government, then...well, there is no then. It's a ridiculous stance. Anonymity is essential to the function of a free state.

If you disagree, then let's take your argument to the logical conclusion. Before you make any statement, you must first provide information that will allow any person to locate you at any time.

Re:I don't want any anonymous mail in any case.

[dgatwood]

I think the problem here is that someday you might want to send anonymous mail of a religious or political nature and most would agree that there is merit in that not being illegal.

No, we wouldn't. There is no merit to that whatsoever. There are plenty of ways of communicating religious or political messages that do not require forging email headers. First, there are anonymous email accounts that do not forge anything. Second, there are anonymous blogging services. Third, there are anonymous web hosting providers. The techniques that these anti-spam laws use have no valid use except to send out mail with no way to communicate back to the original sender whatsoever, making it nearly useless for legitimate religious or political messaging purposes.

I wish that public key signing of e-mail on a massive system was possible and inexpensive (or free!) and massively adopted so that I could filter out unsigned e-mail.

Yup. I agree. However, if we get to the point where we have to start signing things to prevent spam, legitimate anonymous email will become a lot harder, and thus laws like this one actually protect legitimate anonymous speech by making it harder for people to abuse the email system in a way that causes people to overreact and block all anonymous speech. The negative consequences of spam on free speech are far, far greater than the negative effects of this law, so if this law successfully reduces spam, it has a positive impact on free speech, not a negative one.

I would also add that free speech---even free political speech---is not absolute. The Supreme Court has long held that time, place, and manner restrictions on speech are perfectly allowable. Email is a manner of speech. It is, therefore, completely reasonable to put limits on speech sent via email, so long as the restriction is reasonably narrow in scope, which these regulations are, IMHO. The court striking this down is completely unreasonable, and I would strongly encourage Virginia to ask the SCOTUS to grant certiorari on this one.

Re:I don't want any anonymous mail in any case.

[Anonymous Coward]

They are universally speaking out of ignorance (specifically, regarding the problems illiquidity of perfectly valid mortgage-backed securities) and it pisses me off to no end.

"Universally"? No. It is not only possible, but actually quite common, for well-informed people to reach different conclusions on things. Yes, even different conclusions than you.

But that anger it arouses in me does not equate to a right to ban that kind of speech (except maybe under economic terrorism laws, which I think they need to pursue, as I said recently).

Ah. They should be allowed to oppose you, except that they shouldn't. No, you moron, being against the bailout is not terrorism in any fashion and you know it.

Re:I don't want any anonymous mail in any case.

[Jaeph]

Bull.

We're mixing words and sentences up to the extent that nothing has any meaning any more. If someone wants to print anonymously, they can contact a newspaper (blog/whatever), submit an article, and be heard if the media entity will print it. Hence "publius" in the federalist papers.

But sending mail headers with fraudulant address should be "fraud" in the criminal sense and prosecuted in extreme cases.

To be honest, I don't mind a simple heading of "anonymous" - then I can screen you out without a problem. But lying is a real issue, and should be dealt with, not hidden under some glorious "oppressed" nonsense.

-Jeff

Re:I don't want any anonymous mail in any case.

[moderatorrater]

Yes, I *do* have free speech. EVERYWHERE.

No you don't. You don't have the right to free speech within my house, and I can tell you to leave my home and use force to compel you to if something you say offends me. Hell, I can make you leave my home if you refuse to say something I want you to say.

You do not have the right to free speech on my servers. If I'm running a forum and I don't like what you say, I'm well within my rights to delete your posts and ban you forever. Because I own these things, I have control over them, in many ways more control than the government will ever have. The government can only restrict certain types of speech, I can restrict any or all speech.

Re:I don't want any anonymous mail in any case.

[Rrhain]

And if my inbox were a public place funded by public money, anonymous people might have a claim to using it. But my inbox is a private place funded by my money and therefore I have the right to stop people from sending to it since it costs me money to download their message.

I have the right to block phone numbers that don't display their Caller ID from calling me. People who hide their phone number are free to call anyone they want...just not me. And that's because I'm the one paying for the line. You do not get to use my line without my permission. Why should my inbox be any different?

Contrast this with my physical mailbox: I don't pay for it (directly, at least). It does not cost me money to have somebody else send me something, in general. And even COD (does anybody actually still do that?) allows me to refuse delivery if I don't want to pay. Since it is, to some degree, a public method, people can send me things without my requesting it and I have the ability to discard their messages unread. It costs me nothing.

But because I have to pay for the network connection, because I have to pay to download your message before I can determine if I want to see it, it means I get to have some control over what gets put in it.

Your right to anonymous speech does not come with a right to an audience. You do not get to enter my home, without my permission, to try to make your case. If I want to hear your speech, I will go to where you make it.

Re:I don't want any anonymous mail in any case.

[Anonymous Brave Guy]

When you tell people they can't spam, you're telling them that they don't have the right to speak their mind to the world.

No, you're telling them that they don't have the right to make everyone listen to what they want to say... which they don't, as far as I'm concerned.

What they choose to say on their own web site, which I visit voluntarily, or in a public forum, which no-one is forced to attend, is one thing. What they shove, unsolicited, into millions of inboxes is quite another. The problem with spam is not what they say, but the push model they use to say it.

Re:I don't want any anonymous mail in any case.

[Anonymous Coward]

Great! We'll make sure to exclude you from the distribution of the federalist papers, then. Signed, the founding fathers.

Re:I don't want any anonymous mail in any case.

[_Sprocket_]

Richard Nixon could have used more people like you.

Re:I don't want any anonymous mail in any case.

[Gordonjcp]

I think the problem here is that someday you might want to send anonymous mail of a religious or political nature

Why would I want to commit an act of cowardice like that?

Re:I don't want any anonymous mail in any case.

[epee1221]

There are plenty of ways of communicating religious or political messages that do not require forging email headers.

GP was responding to the assertion that anything said anonymously is not worth listening to. He did not say one should (or should be allowed to) send anonymous messages by forging headers.

Re:I don't want any anonymous mail in any case.

[Anonymous Coward]

Well, you live in a "free" country, there are countries where you can get killed by saying what you want, or worse, re-educated.

Re:I don't want any anonymous mail in any case.

[Anonymous Coward]

What a ridiculous analogy. You're welcome to refuse or discard unread any email you so choose, just as you are welcome to refuse or discard unread any physical mail you don't like. Both activities have some investment of your time and resources.

Getting junk physical mail has a cost. It takes me extra time to fetch the useless messages -- time that I must invest before I can inspect the messages and determine that I don't want them -- and I generate additional waste which I must pay to have removed. And because of the volume of physical junk mail, I actually need a larger mailbox (or more frequent checks) than I would without junk mail.

Re:I don't want any anonymous mail in any case.

[tsm_sf]

Don't be dense, Gordonjcp (if that is your real name). It surely can't strain your imagination to consider a situation where the consequences of speaking your mind might prevent you from doing so.

It's easy to be ballsy when you don't have anything on the line, but I wonder how brave (read, stupid) you'd be if your family were in danger.

Re:I don't want any anonymous mail in any case.

[dgatwood]

Ah. I did misunderstand the intent. Thanks. Sorry if I came across as grumpy. :-)

Re:I don't want any anonymous mail in any case.

[Anonymous Coward]

You have to pay to receive phone calls? That's crazy.

Re:I don't want any anonymous mail in any case.

[DM9290]

Yes, I *do* have free speech. EVERYWHERE.

No you don't. You don't have the right to free speech within my house, and I can tell you to leave my home and use force to compel you to if something you say offends me. Hell, I can make you leave my home if you refuse to say something I want you to say.

By the same logic, I can force you to let me live in your house by saying "Nee" until you give me permission. ergo you have no private property rights.

If I'm running a forum and I don't like what you say, I'm well within my rights to delete your posts and ban you forever.

Really? If you think so. I can retaliate once again by saying "Nee".

In no case would any court of law award you damages for me saying "Nee". Just like it wont award me damages for your use of private property rights. But neither right implicitly takes precedence over the other.

As a matter of law, a clause in a contract which forbid one party from saying "Nee" would be unenforcible in court unless the utterance caused actual harm. A contract can not simply restrict speech for the sake of restricting speech. Speech is an inalienable right.

Your power to control my speech is only as great as my desire to access your private property, but at no time did I have any greater access than your arbitrary whim anyway. Likewise my ability to coerce you by saying "Nee" is only as powerful as your dread of that awful word.

Re:I don't want any anonymous mail in any case.

[moderatorrater]

What are you talking about? How would you say "Nee" if you're banned from my forum? How would you bother me by saying "Nee" if you can't come into my property? I have no idea what you're talking about, and I suspect that you don't either.

Re:I don't want any anonymous mail in any case.

[nomadic]

There are plenty of ways of communicating religious or political messages that do not require forging email headers. First, there are anonymous email accounts that do not forge anything. Second, there are anonymous blogging services

None of these are truly anonymous, however. Someone always knows which IP the mail is coming from.

Re:I don't want any anonymous mail in any case.

[dgatwood]

That's what Tor is for.

Re:I don't want any anonymous mail in any case.

[Gordonjcp]

Don't be dense, Gordonjcp (if that is your real name).

A quick google would clear that one up.
It surely can't strain your imagination to consider a situation where the consequences of speaking your mind might prevent you from doing so.

Actually, yes it can. I consider anonymous comments to be one of the most fundamentally dishonest things you can do. Fuck consequences, don't lie.

Re:I don't want any anonymous mail in any case.

[nomadic]

And whoever owns the first onion router you're transmitting via Tor with?

Re:I don't want any anonymous mail in any case.

[Anonymous Coward]

Contrast this with my physical mailbox: I don't pay for it (directly, at least). It does not cost me money to have somebody else send me something, in general. And even COD (does anybody actually still do that?) allows me to refuse delivery if I don't want to pay. Since it is, to some degree, a public method, people can send me things without my requesting it and I have the ability to discard their messages unread. It costs me nothing.

The Supreme Court disagrees insofar as your mailbox is a part of your domain and you have the - theoretical - right to refuse anything. This is a difficult-to-exercise right by the deliberate macinations of the USPO. They have a perverse incentive to maintain that loophole into your home. That said, there is cost. It takes more time to dispose of mail than spam. Most spam gets deleted automatically without my intervention. The same is NEVER said for junk mail. I take steps to reduce both spam and junk mail, but when those measures fail, the cost per piece is much higher for mail. I cannot simply discard the junk on the ground (the mailbox is not on my house's lot) and leave it there. That would be littering and the cops would look towards the recipient not the sender. For both services, I pay for a monthly that handles the transport. Garbage is about $20 a month and my ISP is $6.95 per month. SPAM is cheaper. I am not pro-SPAM, it just amazes me that someone would so hate SPAM as to irrationally defend junk mail. It is ALL a problem.

Re:I don't want any anonymous mail in any case.

[tsm_sf]

There's nothing dishonest about anonymity. It's just anonymous. I can see that it puts a burr under your saddle and a bee in your bonnet, but everyone's different (and really, really weird). I'd be interested to know why you consider it lying, assuming of course we're NOT talking about forged email headers here.


Don't be dense, Gordonjcp (if that is your real name).
A quick google would clear that one up.

That whooshing sound was the joke going over your head =(

Re:I don't want any anonymous mail in any case.

[dgatwood]

All it knows is that you sent some data somewhere. That's the whole point of Tor. No router until the final router can see either the contents of the packet or its destination, and by the time it gets to the final hop, that final router has no idea who the sender was; it only knows which router sent the packet to it, which in turn knows which router sent the packet to it, etc.

Re:I don't want any anonymous mail in any case.

[MacDork]

No, you're telling them that they don't have the right to make everyone listen to what they want to say... which they don't, as far as I'm concerned.

You're the one running a server and listening to any traffic that comes in. Your protocol is broken and you're asking for *legislators* to fix it? I know of one other group that tried to legislate a new reality... it hasn't gone so well for them. Perhaps you should put your money and mental effort into finding a better technical solution instead of dreaming of a legislative one.

Re:I don't want any anonymous mail in any case.

[nomadic]

But it also knows where the packets are coming from.

Re:I don't want any anonymous mail in any case.

[dgatwood]

Who cares. Unless it knows where the packets are going or what is in them, all that it knows is that you are using Tor for something. Period.

At best, this shows why it is important to get people to use onion routing more than occasionally so that we don't get asshat politicians thinking that discovering somebody using Tor is grounds for suspicion and a physical search and seizure just to find out what law they are presumably breaking.... :-)

The whole point of onion routing is that unless a large percentage of nodes are compromised, it is impossible to connect one end of the communication with the other, and it is impossible to connect any particular data payload with its sender. Tor is not the strongest of the onion routers, but it is likely good enough to thwart practical attacks.

Re:I don't want any anonymous mail in any case.

[Ceseuron]

Yes, I *do* have free speech. EVERYWHERE. Not just in "free speech zones". But on government-taxed paper too. Using the air you might have breathed. And yes, using your server, which CHOSE to accept my messages.

The assumption that a server accepting your message constitutes some form of approval on behalf of the recipient is an idiotic claim on your part. A server is not capable of making an independent, conscious decision and can only act within the parameters that have been given it. My email server routinely accepts a multitude of spam emails because it's doing what it's supposed to do. In this regard, the spam filter on my email server is also doing what it's supposed to do by preventing delivery of those spam emails to the intended recipient. Without the spam filter, the server would dutifully flood my users with spam because that's what it's been programmed to do. Likewise, the server itself could not accept any messages at all without being configured to run an email service. There is no sentient capacity in a server to make choices, either for itself or on behalf of a person.

Re:I don't want any anonymous mail in any case.

[Anonymous Brave Guy]

You're the one running a server and listening to any traffic that comes in.

I'm not, though, am I? And neither are almost all of the other average people sitting at home, whose Internet connections are mainly used for surfing the web and keeping in touch by e-mail. But we still get to pay — in many cases, on a meter basis — for the downloaded material.

Your protocol is broken and you're asking for *legislators* to fix it?

My protocol isn't broken, it's just being abused. If someone was driving around town in the middle of the night, shouting obscenities through car-mounted megaphones, then they would be regarded as antisocial, and the police would prevent them from disturbing the peace any further. If someone started putting offensive leaflets through a victim's door, hundreds of times per day, then that would be regarded as antisocial, and harassment proceedings and an injunction would probably follow.

There is a difference between being able to do something and using that freedom responsibly. So it goes with many things in life, and the Internet is no different. We have laws to penalise those who harm others through their failure to act responsibly, and again, the Internet should be no different in this respect. But it is still much better, IMHO, for freedom to be the default and efforts to be concentrated on holding those who abuse the privilege to account, than to make prohibitions and rules and limited functionality the default and hinder constructive use by the overwhelming majority of participants.

Perhaps you should put your money and mental effort into finding a better technical solution instead of dreaming of a legislative one.

For someone so hot on legislative philosophy, you seem to have missed the old saying about technical solutions to social problems.

Re:I don't want any anonymous mail in any case.

[MacDork]

Your protocol is broken and you're asking for *legislators* to fix it?

My protocol isn't broken, it's just being abused.

If it is open to abuse, and that abuse is making it unusable to you, it is broken. That's how the evolution of things work. Bad solutions fail and disappear, good solutions persist.

If someone was driving around town in the middle of the night, shouting obscenities through car-mounted megaphones, then they would be regarded as antisocial, and the police would prevent them from disturbing the peace any further.

That isn't an analogy, it's hyperbole. Unlike sleep, you don't have a biological need for email.

If someone started putting offensive leaflets through a victim's door, hundreds of times per day, then that would be regarded as antisocial, and harassment proceedings and an injunction would probably follow.

You cannot be serious. When you push those leaflets through thousands of doors, it's called junk mail. My mailbox is full of it right now. It has all the same characteristics of spam. It's annoying, it's wasteful, only a fraction of a percent of recipients generate a sale, and disposal of it costs me money. Guess what? I haven't heard of a single case where OfficeMax or Bed, Bath, & Beyond, etc have been taken to court for spamming my mailbox. I think the post office might even be in on the scam. I hear they actually charge these advertisers money to deliver their spam!! Can you believe that?!?

There is a difference between being able to do something and using that freedom responsibly. So it goes with many things in life, and the Internet is no different. We have laws to penalise those who harm others through their failure to act responsibly, and again, the Internet should be no different in this respect.

As I pointed out above, you're clearly arguing for a double standard.

But it is still much better, IMHO, for freedom to be the default and efforts to be concentrated on holding those who abuse the privilege to account, than to make prohibitions and rules and limited functionality the default and hinder constructive use by the overwhelming majority of participants.

So, we'd be 'free' to do whatever you say? Greaaaat! And I'm sure you'll find a legislator who's willing to smile and nod for the right price.

Perhaps you should put your money and mental effort into finding a better technical solution instead of dreaming of a legislative one.

For someone so hot on legislative philosophy, you seem to have missed the old saying about technical solutions to social problems.

People trying to make a living by selling stuff isn't what I would classify as a social problem. Junk mail is as old as mail itself. You're looking at this completely backwards. Your only hope to truly defeat spam would be to offer a better solution than spam. Simply trying to remove junk mail without having a replacement plan is like the RIAA trying to stamp out piracy without offering any alternatives. Either that, or you can quit whining about the failings of SMTP and use/invent a different protocol. Those are your two basic choices. Legislation is a waste of time, money, and effort as this story plainly illustrates.

Re:I don't want any anonymous mail in any case.

[Anonymous Brave Guy]

That isn't an analogy, it's hyperbole. Unlike sleep, you don't have a biological need for email.

No, but I imagine in today's society the majority would consider it an important communications channel, like the postal service or telephone. It has important practical uses, and improves quality of life generally.

My mailbox is full of it right now. It has all the same characteristics of spam. It's annoying, it's wasteful, only a fraction of a percent of recipients generate a sale, and disposal of it costs me money. Guess what? I haven't heard of a single case where OfficeMax or Bed, Bath, & Beyond, etc have been taken to court for spamming my mailbox.

Then your country's laws suck. Physical mail, as you say, has much the same characteristics of spam. My country has chosen not to accept the annoyance to the general population, and one quick trip to a web site put my address on a compulsory no-junk-mail list. Telephoning me for marketing purposes is also against the rules, via the analogous preference service, again activated by one quick trip to a web site. Anyone violating these prohibitions is liable to substantial financial penalties.

As I pointed out above, you're clearly arguing for a double standard.

No, I'm being perfectly consistent, and you're ill-informed and making a typical slashtroll assumption that everywhere in the world works like wherever you live.

So, we'd be 'free' to do whatever you say? Greaaaat!

I'm sorry, but I think you missed my point here. I prefer the current system, where the default is that anyone can e-mail anyone else for any reason, and we only prohibit specific harmful actions. Any alternative, if we followed your suggestion and changed the protocol to avoid abuse, would surely be more restrictive by default.

Your only hope to truly defeat spam would be to offer a better solution than spam.

Oh, I think imposing draconian penalties on those who go around making countless others' lives less pleasant would help, too. This is how laws normally work. It's a combination of deterrence and, if that fails, active prevention through loss of liberty.

The problem is that right now, we don't seem to be able to do that, mainly because people like you seem to think the law should provide a right to harass everyone else with impunity.

Simply trying to remove junk mail without having a replacement plan is like the RIAA trying to stamp out piracy without offering any alternatives.

Well, not so much, because at least in the RIAA's case a substantial proportion of the population clearly feel justified in violating the current system for one reason or another. (As it happens, I don't believe most people really think such behaviour is ethical, and I think people who illegally copy music should be penalised effectively as well. I'd just like the see the RIAA suffer a multi-billion dollar penalty for illegal price fixing and violation of competition laws to go with it.)

In any case, I rather doubt that a similar proportion of the population welcomes the junk mail it receives. Junk mail is nothing but a small group of selfish people harassing innocent bystanders against their will, and should be treated accordingly in law. It is, at least in my country, in every case but on-line.

Re:I don't want any anonymous mail in any case.

[MacDork]

Your only hope to truly defeat spam would be to offer a better solution than spam.

Oh, I think imposing draconian penalties on those who go around making countless others' lives less pleasant would help, too.

Ever heard of a bot net or an anonymous proxy? Stopping spam with legislation is not possible. If you live in such a progressive nation, tell me... where are your spam laws? How come they aren't working? Shouldn't you be emailing happily and spam free thanks to your great legislators? Why are you here complaining? By your own logic, you should be spam free by now. What went wrong?

Simply trying to remove junk mail without having a replacement plan is like the RIAA trying to stamp out piracy without offering any alternatives.

Well, not so much, because at least in the RIAA's case a substantial proportion of the population clearly feel justified in violating the current system for one reason or another.

That's why Apple's iTunes store went out of business... oh wait, it didn't. Apple became the number one music retailer in the US by competing with "free music" head on. Obviously, Apple offered people something piracy doesn't give them. So much so that they were willing to pay for it, and purchase from Apple in lieu of traditional means. Your logic is failing again.

Your other mistaken assumption here is that spammers are some small minority. Big successful spammers may be few, but small time spammers who would take up the torch in their absence are legion. You aren't going to take down a handful of spam kings and solve the problem. Tough laws and taking down Napster didn't solve the piracy problem.

Spam is Evil

[Dr.D.IS.GREAT]

It is my firm belief that I would tread on the rights of others to prevent spam. Spam is a cancer of ISPs and most importantly it is god damn annoying!

But the real problem is nigerian 419 spam. Those evil little pygmys have ripped off Americans and other bloats for a while. I think maybe the government should step in and do something about it. Too many old men think they are falling in love with a attractive online retailer entrepreneur and turning into stolen merchandise drop sites and distributors.

When will the government or hacker community do something about it?

Dr. D

Re:Spam is Evil

[ivandavidoff]

There are no pygmies in Nigeria. If you are receiving Nigerian spam sent by pygmies, the headers are forged.

Re:Spam is Evil

[Dr.D.IS.GREAT]

<quote><p>I would tread on the rights of others to prevent spam</p></quote>

<p>Then I am glad you are not in government.</p></quote>

Well, how does your confidence treat you when you DL 4000 emails everyday telling you, "She wants MORE" and buy these pecker-picker-upper pills.

What I ment about treading on the rights of others: We have Dept. Homeland Sec. wire tapping and all that bullshit making sure Kumar isnt gunna blow him self up in the subway. This is done very sketchy by the govt, and it supposedly keeps us safe... NOW! the govt should kinda wire tap emails in a way, find out where the repeat spam offenders are coming from and take em out. If we can shit 2 billion dollars on bagdad we can shit 2 million in finding spam shops and shutting them down, especially the 419 crowd. If the govt has to break into a few out boxes to find out where the spam is coming from, be my guest; I will be the first one to give up my usrname and pswd for 10 minutes...

uh...

Dr. D

I disagree

[Anonymous Coward]

If you aren't prepared to put your name to what you say, then I don't want to hear it.

Tell that to all the Iraq war protesters (when it first started) who had their houses vandalized and were assaulted because of their views.

Or the folks who disagree with their Governments and are being watched, were tortured or killed.

Or how about being an atheist in a theist country and trying to get work - outside of working for Bill Maher.

Just saying.

so to summarize TFA ...

[un1xl0ser]

tl;dr

State Supreme Court, State Law

[John Hasler]

> ...which may enable the state to win on appeal.

This is the Virginia state supreme court ruling against Virginia state law. Just who do you think they are going to appeal to?

Re:State Supreme Court, State Law

[KiahZero]

The state can appeal to the USSC, since it's a state court applying federal law (the Constitution).

Whether or not the USSC will actually grant certiorari (hear the case) is another matter entirely.

Re:State Supreme Court, State Law

[idiotnot]

Yes, and the court wrote that SCOTUS is more likely to be on their side; the federal courts would prefer that state courts not interpret federal constitutional issues narrowly.

What will happen is that the General Assembly will revise the law, limiting it to commercial e-mail. Unfortunately, the way Virginia law works, spammers again have free reign until 1 July.

It's a court, what do you expect?

[Gothmolly]

This is the same court system that required a server's RAM to be held as evidence, since it was a data-storage device.

Someone will challenge this, and the State will lose. That's the way the system works.

i agree with the summary for a change

[timmarhy]

spam != anonymous mail or free speech. for a start it's not anonymous by it's very nature - they WANT you to contact them and know who they are. it's also not free speech, because free speech means i'm free not to listen or help you in anyway. spam intrudes on my inbox.

Re:i agree with the summary for a change

[Anonymous Coward]

As I understand it, the law as written only required the forgery of headers. This is a resonable analysis of that rule as a barrier to anonymous speach.

Now you are suggesting: that spammers are not anonymous because they want you to contact them.

Well, ok a few points:

  - Just be cause they want to contact you doesn't mean they don't want to be anonymous (of course they do!)
  - Lets say they didn't want you to contact them back, and the speach wasn't fraudlent or commerical or something else we don't like.... it was in fact maybe important political speech! The law still applies right?? In that case the law is wrong, and the court was right. In other words the legislators, industry people, etc didn't think enough about The Law when they wrote it. People then whine about The Courts. Who now have a Big Mess. Fundamentally courts are not supposed to make laws. They are supposed to tell the lawmakers they fucked up and they need to fix the mess when they have.

Now I think the analysis is good, and perhaps the courts analysis would be different if the government hadn't been so successful in forcing ISPs and business to keep records and fundamentally limit the possibility for anonymous speech so much.

We know Nixon had an enemies list. Do we really think Bush is different? We know TIA exists. We know the president has fought to put as much of this data as possible under unsupervised extra-governmental places so it can be accessed without oversight. This is _bad_ for America.
Yes SPAM is bad and annoying, but get the laws _right_.

Garick

Re:i agree with the summary for a change

[Mitreya]

or a start it's not anonymous by it's very nature - they WANT you to contact them and know who they are.

You would think so... many of them advertise as referrers (have the damn referrer ID in the link), so they don't want you to contact them, just to click and pass their mostly anonymous referrer ID to the seller.
And then there's the stock pump and dump schemes that don't want you to contact them.

Re:i agree with the summary for a change

[Anonymous Coward]

By that logic, any speech that one disagrees with is not free speech, as it intrudes in the "inbox" of our head.

However, I do agree that spam != anonymous, free speech, because of the fact that it is commercial in nature.

This summary is incredibly naive

[Anonymous Coward]

First of all, I think anyone interested in sending anonymous emails containing criticism of the government will agree that opening up a Hotmail account won't cut it. Nor does it make sense to do this through Tor and hope that the service works correctly, has no security vulnerabilities, etc when you can just forge some headers and get direct access. Finally, what makes you think that people will only do this from their home PC? What if someone goes to a cafe, or rides by an unsecured wifi spot, or something like that? Not to mention that for some protocols (maybe not mail), you could spoof your IP address.

IP address tracking

[ilovesymbian]

So they think IP addresses are like ID cards and nobody can spoof them... shows the sorry state of affairs and why we get so much spam and nobody is accountable for it and why they can't catch the spammers.

Re:IP address tracking

[pryoplasm]

By the same token, can no one spoof ID cards?

Re:IP address tracking

[kayditty]

it would be incredibly difficult to spoof an IP address over the internet to engage in a TCP session, in a real application. I sincerely doubt anyone has ever been close to doing it.

They're shooting themselves in the foot

[David Gerard]

Virginia needs to consider the economic benefits of spam.

You might want to stick with what you know

[KiahZero]

IANALY, because I have another 1.5 semesters and a bar exam to go. However, I still know a lot more about the law than you, which is why I know things like this was a VA Supreme Court case, not a trial.

Appeals don't work like your small claims cases (thank the gods). You have written briefs from the parties and any interested amici curiae, which is where your technical experts come in. The "trial" is oral arguments before the justices (not "judges") of the VASC, where the two parties have fifteen minutes to emphasize certain parts of their cases while the justices interrupt with questions as the mood strikes them. Typically, this is where the justices ask for further explanations of the arguments in the brief, generally about things that seem not to make sense or could use further clarification. Sometimes, justices will ask questions that draw better arguments out of a party, so as to convince other justices around to their way of thinking.

A justice would never ask, "Well, I'm going to rule this way; what do you think," because that's not the appropriate language for the Court; you're confusing a peer-to-peer relationship with one that is decidedly not. The attorneys for the parties aren't peers of the justices, and the amici aren't peers of the justices. Your role as party or amici is to provide the justice with the information the justice wants in order to come to a conclusion. However, justices will ask questions to get at facts they need, and a skilled lawyer will be able to figure out where a justice is headed from a question, and explain why that reasoning is good or bad.

It's all well and good to have a layman's critique of the system, but it would help if the layman wasn't basing his opinions on completely irrelevant experiences and actually knew something about the system he was critiquing. Hell, even a quick Wikipedia search would have prevented basic misunderstandings about the nature of the court: http://en.wikipedia.org/wiki/Supreme_Court_of_Virginia

Re:You might want to stick with what you know

[Anonymous Coward]

A justice would never ask, "Well, I'm going to rule this way; what do you think," because that's not the appropriate language for the Court; you're confusing a peer-to-peer relationship with one that is decidedly not.

Since that's the same thing that the summary says, I don't think he's the one that's confused. If you read that badly I don't think I would want you for a lawyer.

Re:You might want to stick with what you know

[KiahZero]

But the mistakes in the ruling would have been caught if the judge had just showed a draft to an Internet guru and said, "Hey, can you check if there's anything wrong here?" I know, I know, that's "just not done" (and there are probably formal rules in most states against showing a draft of a ruling to a third party before publishing it, even if the third party reviewer is sworn to secrecy, as they should be). But there's nothing stopping the judge from asking a technical expert during the trial, "It seems to me that the only way to publish anonymously on the Internet would be to use forged headers in e-mail. Can you tell me if that's right before I go too far down that line of reasoning?"

Re:You might want to stick with what you know

[Anonymous Coward]

I have an idea, why don't you save us all and just die in a fire.

Re:You might want to stick with what you know

[CodeBuster]

That is an interesting point and while there is apparently a shortage of law geeks here on Slashdot (I do happen to know someone with both a law degree and a PhD of CS, but that is probably fairly rare) we IT and developer geeks do provide, collectively via the comment and moderation system here on Slashdot, good technical commentary and fact checking which might be useful to your justices as part of an amici curiae brief in order to more fully inform them of the technical background and basis for arguments presented by the attorneys.

Re:You might want to stick with what you know

[wasexton]

This is EXACTLY the problem. The "justices" do not know the subject matter they are making rulings about. They may know the law, which is their subject matter expertise, but by not consulting an expert in the subject they are trying to base an opinon about, their opinion holds about as much weight (or should) as the IANAL comments on this forum.

Just my 2 cents.

Re:You might want to stick with what you know

[Intron]

It's not the justice's job to go find out technical details. The lawyers making the case need to hire the experts if necessary and present the relevant facts to them in the briefs. If a brief is wrong or misleading, then the other side needs to point that out, not the justices. They aren't ruling on facts, they're ruling on law. If a brief says that 62,283,583 is prime the justice is not obligated to try and factor it.

Re:You might want to stick with what you know

[Ed_Pinkley]

They aren't ruling on facts, they're ruling on law. If a brief says that 62,283,583 is prime the justice is not obligated to try and factor it.

But it would be realy cool if he said, "7883 times 7901 is 62,283,583. YEAH!! In your FACE!"

ED

Not too surprising...

[Anonymous Coward]

You take a bunch of old lawyers that have no concept of how technology works, mix in some ego, and have them make decisions on it. It's only going to be right by accident.

Re:Not too surprising...

[Anonymous Coward]

You take a bunch of old lawyers that have no concept of how technology works, mix in some ego, and have them make decisions on it. It's only going to be right by accident.

You just described Congress.

Re:Not too surprising...

[thrillseeker]

s/technology/economics/

short summary of current national politics

Not Quite wrong

[TotalRebel]

IP and MAC address can be spoofed, so that the ISP will not know the true address and location of the originating client endpoint. Also if WiFi is used, then it becomes easier to hide the true endpoint from the ISP and mail server.

Re:Not Quite wrong

[RAMMS EIN]

Actually, _can_ IP addresses be spoofed for the purpose of sending email? AFAIK, you need to be able to receive and interpret responses from the server to be able to send email. Can you do that with a spoofed IP address?

What Courts Know

[ari_j]

A court is generally not supposed to know anything that's not brought to its attention in the case, other than legal issues which the court is supposed to know all about. If a court issues an opinion in which it is wrong about how e-mail and IP addresses work, that is simply because one of the following things went wrong:

• The court took judicial notice of something that is at odds with reality (this would be extremely rare, as what courts can take judicial notice of is very limited in scope; also, one of the attorneys would normally have had to ask the court to take such judicial notice, although it could do so sua sponte)
• One of the lawyers argued the issue and got it wrong, and the other lawyer(s) failed to point out the error
• Evidence supporting the wrong finding was presented by an incompetent expert witness
• The finder of fact at trial (jury or judge, depending on the specific case) interpreted the evidence wrong
• The appellate court decided that the finder of fact at trial interpreted the evidence so horrendously wrong as to justify overturning the factual decision and coming up with the wrong answer in the process

On technical matters, when a court gets it wrong it is usually not the court's fault.

Re:What Courts Know

[plsuh]

On technical matters, when a court gets it wrong it is usually not the court's fault

As someone who has submitted testimony as a paid expert witness in court cases, I can tell you that often it IS the court's fault. The education of some of the members of the judiciary on technical matters (and not just computer technical matters) is abysmal. There was a judge who ruled that interest on the damages that our client owed should be handled by just doubling the damages. This was completely unfair to our client since it implied an annual interest rate of something like 25%, at a time when the inflation rate was only 3% and AAA bonds were paying something like 4.5%. We had to go through several days of work, filing a petition for reconsideration, and a hearing to correct what should have taken 5 minutes and a calculator, or 30 seconds and a spreadsheet.

I can well believe that the justices got it dead wrong. Very often the judges do not even know the correct questions to ask of the parties to clarify their misunderstandings. There are normally provisions for judges to appoint special masters who have the technical expertise to advise them, but all too often the judges do not avail themselves of them. See the whole train wreck surrounding the Daubert ruling.

Is there any hope? The point of judicial review is to catch errors, but in this case the appellate layer made its own very bad error. We should always remember that judges are human -- and thus are fallible and have friends. With any luck, a neighbor or buddy of one of the justices will point out the error and say, "Joe, you really, really got it wrong there. You need to take that back and re-do it." And these people actually do listen, as they are human.

--Paul

The best way I've seen to sum this up...

[Arrogant-Bastard]

"Spam and other forms of abuse are not speech, just as a brick with an attached note thrown through a window is not publication." If that's correct, then the 1st Amend. doesn't apply and the whole argument can be tossed.

Re:The best way I've seen to sum this up...

[stubob]

Throwing it through a window means destruction of property. Maybe we can charge them with littering?

Re:The best way I've seen to sum this up...

[Anonymous Coward]

you are wrong. douche fuck. And I would put it on a brick and throw it through your email if i could.

Correct by Definition

[John Hasler]

> The first 20 pages of the decision, which are all about legal standing, jurisdiction,
> and overbreadth, made my eyes glaze over.

So legal stuff makes your eyes glaze over and yet you are going to give us your legal opinion. Right.

> I'm not analyzing those at all except to point out that on most of those issues, the
> lower court came to exactly the opposite conclusion from that of the Virginia Supreme
> Court, and there is no reason to think that the higher court is any more likely to be
> "The first 20 pages of the decision, which are all about legal standing, jurisdiction, and overbreadth, made my eyes glaze over. I'm not analyzing those at all except to point out that on most of those issues, the lower court came to exactly the opposite conclusion from that of the Virginia Supreme Court, and there is no reason to think that the higher court is any more likely to be "correct" than the lower court (even granting the assumption that there is an objectively "correct" answer to these questions). correct" than the lower court (even granting the assumption that there is an
> objectively "correct" answer to these questions).

The Virginia Supreme Court is the ultimate authority on matters of Virginia state law. Where Virginia state law is concerned what the Virginia Supreme Court says is "objectively correct".

If the court had upheld the conviction then the defendant could appeal to Federal court on the grounds that the law violates the First Amendment. However, since the court overturned the conviction the state has no grounds for an appeal to Federal court because there is no Federal question.

I agree that there may be flaws in the court's reasoning, but the nearest thing to an appeal is for the state to ask the Virginia Supreme Court to re-hear the case.

Re:Correct by Definition

[KiahZero]

VA could also appeal to the USSC, since the decision was based on an interpretation of the First Amendment.

Re:Correct by Definition

[Thad Zurich]

The Legislature is the check and balance against the Supreme Court. I'm not suggesting impeachment, just that they clarify the law, which should include technically-vetted definitions of the terms use erroneously by the court.

speaking of anonymous emails

[Liath]

did anyone else wake up to 26,300 or so emails from false IP addresses in Stafford County, VA?

appeal

[PMuse]

. . . which may enable the state to win on appeal.

What appeal? Think the US Supreme Court is going to take this case? Possible, but unlikely.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Impossible to defend?

[Schraegstrichpunkt]

But it's impossible to defend what the court says next:

As shown by the record, because e-mail transmission protocol requires entry of an IP address and domain name for the sender, the only way such a speaker can publish an anonymous e-mail is to enter a false IP address or domain name. Therefore... registered IP addresses and domain names discoverable through searchable data bases and registration documents "necessarily result[] in a surrender of [the speaker's] anonymity."

Impossible to defend? Just watch me.

You're overlooking a perfectly reasonable generalization that the judge is making. The IPv4 packet headers and the email headers, to the judge, are one and the same: Both can be used (indirectly) to identify the sender of the email, and both need to be "forged" in order to send anonymous email.

Keep in mind that tunnelling your packets through a proxy effectively "forges" the IPv4 source address, since the communication is actually originating at your computer, but on the receiving end, it shows up as being from the proxy, even though the communication actually originated elsewhere.

The judge was right to point out that you can't communicate on the Internet without including some kind of "sender address", and this address needs to be forged in order to use the Internet to communicate anonymously. As far as his argument is concerned, it doesn't matter whether the headers you're forging are specified in RFC 791 or in RFC 822.

Re:Impossible to defend?

[Anonymous Coward]

Just a note, tunneling through a proxy will not complete obfuscate the source address, it simply overlays them. The original IP, whether on an internal private system or a global IP, will still be decodable within the packet headers.

I find that if you telnet or use remote desktop, etc. to a server you can then use the browser on that server and you troubles go away.

If you wish to be anonymous even for business, there are states that allow business to be setup without named owners... You need a lawyer to set it up, but technically the lawyer can't divulge your names and few judges would try to make them... This anonymous company can then setup a mail server using an IP which they can acquire direct from ARIN and even get an internet line. The server can be in a server farm, almost anywhere, I had a California IP in Tokyo... which worked great from some things I needed... Anyway, you can send all the anonymous e-mail, commercial or other you like... privately held businesses do not have to maintain access logs either, ISPs do... So you could lease access to customers without logging and rather than you actually sending any commercially anonymous e-mail, you simply provide a medium for customers to do so...

Of course I don't condone spam or anonymous e-mail, but when you want to tell the boss that he bites... its nice to not get fired...

Did someone say Roswell Aliens? What's that guy smokin'?

Re:Impossible to defend?

[Cormacus]

Keep in mind that tunnelling your packets through a proxy effectively "forges" the IPv4 source address, since the communication is actually originating at your computer, but on the receiving end, it shows up as being from the proxy, even though the communication actually originated elsewhere.

No. No, no, no, wrong. It does not in any way "forge" the source address, because it is a record of the source address of a transaction that actually took place. It is in no way a forgery of any kind. It conveys no useful information about the actual identity of the originator, but it in no way constitutes a forgery.

Re:Impossible to defend?

[kayditty]

Just a note, tunneling through a proxy will not complete obfuscate the source address, it simply overlays them. The original IP, whether on an internal private system or a global IP, will still be decodable within the packet headers.

no, it won't. you have no idea what you're talking about. perhaps you're referring to some very specific, incredibly small subset of "proxy," such as 'this HTTP proxy which records the originating IP address in an HTTP header,' which has nothing to say of lower-level or protocols or other kinds and implementations of proxies.

It is probably possible, actually, to inject data into an IP header, though that would be more of a trick than anything (an interesting experiment on cryptology or stegonography, which I'm now excited to try out, having just really thought of it), but there is nothing "encoding" addresses in anything, apart from some superficial X-Originated-For or whatever headers which some particular proxy decides it wants to add.

as far as differently configured HTTP Proxies and Squids go, or SOCKS proxies, or telnet-based proxies (WinGate), or web proxies (CGI), or anonymizing services (Tor), there is absolutely nothing indicating the origin of communications to the endpoint. in the event of Tor, it would even be impossible for the exit node to KNOW who was the originator of communications, unless it had explicitly contrived to give that information out.

This anonymous company can then setup a mail server using an IP which they can acquire direct from ARIN and even get an internet line. The server can be in a server farm, almost anywhere, I had a California IP in Tokyo... which worked great from some things I needed... Anyway, you can send all the anonymous e-mail, commercial or other you like... privately held businesses do not have to maintain access logs either, ISPs do... So you could lease access to customers without logging and rather than you actually sending any commercially anonymous e-mail, you simply provide a medium for customers to do so...

umm.. it is increasingly hard to get a block directly from ARIN. they don't [generally?] deal with blocks smaller than /16s these days, as far as I know. it is still possible to do, however. but 99.99% of people obtain their netblocks from a lower level ISP. in any case, there is no such thing as a "California IP," which is one of the things this article hinted at, but didn't really get into. that is nothing more than another ridiculous obfuscation. IP addresses on the internet have absolutely nothing to do with physical locations. WHOIS records are only used for contacting the organization which has registered that netblock, and, in the case of a person obtaining his IP addresses from the ISP, it may not even be possible to identify that person's general network, let alone his individual identity, without a subpoena.

this was always the case. it is clear to anyone who knows anything about the internet (like the guy who wrote this article does) that there is no such thing as a "California IP" or a "Denver IP," but rather that these are mere conveniences for establishing a chain of authority. there's, in fact, little difference from using a netblock registered by a California-based organization in Tokyo than using a machine on an IP block registered by a California-based organization in Tokyo through a proxy. the major difference is that it would be much harder to find out who you are in the latter case than in the former. BGP doesn't care where you live, but, of course, [the lack of] international cooperation is always helpful in obfuscating things.

Re:Why All Bailout Packages Will Fail

[cmacb]

Maybe I'm projecting my thoughts too much on the rest of the populance, but I know very few people my age (~30 years old) who have even started building a family, and that's quite frankly, distressing. The economy isn't everything. We will survive. The crash will happen. Let it happen swiftly and let the recovery happen in the near term.

I don't know what this has to do with the subject at hand, but I agree with you to some extent. I don't agree that it has to do with people addicted to their jobs, although there are certainly people who are. There are also people addicted to the Internet, or addicted to TV viewing or going to those bars you mentioned. If the people who promote the abandonment of religion (and that would be the majority here on Slashdot) can't find a substitute better than just sitting all day hitting refresh on your browser, I don't think there is much hope for things improving.

I'm not saying necessarily that religion is the answer (although it certainly is an answer). But I see few alternatives presenting themselves. Marx said that The State would for a while become our religion, and I don't care what anyone here claims, we are going down the same path as the Soviet Union, only without a bloody revolution. Der Spiegel is today celebrating the death of capitalism and American dominance, except we haven't been practicing capitalism since the 1800s. Popular belief among American "intelligentsia" is that we now have the power to control every aspect of our society and I foresee that after the next election any failure of such control will simply engender a feeling that the controls weren't strict enough. That's what I'm seeing every day in the mainstream media.

That control, ever more sophisticated, will soon, even if it hasn't already, make anonymity impossible. The novel 1984 may have been a failure in terms of the timing, but I don't think it is far off the mark in terms of where we are going, and the direction as well as end-point to me seems fairly inevitable.

I think I have accidentally wandered back on-topic, my-bad.

Armchair Quarterbacking

[Valdrax]

The first 20 pages of the decision, which are all about legal standing, jurisdiction, and overbreadth, made my eyes glaze over. I'm not analyzing those at all except to point out that on most of those issues, the lower court came to exactly the opposite conclusion from that of the Virginia Supreme Court, and there is no reason to think that the higher court is any more likely to be "correct" than the lower court (even granting the assumption that there is an objectively "correct" answer to these questions). Any time you feel intimidated by "experts", it's helpful to step back and ask whether the alleged experts even agree with each other.

Well this quote really gets the article started off with a bang. First of all, the expertise of a trial court and a state supreme court should not be presumed to be equal. A trial court judge could be as fresh as the day is young, but a supreme court justice there has to be elected by the legislature and has to go through a vetting process that favors experience.

This sort of "all experts are equal" attitude confuses issues like global warming, where there are clearly people more knowledgeable about a subject than others, but the public is tricked into believing that "balance" demands we treat anyone with an opinion as equal to anyone else.

Now, there are two possible definitions of "anonymity" to consider: (1) you can be anonymous to the extent that ordinary citizens reading your content cannot determine your identity without a subpoena; or (2) you can be anonymous to the extent that even the government, armed with subpoenas and wiretaps, can never find out who you are.

For purposes of government action against citizens violating the law, the latter is the only one that matters. (Well, that plus what the government can't find out without violating the 4th Amendment.) The former is of little relevance. The courts shouldn't rest all First Amendment protections on whether or not the average person can figure out how you are instead of the bodies entrusted with the duty to enforce the laws against you. Otherwise, anonymity would be meaningless in a legal sense except as an excuse to provide a mirage of privacy for citizens.

But there are even ways to be anonymous in the second sense -- such that not even the government could identify you -- without resorting to forged e-mail headers. You can create Hotmail and Gmail accounts without giving the providers any of your true information.

Courts generally will not favor solutions that revolve around you fraudulently entering into an agreement with email service providers who require you to provide accurate information when signing up and agreeing to their service contracts.

Furthermore, you always have to give an email address for confirmation when signing up for such services, and eventually if you peel back enough layers of registration, the courts can find out an account where you had to give real information to someone (whoever you pay for your initial email account), so this is no guarantee of privacy at all.

In all of these cases, the receiving mail server can see the IP address of the sending machine, so a government subpoena would usually be enough to determine the sender's identity. (I know you all know this, but I have delusions that some helpful clerk will print out this article and explain this to the judge.)

Didn't you just completely defeat this argument by mentioning the use of Tor a few paragraphs above?

Also, while the court is interested in protecting legitimate political or commercial speech (and thus speech not made by illegal activities), most spammers "fake" IP addresses by sending mail from virus hijacked machines, so a government subpoena is useless to find their identity in the case of a real spammer.

It would presumably be unconstitutional for an anti-spam law to prohibit anonymous political e-mails which attempt

Re:Armchair Quarterbacking

[0111 1110]

Courts generally will not favor solutions that revolve around you fraudulently entering into an agreement with email service providers who require you to provide accurate information when signing up and agreeing to their service contracts.

But of course they have no problem with you sending out millions of emails with inaccurate fraudulent information asserting that you are someone who you are not. In fact it is far worse because it is quite likely that the forged headers do in fact represent the identity of some innocent party, whereas supplying "Fred Flintstone at 1010 Bedrock Place" for an identity to the email provider doesn't involve an actual 3rd party in the transaction. In addition email providers can require verification for signup if they so choose.

Taco...

[Anonymous Coward]

...Stop referring to links as "magical little links."

It's hokey.

Lawyers' fault for not explaining it to them

[Anonymous Coward]

Not trying to be an armchair-attorney here, but I don't think people arguing in front of a state (or federal for that matter) Supreme Court should expect the justices to know anything about how the Internet works. The attorneys making the case should have made it clear to them and if they deliberate with the wrong assumptions you're either making a bad case or your opponent makes a convincing lie.

But again, "IANAL but I play one on /." applies.

Dude...

[sydneyfong]

Seriously, you really have no clue what you are talking about.

I don't know where to start.

Here's what I have to say. You don't nitpick on a few lines in a long judgment and claim the decision is bad just because of that few lines.

It's like if I found a typo in your post and claimed it was all bullsh!t. Worse, I said it was boring and I only noticed the typo.

The rant is understandable, since somehow the law eludes many (although personally with hindsight it's not that hard to get), and most people don't know how their legal system works, but I really can't imagine this getting through the slashdot filter and posted. Yes, even by slashdot standards. (Yes Taco I'm talking about you)

Re:Dude...

[PPH]

It's like if I found a typo in your post and claimed it was all bullsh!t. Worse, I said it was boring and I only noticed the typo.

Dude! You finally 'get' Slashdot!

Re:Dude...

[sydneyfong]

Wow. (Compares UID) How humiliating.... :-'(

Slow learner here ;-p

someone is WRONG on the internet

[sohp]

Oh no! http://xkcd.com/386/

Um, wow ...

[gstoddart]

The two basic errors are: concluding that anonymous speech on the Internet requires forged headers or other falsified information (and therefore that a ban on forged headers is an unconstitutional ban on anonymous speech)

Cool, so does that mean fake ID is constitutionally protected so that I can preserve my anonymity when doing things in public?

Sometimes (well, quite often actually) judges rule on technology issues without really having nearly enough understanding of the underlying issues and what it means. It's amazing how a poorly misunderstood bit of technology can lead to a ruling which has absolutely no relation to how reality works.

And, just because you have the right to free speech, doesn't mean that I'm required to actually listen to you. Decreeing that allowing forged headers in order to allow the special case of some religious or political nut screaming in my ear is ludicrous. Your freedom to speak does not confer an obligation on me to listen.

Someone should start spamming this guy with several thousand emails with forged headers expounding the virtues of the Flying Spaghetti Monster, or calling him at home with forged caller id telling him to vote for the Nut Job Party so he can see the flaw in his reasoning.

If the analog is a phone call, you don't have the right to anonymously phone me over and over.

Cheers

Maybe I missed something

[MrSmith0011000100110]

So SPAM is different from anonymous random cold-calling that we can easily defer from by adding our phone numbers on the DNC list. Oh that's right, email isn't REAL, so it doesn't count the same way. SPAM as a statistic is 90% of all email traffic and yet it's not a problem. Do these judges not have/use email? Are they all so old and their ways old-fashioned that they don't see our inboxes stuffed with crap to the point where we have to pay for hardware(enterprise) or software(home) solution to end the SPAM madness? Legally and any other way I believe SPAM is wrong. The fact that a judge/judges that clearly has no understanding of the subject matter could rule one way or the other is and should be a case of malpractice. We are granted the right to a jury of our peers(despite what we really get) so why can't the judge be held to the same? If I ever went to could a la Terry Childs, I'd hope to have at least a few IT people on the jury. I know if it was a jury of CEO's I'd fry for such an infraction. In summation Judges + Technology = bad decision.

Re:Maybe I missed something

[bws111]

Justices are not supposed to be experts on the things a case is about. A justice is supposed to be an expert on the law. It is up to the parties in the case to present their arguments in terms of the law - if the justice doesn't 'get it' it is the fault of the lawyers in the case, not the justice. If the justice makes a mistake as to the law, that is what appeals are for. Also, it is not up to the justice to say 'I hate SPAM, so it is illegal'. That is the job of the legislators. Finally, do you know what 'your peers' means? It does not mean someone of the same intellectual, social, or political leanings as you. It means ordinary people, as opposed to people representing the government. And that is what you ALWAYS get for a jury, in spite of your snide insinuations otherwise.

Magical little link?

[Anonymous Coward]

OMG! Ponies!!!

Re:Why All Bailout Packages Will Fail

[compro01]

I don't know what this has to do with the subject at hand, but I agree with you to some extent. I don't agree that it has to do with people addicted to their jobs, although there are certainly people who are. There are also people addicted to the Internet, or addicted to TV viewing or going to those bars you mentioned.

The important difference in those is that the former addiction would appear to be actively endorsed by society in general, or could even be considered indirectly enforced.

You are barking up the wrong tree...

[spiritraveller]

The submitter complains about factual issues, but appellate courts do not determine factual issues. Trial courts do. Before the case reached the VA Supreme Court (an appellate court), the trial court already made its findings of fact. The appellate court can only address the factual conclusions of the lower court if the lower court made a clear error in its analysis of the factual evidence presented. As the VA Supreme Court makes clear, it is analyising what is "shown by the record," not making its own declaration of how the internet works.

In order to know whether the VA Supreme Court should have overturned the lower court's findings, you would have to review the record on file with the court and read the testimony of the various expert witnesses that the parties called to testify. If there was no testimony at all to support the court's factual findings, then the VA Supreme Court could have overturned those factual findings, but only if there was no evidence or testimony to support the finding. If there is any evidence to support the trial court's factual findings, the appellate court has no choice but to go with them.

Courts make factual findings based on the evidence presented to them. Anything that is not obvious to pretty much everybody (I am paraphrasing the law here.) must be proven through evidence (including testimony of expert witnesses).

See here for more info.

As discussed on Groklaw...

[gnasher719]

This has actually been discussed on Groklaw to the end.

The situation is actually quite simple: The good lawmakers of Virginia passed a law that prevents _anybody_ from using forged headers etc. etc. , including good folks who need anonymity for good reasons protected by the US constitution. Therefore, the law as it stands is illegal. Now a judge _can_ decide that a law is unconstitutional and therefore cannot be used in any court case; a judge can _not_ decide how to fix this law. Therefore it _must_ go back to the lawmakers who have to fix it; as long as it isn't fixed, it cannot be used to convict any spammers.

The article comes up with all these arguments why the court decision is wrong. What he ignores is that the judge doesn't have the power to do that analysis. The only thing the judge can do is to say that the law is constitutional or not. The article claims that there are methods others than those disallowed by the law that make anonymous free speech possible. But that is not for the judge to decide. The law clearly restricts free speech that is protected by the US constitution (while also correctly restricting the rights of spammers to their "speech"), and that is not allowed.

Re:As discussed on Groklaw...

[Fulcrum of Evil]

The good lawmakers of Virginia passed a law that prevents _anybody_ from using forged headers etc. etc. , including good folks who need anonymity for good reasons protected by the US constitution. Therefore, the law as it stands is illegal.

Exactly how is a content neutral law going to run afoul of the 1st amendment? It's illegal for someone to post bills on my house, regardless of whether they're good people or not.

Bit like EA

[word_virus]

Virginia law is definitely of the "release it now and patch it later" variety. We're a bit like EA that way....

Can't appeal a Supreme Court judgment

[fair use]

> But the decision contains statements about IP addresses, domain names,
> and anonymity that are rather basically wrong, and which may enable
> the state to win on appeal.

There is no such thing as an appeal from a Supreme Court judgment. That's why it is Supreme! (Except in NY where they use weird names).

From the VA Supreme Court ruling, you have two options:

(1) Ask the VA Supreme Court to reconsider its decision. This rarely happens, but if the Court really did screw up, then it might.

(2) Seek a writ of certiorari from the US Supreme Court. These are also hard to get, but where a state Supreme Court really messes up First Amendment law, you probably have better odds.

Just a note to clarify

[Anonymous Coward]

The court is actually correct based upon how IPs work in that when ARIN assigns a block to an ISP, that is public info - any lawyer can get it. Once you know the IPS is known a simple court order can force them to divulge the account who was logged on and assigned that IP at the time the message was sent. Thus the full account, including billing information of the user to whom the IP was leased or assigned (as with dialup) at the time can be identified unless the IP can be obfuscated.

It is wrong to say there are no other ways in which an id can be masked. There are enough unsecured mail servers in the world that one can use with a little knowledge without the trail then actually leading back there PC. The trail would end at the unsecured server.

Origin relocation will work also... you need to be able to access a remote server, I won't say how - but lets assume you did it legally, then you can use the remote system to send a message without it directly leading back to you via IP... depending upon the system accessed and how you accessed it could lead to someone else, or back to you through a few more court orders...

This IP tracing back to the user via the ISP is EXACTLY how the music and entertainment lawyers have been finding people to persecute... yes I meant persecute....

This is just my humble opinion; however, I do NOT believe the arguments are strong enough to get the case over turned...

Also, I DID hear of a case where defamation was be claimed against a spoofer... but you have to find the spoofer first...

I traced several e-mails back to unsecured servers in China so there was no way to tell where they came from, I suspect Roswell's Aliens are behind it....

That law took the wrong approach

[Skapare]

That law is in fact prohibiting speech. Even if it were rewritten to be more narrowly focused on spammers, it would still be the wrong approach.

The problem with spam is not a speech issue. It is a property issue.

The protection of free speech in the US Constitution does not grant speakers the right to steal property rights. You cannot steal my paper, ink, and printing press and justify the theft as enabling your freedom of speech.

Remember ... free as in free speech, not as in free beer.

Email costs more to the recipient than to the sender. The sending server only needs to store mail until it can exchange it with the recipient's MX host. In the case of spamming, this cost is virtually nil since the message tends to be the same for all recipients, so only the recipient email address is all that needs to be stored. The recipient server has to store each message individually, if it arrived individually. It also has to store the messages longer, until the recipient's user agent (client) picks up the mail. And that pickup is through yet another active service (IMAP, POP, Web).

Sending something to someone that doesn't want that is fundamentally wrong. It is a theft of computing resources. It can also be a theft of personal time. When this is done on a very small scale, such as trying to contact an old friend that has no interest in communicating with you, or asking someone a question about free software they wrote when they don't want to deal with such questions, then it's generally not a big deal. It's still wrong, but the scale of it doesn't rise to be a criminal interest.

Doing this sending in bulk, however, indicates the intent to benefit in some way from this theft, usually financially. Sometimes there are other forms of benefit, such as political.

It could be argued that existing property law already provides the proper protection. However, this would require a complex constructive argument in court, which might also be easy to knock down. Email, the internet protocols, and the way computers work, are complex issues that would have to be dealt with over and over in courts this way. What we need is a law clearly written to deal with the property theft aspect of spam. It needs to avoid any reference to what the content of a message is. It needs to focus on the means by which the sender is doing the theft in bulk (even if the case before a court is only one instance of what the spammer did). It needs to make clear that freedom of speech is about the right to say what one wants to say, not about giving the speaker a right to steal property from others to achieve that speech.

The law needs to make clear that sending email against the wishes of the recipient is theft. It needs to make clear that doing so in bulk raises the level of this theft to be criminal. It also needs to make clear that the definition of bulk can include sending any one given recipient just one copy.

Such a law should do better to stand within the protections of free speech in the First Amendment.

Re:That law took the wrong approach

[cdrguru]

The basic problem with the idea that it is wrong to send something to someone that does not want it is that it turns the idea of an open communication medium on its ear. It is fine that with Yahoo Messenger you cannot send anything to someone until they accept you as a contact. Email was not intended to work that way.

Trying to introduce this sort of permission into email means that it can no longer be used to communicate with people prior to establishing a relationship. Should a law get passed that says it is wrong to send things to people they do not want essentially enforces this. You now have the situation where I cannot send you a receipt for your purchase because I have no idea if you want it or not. And as a commercial entity, I cannot take the chance that you don't want it without explicit permission.

And then we're back to Yahoo Messenger instead of email.

Personally, I think that email today is already broken enough that it cannot and should not be used to deliver anything of importance. Most people do not receive all the email that sent to them - it is filtered by third parties that are not interested in filtering errors. This means email is unreliable. So if I am sending you a receipt or a notification of a credit I have no idea if it is getting through to you or not. It is therefore useless.

Re:That law took the wrong approach

[Skapare]

The basic problem with the idea that it is wrong to send something to someone that does not want it is that it turns the idea of an open communication medium on its ear. It is fine that with Yahoo Messenger you cannot send anything to someone until they accept you as a contact. Email was not intended to work that way.

Email was intended for civil participants that would not use it to steal from others. Of course that was naive about the real world, and naive about the protocols being used for real world communications. But if you want to speak of intentions, that was the intent.

Trying to introduce this sort of permission into email means that it can no longer be used to communicate with people prior to establishing a relationship. Should a law get passed that says it is wrong to send things to people they do not want essentially enforces this. You now have the situation where I cannot send you a receipt for your purchase because I have no idea if you want it or not. And as a commercial entity, I cannot take the chance that you don't want it without explicit permission.

Prior communications, transactions, or business relations would imply the intent to communicate within reason about it. The law probably needs to include a clause that says this to be clear about it. This is why a similar clause exists to permit communication by telephone in similar circumstances. It also needs to include a clause that allows the would-be recipient to cancel the relation to the extent that it permits communication by particular methods such as email, or communication about issues not specific to the existing relation (e.g. don't send me advertising about other products, just notify me when the product I ordered is shipped).

If you post in a forum where your email address is available (and more people would make it available if the spam issue did not exist), then it is reasonable to assume this implies the permission for reasonable communications specifically about the subject matter posted. It would not necessarily imply permission for communications about other matters. If I post in a photography forum that I am looking to buy a particular type of camera, that would reasonably imply that I want communications from those who might offer to sell me that type. That could be troublesome if 9000 people send me email with offers to sell me exactly the type of camera I want. But none of those 9000 people would be abusing email if each only sends me one message that is exactly about what I asked for. This would be the rare situation (compared to the rampant abuse of spam taking place today).

And then we're back to Yahoo Messenger instead of email.

I don't see why that would be so.

Personally, I think that email today is already broken enough that it cannot and should not be used to deliver anything of importance. Most people do not receive all the email that sent to them - it is filtered by third parties that are not interested in filtering errors. This means email is unreliable. So if I am sending you a receipt or a notification of a credit I have no idea if it is getting through to you or not. It is therefore useless.

That certainly is a situation we have today with email. I would suggest that it would not have been so had a correct and proper law been in place since the beginning of email that carefully, and constitutionally, prohibited abuses with specific and strong penalties (strong because of the difficult of bringing cases).

I am not a publishing house!

[Anonymous Coward]

I would like to point out that I am not a publishing house and that anyone who wants to have an email "published" must not to send it to me!

CAN-SPAM Act already forbids forged headers

[schwaang]

You can read about it here. Among other things, it says that an unsolicted commercial email cannot contain falsified headers.

The reason it did not apply in the Virginia case is that the crime was perpetrated before the act was made law in 2003.

So really this Virginia decision is largely irrelevant when it comes to spam. It is possibly very relevant when it comes to anonymity on the internet.

In the mean time, you have powerful interests (like the government of China) working to ensure that anonymity on the internet becomes impossible.

And that is a case-in-point of exactly why anonymity is necessary to protect free speech.

Consider The Source

[hyades1]

It's Virginia, for godsake! They only took "Family Reunion" off the official, Virginia Is For Lovers, list of "Best Places To Meet Hot Babes" last week.

Anonymity a right?

[Anonymous Coward]

Since when should free speech include a right to anonymity? Should we allow people to drive without license plates in the name of free speech (you know, so long as they're shouting "speech" out the window while driving of course) ?

People tend to be asses when they think they have full anonymity.

Email is not a speech issue at all

[Anonymous Coward]

Here's my problem with the whole subject: spam, and email in general, should not be considered a free speech issue in the first place. This case talks about the act of "publishing" an email as a free-speech action. One does not publish an email, one sends it explicitly to targeted recipients. Publishing "speech" in the electronic sense would be something like posting to a message board or putting up a web page which a person may choose to view or not. Such speech, commercial or otherwise, is clearly deserving of protection.

Sending unsolicited email is not "publishing". It is more akin to breaking into a house and spraypainting your message on the wall. Such speech, commercial or otherwise, is clearly undeserving of protection -- and indeed should be punished severely. Telling the recipient that he is free to paint over the message without reading it is not good enough.

The obvious solution to "spam" is for the delivery of all email to be on an opt-in basis. If I haven't explicitly authorized you to send me email, then I shouldn't have to waste my time/energy/bandwidth attempting to filter out and throw away the undersired items. If I want to hear what you have to say, I'll let you know -- otherwise, stay out of my face.

Re:Why All Bailout Packages Will Fail

[Anonymous Coward]

I don't know what this has to do with the subject at hand...

Nothing. He/She/It's been blindly copy/pasting the same comment in every article. Ignore him/her/it.

Mod parent up: Good point

[ari_j]

Judges aren't usually supposed to ask the parties questions. They're supposed to decide issues of law and if a question needs to be asked, the lawyers are supposed to be smart enough to ask it. A jury is supposed to decide the facts, but whether it's a jury or a judge who decides the facts it is the job of the lawyers to ensure that evidence is presented to educate the fact-finder sufficiently to make the correct decision. I really don't want to live in a world where judges have to have technical expertise in every kind of case that comes before them - they'd have no opportunity to learn the law, and that's a hard enough area for them to get right as it is.

The purpose of an expert witness is to assist the trier of fact on matters beyond lay experience, as you know. You have certainly seen a pretty heinous example of a judge getting it wrong, but it sounds like the error got fixed "easily enough" (I put that in quotes because it's such a relative term, relative here to paying 25%+ annual interest). In general, though, there is a lawyer who did not sufficiently educate the judge for the decision he had to make.

Let judges dedicate their time to studying the law. It's critically important that they don't suck at making legal decisions.

Not True

[Anonymous Coward]

This analysis misses an important element. Almost anyone EXCEPT the government may request and receive non-content based identifying information without any sort of court order whatsoever. The applicable statute is the Electronic Communications Privacy Act. Check it out.