Slashdot Mirror
CAN-SPAM Act Turns 5 Today — What Went Wrong?
alphadogg writes "Five years ago, the US tech industry, politicians, and Internet users were wringing their hands over the escalating problem of spam. This prompted Congress to pass a landmark anti-spam bill known as the CAN-SPAM Act in December 2003. Fast forward five years. The number of spam messages sent over the Internet every day has grown more than 10-fold, topping 164 billion worldwide in August 2008. Almost 97% of all e-mails are spam, costing US ISPs and corporations an estimated $42 billion a year. What went wrong here?"
especially when they are anonymous(or at least obfuscated) and in many cases, overseas and therefore beyond prosecution under this law
'I'm just saying
Enforcement would be nice. How hard would it be for some FBI office to sign up to get all the possible spam out there, and start replying to all the great offers from African banks?
Of course, a lot of the perpetuators do not reside in the US, but quite a few do. The more legitimate a business looks like, the more likely it has a US presence that can be used to stop it.
So vote with your US tax dollars and force your government to allocate serious funds to the problem. Please!
--
http://fairsoftware.net/ -- where software developers share revenue from the apps they create
What went wrong? Nobody stopped to define "Spam" before trying to make it illegal. So they made something up, called it spam, and made that illegal. And when people called them up to ask why they were still getting spam, they replied: I don't see any spam here!
#fuckbeta #iamslashdot #dicemustdie
Yea, something was legislated against, therefore it will stop. What logic?
something to do with the fact that the US Congress doesn't have jurisdiction over international crime rings.
That, and the allure of free advertising in a world full of idiots.
1) Legislation was flawed
2) Problem transcends US Jurisdiction
3) Enforcement is spotty at best
4) Idiots buy their stuff
Look at the name of the law. Working as designed.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
All the legislation in the world won't fix teenage pregnancies, the War On Drugs, etc etc.
Since there is really no technical mechanism to kill spam, the legislation itself is ineffective.
Engineering is the art of compromise.
This prompted Congress to pass a landmark anti-spam bill
Duh.
If our elected representatives no longer represent us, do we still live in a Democracy?
You mean you guys have still been getting spam?
What signature defines me as a person?
Anything that fails to remove the financial motivation behind sending SPAM will fail to prevent SPAM.
No one in their right mind ever thought CAN-SPAM would have any tangible benefit.
I don't see how anything went wrong. Politicians get props for being tough on spammers (it isn't poor Congress's fault that the law is barely enforceable), and the feds profit from imposing some hefty fines on the few criminals they do catch.
The spammers are too smart to get caught and a lot of them probably reside outside of the US where the law does not apply.
The law is about as useful as a law against breathing.
Why am I not surprised. Ironic, kind of like the war on drugs. The stoners are winning.
Remember when we made weed illegal and now you can't buy... ooh, wait a second.
To summarize the summary of the summary: people are a problem. - Douglas Adams
It gives Barracuda a market.
They should have called it CAN'T SPAM.
--
Stay tuned for some shock and awe coming right up after this messages!
Quite seriously, this law was specifically not aimed at spam. It was aimed at certain types of online fraud, and it deliberately took power away from local law enforcement to put it in the hands of a federal power that does _nothing_ about mere spam. It was carefully designed to allow 'opt-out' advertisements, and that first advertisement from any spammer, and it was carefully legislated that way by the Direct Marketing Association to avoid interfering with the advertisements of their funding agancies. It was also carefully designed to overrule more effective, state efforts.
Such laws should instead be modeled on the junk fax law, which has withstood the test of free speech challenges and ease of prosecution.
Your Congress advocates a
( ) technical (X) legislative ( ) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
(X) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
(X) Lack of centrally controlling authority for email
(X) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(X) Asshats
(X) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
(X) Willingness of users to install OS patches received by email
(X) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
(X) Extreme profitability of spam
( ) Joe jobs and/or identity theft
(X) Technically illiterate politicians
(X) Extreme stupidity on the part of people who do business with spammers
(X) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook
and the following philosophical objections may also apply:
(X) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
(X) Any scheme based on opt-out is unacceptable
(X) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
(X) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
(X) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
( ) Sorry dude, but I don't think it would work.
(X) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!
Even I managed to get some real Vs over the internet.
It doesn't matter if it is illegal drugs, or penis enhancement or whatever.
As long as the response level to any spam is more than 0%, or laws otherwise prevent rational adults from wanting a few chill pills, this fight will continue. And it will be as fruitless as the war on drugs.
And more and more laws will only ruin the rest of the internet, but the spam will continue.
Spammers know they won't likely be caught. And, if they're caught then the punishment won't be harsh.
Put a few in a federal PYITA prison. Put some heads on pikes outside the city walls. Send in some Navy Seals and install Vista on their machines. Do whatever it takes! :-)
Three things went 'wrong': 1. Moron sysadmins who allow their servers to act as relays or become exploited 2. Idiot end users with compromised systems 3. Unbelievably stupid people who respond, and buy, what the spam is advertising No legislation has ever overcome human stupidity.
As if anyone in government is ever going to be able to stop spam. Did anyone notice the irony of the link in the article (it took me to a symantec advertisement)? Spam will never be stopped until idiots are gone (which will be never). If you think the government is capable of stopping spam, then you don't understand government. They are more likely to make the problem worse.
In fairness, nobody with any amount of knowledge expected it to have any impact. It's not really accurate to say it 'went wrong' when most of us never expected it to work in the first place.
i use Yahoo! mail (4 accounts) for most of my email activity. i have a rarely used GMail account or two. i have an account through uni, that is now serviced by GMail. i get almost no spam. i had 2 accounts with Earthlink. now those two were somewhat spam-laden, but in recent months, the amount of spam dropped quite a bit.
if i didn't know any better, it would seem to me that the legislation worked. but i'm more inclined to believe it was a result of software changes that were implemented by the services to respond to complaints from users.
"To stop the terrorists."
Another example of why legislators shouldn't attempt solve problems that should be left to engineers.
Just disrupt the deflector shield with a tachyon burst.
I know where it is, and why it is still a problem. It is not in my email box, or the email box of most people. It is in the spam filters of our email providers. And that is the problem. I don't see it so I don't care. Sure, it may increase my cost to get online, but by how much. DSL is dirt cheap to what I was paying 10 years ago, and at better bandwidth. So what do I care? I don't see it, the problem is solved. And I can delete the 5 messages of spam that get through.
So out of sight, out mind, right? Wrong. I also know for the average person, and for the average spammer, those five messages per person that gets through can mean huge amounts of money. Even if nothing is bought, the way that mail clients are set up and vulnerabilities in the mail and web clients can make the spammer money. For instance, most clients now render HTML and load images automatically. Apple still refuses to set an option in mail.app to turn off HTML permanently, though it does allow one to not load images. Still, most people load images, which registers as a hit on some scam web site and registers the email as valid. Rendering the HTML can allow viruses on the receivers machine. And even the semi legitimate spammer still has hope that someone will buy a product.
We won't be able to get rid of all spam, even though we can't get rid of mail scams though it is a felony. The best we can manage it. If we are to fix it more, then we have to bring the problem to the forefront by letting spam through, or some other methods.
"She's a scientist and a lesbian. She's not going to let it slide." Orphan Black
CAN-SPAM like many other laws (can anyone say PATRIOT?) was written and passed for the benefit of voters and those they vote for. Very few cases of enforcement were actual attempts to enforce the law, most were attempts to fill press releases.
As I've quoted before, FTC Commissioner Orson Swindell said at the first FTC spam conference "What we need are a few good old fashioned hangings." Certainly in spirit, yes. If the Secret Service can round of a few dozen kids and a game designer and cause them all manner of grief, now that they know what they're doing, why can't they round up a few dozen spammers? Why do the "spam kings" get removed only to be replaced with no net (pun unintentional, but I like it) effect?
Isn't there an "or cause to" statement in the law? Those that hire spammers were supposed to be held accountable too. "I didn't know they would spam it" should only be taken to mean the owner was negligent in research and contract. Negligence isn't commission, but it's still a basis for guilt.
Spamming has become such a big multinational business, and increasingly associated with organized crime, it's only a matter of time before we start hearing about them offing each other and/or their providers. That's hearing about it, not to say it hasn't happened already and not recognized.
"I may be synthetic, but I'm not stupid." -- Bishop 341-B
The bill got the people who paid for it, what they wanted. Permission to send spam.
To fix the bill, it needs the following:
1. Outlaw spam. (yeah, won't probably happen, but I can dream.)
2. Require labeling. Make it easy for spam filters.
3. Permit private right of action for individuals.
4. Require attorney fees to be paid to successful plaintiffs.
5. Strict liability for the advertised party. No more, "Oh yeah, that affiliate didn't get permission to send that e-mail to you -- don't blame us."
The bill is incorrect, you can go after foreign spammers, it is just harder.
Fight Spammers!
Seriously, the problem with every anti-spam countermeasure I've seen so far is that they are all based on using SMTP as a mail transport. And SMTP is a protocol designed for a civilized Internet - one where every email sent is assumed to be one that the designated recipient wants.
In order to stop spam, we need to stop using SMTP and switch to a protocol that rejects mail by default. Unfortunately, this requires a flag day, and nobody's put forward a protocol like this yet, so we're still stuck with insane amounts of spam.
Nothing went wrong. It's name stated what it was for: Companies CAN SPAM. And that's what they did.
There should be mandatory authentication of all emails coming from within the US or from a US email provider.
In two words: your expectations.
When Congress swoops in to solve a problem I always expect them to fail. They almost never let me down.
-Peter
Um, flag day?
[x] This article is useless and the comments will spawn over 9000 forms giving detailed explanations of why spam can't be stopped by technical, social, or legislative solutions.
[x] Pie
[ ] None of the above
What's needed is actual enforcement. Spammers make money because people buy their wares. Where there's money changing hands, there's a trail you can follow. The problem is seemingly that no one wants to follow that trail.
I'm guessing that some high-profile business got joe-jobbed, discouraging law enforcement from following the money. A spammer could distract those who follow the money by advertising the shady businesses they normally deal with and then advertising smaller legitimate businesses as a decoy.
Congress had no idea why spam was a problem and therefore did not draft legislation designed to address the problem. http://ssrn.com/abstract=487162 Instead, they took a shotgun approach of trying to legislate against a panoply of problems, which meant that the law was not designed to fix any single problem and therefore was not going to succeed even from day 1. Eric.
Congress was compelled to pass cable legislation - prices have gone up rapidly ever since
Congress passes the Patriot Act - one of the most *un-patriotic* pieces of legislation ever written
So everybody who really thought CAN-SPAM would reduce spam, raise your hands...
I thought so.
The problem is not that the CAN-SPAM act of 2003 is flawed.
The problem is that the US seems to assume that laws made in their country are globally accepted.
Prohibiting pretty much anything will just make those people that want it get it from another source. For example, look at the prohibition of alcohol in the US... suddenly many people had the urge to visit Canada and/or Mexico more often (even bring back 'souvenirs').
Just my 2-cents in the matter.
I say don't drink and drive, you might spill your drink. Before you get behind the wheel just stop and think.
Freedom of speech is more important than $42 billion a year.
Political speech, asking for a petition to be signed, telling someone about your faith, selling door knobs... there is a plethora of good bad and highly subjective things people can say, repressing speech, even 'commercial' speech both a constitutional violation and a vary dangerous precedent to set.
I don't like receiving 'get a bigger penis' adds any more than the next guy, but the legal action should be against the individual for lying, not for communicating speaking.
Look at the people who blew up the hotels in Bombay (Mumbai these days) - just a few men in boats with guns -- sophisticated protection can't stop them every time. We might as well give up and spend the money on something useful.
The number of spam messages sent over the Internet every day has grown more than 10-fold, topping 164 billion worldwide in August 2008.
Those are great numbers. Imagine how much SPAM would have been sent had the law NOT been passed!
Private right of action got stripped out of it due to complaints from the direct marketers. That was strike one. With so much spam it's completely unreasonable to expect anyone to enforce the law. Crowdsourcing the enforcement through private right of action would've worked. And the direct marketers knew it...
The second strike was that the bill didn't anticipate the success of botnets and Russian organized crime. The law doesn't do jack s*** about that problem.
In Soviet Russia, I ruled you
Easy - Congress got involved. And, as usual, they are a complete waste of time, money, and effort.
just goes to show that making laws about stuff wont change anything.
Like say, prohibition lol
If very one was charged 1c per mail & laid down in legislation that is all that can be charged, it would close the free lunch table spammers are eating off.
Five years after being passed, the law banning flies still hasn't reduced the amount of flies. What went wrong?
Opus: the Swiss army knife of audio codec
In order to stop spam, we need to stop using SMTP and switch to a protocol that rejects mail by default. Unfortunately, this requires a flag day
Not necessarily. The Wii game console implements a transitional protocol that enforces whitelisting, much like the friend code system of Nintendo WFC games. To send mail to someone's Wii Message Board, you have to be in his address book and he in yours. It interoperates with classic SMTP: when you add an SMTP address to your message board, the address gets an e-mail from wii.com asking the user to accept or reject this contact. People who need to accept random business contacts from suppliers or customers can set up a web form; this could be as simple as a form mailer or as sophisticated as an issue-tracking system such as Bugzilla or OTRS.
Enforcement.
The law itself is just fine. It cautiously defines spam, in a way that makes virtually all current spam clearly illegal, without causing significant free-speech problems. But spammers won't voluntarily obey the law, and the government isn't prosecuting them for violations.
The Washington Post managed to get a huge amount of spam stopped just by making a phone call. The government should have been there first, and they weren't.
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
Our clients include many bands and music venues. We make every effort to be legit (unsubscribe links, legit reply email addresses, and all legit headers and DNS entries), but the rules of the game are not even available.
See, many ISP's (AOL, and my new target of wrath, earthlink) have rules about the maximum number of messages allowed to come from a single source to their domains in a given time period. Exceed those, and you are an abuser. Except they won't tell you how many messages or how long the period. On the one hand I understand as spammers could use this to get through. But you can't even call them and get info. I've emailed their abuse lines with no reply. It's as if NO ONE knows this info. How does one follow the rules when they are undocumented and beyond the legislative code?
Or when earthlink this past weekend decided we were a spammer, and spammed us back with abuse notices. But then they delivered our email to their customers many, many times in repetition. Like a dozen or more. It was not a server flaw on our side as confirmed by the database and log files. It was 'something' on their side that acted as a repeater for our legit email even as it was notifying us that we were spamming. We then get lots of nasty emails, which we reply to by hand. I spent half of the morning yesterday trying to get anything out of earthlink regarding the issue, but if you don't want to subscribe for service, they don't know what to do or where to have you call. I don't even know what the hoops are, much less can I jump through them.
I get lots of unwarranted spam, but I also get many distribution lists that I want and look forward to reading. Some places make that a nightmare if you want to provide that service.
Um, flag day?
At 0800GMT on the Nth of Y, all admins everywhere in the world will press the magic button and convert to the new email sending protocol.
Cost for a substantial compliant mailing setup - Around 30k
Cost for a substantial non-compliant mailing setup - Around $1-2k.
There's a significant part of your problem, and no amount of legislation is going to lower the cost of legit IPs/data anytime soon. When spammers can't spam compliant, they spam non-compliant.
And probably the most important:
Sure, the US is the originating point for a lot of spam,but there is plenty of spam that starts elsewhere. And if the offense is somehow tied to people in another country then good luck getting any enforcement.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
Um, flag day?
Yes, a Flag Day.
Where there's money changing hands, there's a trail you can follow. The problem is seemingly that no one wants to follow that trail.
The problem with the trail has more problems than that. You can probe the trail yourself for any piece of spam you receive. Check the following for the next spam email you get:
You'll probably find people and companies in at least 2, if not 3 or 4, countries in that list.
And getting them to care about CAN-SPAM - when likely at least one doesn't speak fluent English - will be near impossible.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
one where every email sent is assumed to be one that the designated recipient wants.
The problem of being assumed wanted by the recipient pales to insignificance compared to the problem of the sender being correctly identified.
is the very same result of the concept
"free market"
u make booms..and boobs.....
at the same time
Your news story advocates a
( ) technical (X) legislative ( ) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
(X) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
(X) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
(X) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
(X) Lack of centrally controlling authority for email
(X) Open relays in foreign countries
(X) Ease of searching tiny alphanumeric address space of all email addresses
(X) Asshats
(X) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
(X) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
(X) Extreme profitability of spam
( ) Joe jobs and/or identity theft
(X) Technically illiterate politicians
(X) Extreme stupidity on the part of people who do business with spammers
(X) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook
and the following philosophical objections may also apply:
(X) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
(X) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
(X) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
(X) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
(X) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!
CAN-SPAM less than toothless tiger, tiger still have claws and muscles and still can kill you.
The issue is that lobbyist has congress in their pockets and neutered the real CAN-SPAM act and now we have a big stuff animal of a tiger of an act.
What should have occurred is all people on all mailing are now cleared and people that still want to legitimately subscribe to the mailing list they want will still get their mail. All other mail they get is spam, in the eyes of the beholder. I work in biomedical/pharmaceutical research so what appears to spam to one person is legitimate to another so I have tuned my spam filter differently from others.
Also they need to properly search for, arrest and prosecute all of these morons and truly punish them. None of these released after pleading guilty and "promising" not to do it again and they are back on bot controller to start the sh&# again. Also they should get all of the money tey stole return money to rightful people. Also as punishment they should have NO access to any electronic devices during their sentence.
This should discourage most of the spammers that are spamming us now. There are the extremist that won't get "discouraged" from spamming and we have Gitmo for them....
*Everything* Congress has touched has failed. I can't find a single thing they've done that's admirable.
In this case, they assumed they controlled the internet: they don't. They can't, unless they kill it, and make another that runs only in America, costs too much for anyone to have, and has no content. Kinda like Amtrack.
- College tuition is so high because no matter the amount, the government will pay it.
- Banks collapsed when they were told they must make loans to people without jobs, just because they were black/hispanic/pick-one. This was just another spin-off of the never-effective "New Deal" which is otherwise known as the Democratic Bank Scandal. (Show me ONE Republican. Just one.)
- Funding welfare of all kinds hasn't changed the poverty a single percentage point in 70 years or so. (Anywhere) It doesn't work. It's time to stop funding the process, period.
- Amtrak runs places senators want to look good, not places people want to go.
- The Department of Education has consumed BILLIONS of dollars and never educated a single child.
- Sponsoring ethanol, rather than letting the free market do it has people overseas starving. Government funding means they get paid large amounts of money, even though it corrodes machinery. Even though it's not a great idea. And people starve.
What does Congress have to do to be thrown out?
One word - Congress.
The very same Congress you want to manage your health care.
When will you people ever learn?
From TFA:
"...they are developing the ability to modify images so that each image sent in an e-mail is different."
Is this even possible?
Well, Internet Mail 2000. But good luck getting everyone to switch.
Most of the comments I've read so far are either concentrating on legislation, and/or a technical solution to the spam problem.
Legislation won't solve the problem (a la drugs, guns, or any illegal vice you care to think of - they still happen despite legislation)...
Technical solutions would solve the problem - if only the whole planet would instantly switch over to "New Improved Email Services[tm]" at precisely the same time - again, at the moment this looks to be unlikely due to the sheer logistics of accomplishing such a task.
What I think is a better solution, is to begin educating whoever is going to be using an email system - and you begin that education EARLY.
Today's children are tomorrow's email users, consumers, workers, and contributors to Society. The current spam problem is NOT a technical or a political problem as such - it is a SOCIAL problem - i.e. a lot of humans are stupid and naiive - and it is this naivety which the spammers and surrepticious criminals prey upon. Why do most of us not recognise this?
Begin a program of - oh I don't know what you might call it - "Life Education classes" - in which you at least TRY to get young children to begin to get savvy to shysters, tricksters, con-men, whether offline OR online. Educate them on the dangers of following spam adverts, online scams, etc. Do this from kindergarten age upwards through high school - drum the message in.
At the end of it - when these kids exit high school or Univeristy, they at least have been ingrained with a certain skepticism about spam and other ways to get conned by crooks.
Another way of putting it is this : spammers, scammers, and criminals prey upon naivety - it is their oxygen supply. If we start imbuing new generations of future users with a healthy dose of awareness about the dangers of following these spams and scams, you're beginning to cut off that oxygen supply to the crooks.
This of course won't solve the immediate problem, but, again I point out, this is an escalating SOCIAL problem, and should NOT be considered a technological problem - what's happening now is the social problem is being exacerbated by the technology. Remove or reduce the social problem and the urgency of the technological and political problem is also reduced.
In order to stop spam, we need to stop using SMTP and switch to a protocol that rejects mail by default.
I wasn't aware that SMTP was incompatible with whitelisting. In fact, I'm pretty sure I've heard of setups that do just that, result in an SMTP server that rejects connections from people it doesn't know.
This law was doomed to fail because it is not practically enforceable. You get the big fish and maybe drop the amount of spam for three days until a bigger takes its place. I like the technological/economical approach to combating spam. OpenBSD has come up with an ingenious way of using technology to take the economy out of sending spam. They have come up with spamd, a fake smtp daemon which can cause delivery of a single spam message up to 5 minutes thereby causing a massive queue clog on the part of the spammer. By causing a severe bandwidth clog on the spammer's end, you remove the economy of mass emailing. I have used this solution to rid my father's company of ALL of its spam. It makes me laugh with delight to comb the logs and see the fool spammers continuing to try delivery and there is 0 impact on our bandwidth.
SPAM is, without question, the most perfect business model ever conceived. It's simple math, really. Consider:
* It costs the same amount to send literally an infinite amount of unsolicited commercial e-mail messages as it does to send 1.
* If one person out of the infinite SPAM recepients buys the advertised product, the spammer makes money.
* Any finite number divided by infinity is zero.
* Therefore, a spammer makes money even with a *0 percent* response rate.
No way to beat that model. Therefore, it's overwhelmingly unlikely that a legal solution to spam will work. It also makes it almost impossible for a technological solution. The best advice re: SPAM is the one I give to all my users: delete SPAM messages as quickly as possible, devoting as little brain power as possible to the process.
-Z
If Barack Obama promised full pardons when you murder a spammer, things would change really fast
Not really. AIM and Skype do a pretty good job of it. So does ssh. It's a simple matter of public key cryptography, coupled with some variety of introduction and rendezvous mechanisms appropriate to the various ways you might know another person online.
Well, as another person mentioned, whitelisting is pretty useless because it's easy to forge a sender address. It's not a good argument for a pull protocol, but with a push protocol like SMTP, it's a real problem. If whitelisting were widely and effectively implemented, it would be one more incentive to spammers to crack your friends' and relatives' address books.
I don't understand the confusion... it was clear... they said you CAN-SPAM, right?
What went wrong is that the ISPs have not been made responsible to ensure that their clients do not send out large quantities of spam.
If the ISPs were required by law to temporarily disable or even permanently terminate all internet connections that have ANY computer that is sending out quantities of spam - ie if the ISP was at risk of having their own network existence permanently deleted/deregistered by ICANN if they did not actively ensure their network was not a source of spam or a source of the management of spambots...
The onus needs to be forcibly put onto the ISPs in order to compel them to keep their part of the Internet free from spam - and the penalty needs to be draconian.
Otherwise the basic greed of the owners of that ISP will cause them to not do anything that would hurt their revenue from spammers.
Do that and spam will disappear within weeks - just as soon as ICANN finds the balls to start deleting/deregistering those ISPs from which spam is constantly spewing out.
Government fights unemployment, we get more unemployment
Government fights a recession, a depression lasts for ten years.
Government regulates and prints money, hyperinflation and financial bubbles.
Government invades Iraq, never leaves.
Government passes law on spam, spam increases tenfold?! Oh Lord, what a surprise!
Send your spendthrift head of state this
Thats all well and good - what about 200+ ?
On occasions with various email accounts (publicly visible addresses) I have received at least this daily. Mail filters sucessfully caught at least 98% of all mails, but that isnt the point.
the spammers CAN SPAM.
I meant significant problem as in more the root cause, not technical difficulty. If only the senders could be 100% verified, it would do a LOT more towards eliminating spam than identifying the recipient's desire to recieve.
I dunno, it seems to me that once your brain has been uploaded to a computer getting turned into a zombie by malware and forced to spam all day would kind of suck. Of course some would say this is what has happened to cult members now.
echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
CAN-SPAM Act Turns 5 Today -- What Went Wrong?
Maybe if they had named it CAN'T SPAM, it may have turned out better.
Based on the spam I get here, there is no big incentive to buy anything from whoever's business being advertised to begin with. To the extent there even is any kind of business there at all.
To illustrate, from looking at some recent deleted spam I make the following observations:
First of all, my penis is just the size it should be and it works the way it should, so no need for enlargments and viagra, nor, presumably, subsequently having to carry it around in a wheelbarrow.
With that taken care of, next, I don't have time to do contract negotiations with alleged attorneys claiming to represent rich deceased people whom I've never heard of, living in countries where I've never been.
Neither do I care about spending time attempting to claim a prize in lotteries where I never bought a single ticket.
I don't use Paypal in French either.
Then there are the bankers in Ghana that send me notices of their new e-mail address, with wild and wonderful and completely unrelated titles. Since all these notices are basically formatted the same way, the precipitated hypothesis is that there are a lot of bankers in Ghana, and all of them are getting yahoo.com e-mail addresses. Well, I don't need Ghanesian banking services any time soon. If I ever should, I'd deal with someone whose e-mail address had a reasonable resemblance to the name of the bank and the country the bank is operating in, not just some random attention-getter I found in the spam-box.
And that is just looking at the stuff that comes in a language I can read. Sometimes it is Chinese or Hebrew, and sometimes it is in some mysterious language that merely renders as garbage.
Point of all this, there is hardly any legitimate business or services of any kind advertising through this spam channel at all. Hence no one to boycott.
Makes me wonder why do they bother.
SIGBUS @ NO-07.308
Believe it or not spam is a very minor problem.
One day whoever controls all these botnets is going to realize the data on the machines they already control is worth -WAY- more than what they make out of spam. All the botnet herders need is some decent indexing technology and/or keystroke loggers and they have access to all kinds of profitable stuff.
Sooner or later ISPs will be forced to block all TCP port 25 except to and from their own mail servers.
It will be a shame for those people who run their mail servers off a DSL line.
And of course the above means the government gets a copy of everything.
The death penalty for spamming - then slowly you'd get to the bottom of this problem.
If Google really cared they would fix Android Chrome to reflow text, instead of discriminating
Social networking sites, e.g. FaceBook, LinkedIn, etc, provide at least a partial solution to the problem: you only receive messages from friends, friends of friends (or bussiness connections). Confidence in the authenticity of a person can be gained because you can see their profile, follow their conversations with other people you know. And you can shut them out of your network if they are spamming.
Still, a solution is needed for more incidental communications, e.g. when ordering something on-line or when dealing with a company that you have not dealt with before. Maybe a quota system, where you will agree to accept a limited number of messages from a specific source?
assignment != equality != identity
.
So if a housekeeper using her desktop on my hospital network gets infected by malware, no doctor in the hospital can use email? Hmmm...I foresee no problems whatsoever. Let's do it!
Professional lawmakers are typically more expert in crafting rules than understanding their effects. This is natural, because, while they are comprised of a cross-section of society (Doctors, Lawyers, Engineers, etc.), those skills become secondary to their current job of telling us how we must (or may not) act.
Combined with the "market will fix itself" mentality so pervasive in both the Executive and Legislative branches, it's no wonder the letter of the law is so out of touch with the spirit.
http://news.bbc.co.uk/1/hi/technology/7719281.stm says 1 in 12 million.
I'll see your Constitution and raise you a Queen.
Because CAN-SPAM set out with the wrong mindset.
Now, if they had started out with a CANNOT-SPAM mindset, they might actually have gotten somewhere.
Seriously. CAN-SPAM didn't make it illegal to send spam, it set up some simple rules making it LEGAL to send spam. Things like the unsubscribe link (you know, the one that confirms that this address is active) actually has to unsubscribe you from that exact "mailing list". (But don't worry, next week we'll be sending spam to you on a different list).
You expected Can-Spam to help? All it did was define what were LEGAL methods for spammers to use, thus giving them even more loopholes. Anyone who thought that enforcement would be good was deluding themselves.
What went wrong was the CAN-SPAM act was never designed to prevent spam, instead it brought in provisos that actually forbid end-users from suing the spammers and also provided safe harbor for ISPs and 'online marketers', er spammers ...
...
One measure against spam was putting an `ADV' keyword in the subject of the email, but this was argued against by Bill Gates who instead argued for setting up 'safe harbor' that would absolve online marketers from getting sued
davecb5620@gmail.com
"Private right of action got stripped out of it due to complaints from the direct marketers"
..
Strike two was the ISPs getting imdemnified against getting sued and strike three was dropping any suggestion that spam should be flagged in the header such as putting an `ADV' in the subject line. The only canning of spam in the Can-Spam Act 2003 was in the title
davecb5620@gmail.com
... Extraordinary Rendition, then professional spammers in foreign countries is it.
Given that law enforcement in Russia is not helpful in getting spammers shut down, at least, and better prosecuted, then the remedy should be to just go in and get 'em and deliver 'em to GitMo.
Note: I do not support unconstitutional means nor violating international treaties in any way. However, since it's on the books, use it where it is necessary.
Wouldn't the people with good impulse control and self discipline be dead - shot by those who don't?
Just asking.
Nothing went wrong... CAN-SPAM was not meant to stop spam, and suggesting otherwise is irresponsible. It was meant to bring accountability to spam operations operating in the USA, which it did. Because of that, almost all of the "legal" email marketers out there are now out of business, and what we have today are almost all illegal spammers.
Back then, 45% of all e-mails were unwanted pitches for such products as Viagra, penny stocks or porn sites.
It's a bit different now.
Today, more than 83% of spam contains a URL for a Web site that is trying to infect computers with malicious software.
I've run spam scanning servers for a small ISP since 2000 and the changes that I've seen follow this trend. At one point I installed OCR scanning software for the penny stock image scams. Later it was PDF scanners. Then there was the password-protected zip files which had to be binary scanned. It's back to text now and lots of URL scanning. Grabbing the SARE signatures for ClamAV helps weed out that kind of crap.
It's become very hard to blacklist IPs because so many of them are from botnets and scattered so widely.
Basically, it's all a royal pain and a lot of work.
There weere two problems with this law:
1) Too little.
2) Too late.
Whether it would have been possible to restrict spam via legislation at all is a theoretical question. However, this law was not written to stop spam--it couldn't have worked, because there were too many ways around it.
Furthermore, it was a law in a single country, and we already knew that that would be pointless.
HOWEVER, the real problem stems from the fact that when spam started to get rolling, a handful of rogue ISPs (AOL, I'm looking at YOU!) refused to take responsibility for it. They allowed enough momentum to develop that it became profitable, and once it was both profitable and legally questionable, it was inevitable that organised crime would step in.
Now we're facing Russian gangs acting across multiple countries in eastern Europe. Think any legislation in the USA is going to slow them down?
"People who do stupid things with hazardous materials often die." -- Jim Davidson on alt.folklore.urban
The bill was lip service. If you're not going to hire the 25 computer forensic specialists, then give the FBI the manpower it needs to actually bust these idiots, then making laws doesn't mean shit.
Seriously, people. Let's make a bunch of laws about spam, then fight implementing them.
CanSpam law. Making idiots of lawmakers since 2003.
--Toll_Free
The fact that there is a market for it? Here's a clue, stop buying the penis enlargers and viagra pills and this market will dry up. The only reason spam exists, is because, golly, its working. Dumb people are buying these dumb products.
Hi, I Boris. Hear fix bear, yes?
Its a basic illusionary premise that all is well and prosperous. One senses something not quite right one day, and lo and behold, heads turn the other way. Then later that day one goes out and buys someting they can't afford with virtual money.
The quick fix enigma. The LONG fix would be that one would do some research and explore sources, read the flags, or at least program flags in. Ah, but this would take too long a time, and we only get 4 to 5 hours a sleep and I gotta get to my other job, and then a class at 7PM. - CRASH!!!
The CAN-SPAM law's purpose is to make it LEGAL to spam people. Which means that if you want to get rid of spam, the CAN-SPAM law is FUNDAMENTALLY flawed. Just read the CAN-SPAM law itself. CAN-SPAM says you can legally spam, as long as you follow some rules such as putting your "correct" header information on and including an opt-out clause message.
The primary failing with CAN-SPAM is an "opt-out" system, that is, it pretends that spam is okay as long as the sender includes an "opt out" address. That's fundamentally wrong; that means that senders can constantly create new shell organizations that send "one-time" messages every time they send something. If you're stupid enough to "opt out", you're immediately added to the "valid email" lists (aka a "sucker list"). Reputable articles about spam will SPECIFICALLY tell you to NEVER reply to a spam message, so the legislation requires law-abiding victims to do what they should absolutely NEVER do.
Legislation doesn't solve all problems; murder still happens, even though it's against the law. But the anti-fax-spam law, which is very similar, has been a resounding success. The difference is that the anti-fax-spam law made spam illegal, and required existing commercial ties or an opt-in into a list. Most companies still have and use fax machines, but spam is simply a non-problem for them.... in part because the legislation got this one right. So if you sent commercial spam by fax, then you ALREADY broke the law. Versus "CAN-SPAM", which is opt-out (not opt-in).
We need a law that makes spam ILLEGAL, not LEGAL. If you didn't EXPLICITLY opt into a list, and the message is sent to lots of people, then it needs to be illegal. I would love to see that happen, and with some teeth; spam is making email systems really painful to use. Then the U.S. can stop being one of the spam havens of the world, its current shameful position.
- David A. Wheeler (see my Secure Programming HOWTO)
The root cause is twofold. First, SMTP is inherently opt-out, not opt-in. By default, you always accept an email message unless it is from someone you know is a spammer. Being able to accurately identify the sender isn't all that helpful because most senders will be unknown to you, and thus whether or not they are spammers will not be known. Furthermore, generating new identities ought to be cheap, but in order for knowing the identity of the sender to be useful in the context of SMTP, it has to be expensive.
Contrast this with a pull-oriented email strategy, where my server contacts yours because we are "friends," to see if you have anything new to say to me. Now no traffic passes unless the recipient wants it to. The sender has no opportunity to attempt to fool the recipient, because there is no context for unsolicited traffic.
In this case, knowing the identity of the sender isn't all that important. We need to know that the message is from a person we said we wanted to hear from, but we do not need to know precisely who that person is. Receiving messages is a question of preference, not trust. If you start sending me spam, I un-friend you, and that's it - no more junk mail from you.
That's the fallacy here. And we see more and more of it every day. X is harmful for people? Ok, outlaw X. It has zero impact, though. Why? Because laws don't change people's behaviour. They may make that behaviour illegal, but whether or not people change their behaviour first and foremost depends on one single factor:
Do they understand why it is illegal? Do they support this law?
That's basically the first thing to ask when you want to know whether people will observe a law. Do they support it? Do they agree that X should be illegal? If they do, all is fine already. They won't break it. They most likely didn't break that law before it became law anyway, out of moral concerns or out of consciousness. Because they themselves thought that this kind of behaviour is "wrong".
If they don't, if they don't consider the law "morally supportable" and consider breaking it, the law's survivability depends on three criteria:
1. How likely is it that you're being caught?
2. How high is your gain?
3. How high is the penalty if you're caught?
And that's it. Nothing else matters. Actually, even only the first one really matters, judging from copyright and the ensuring madness. Zero gain, insane penalties and still people copy. They don't support the law, they don't consider it "morally wrong" to duplicate copyrighted content and the threat of being caught is infinitly small.
And it's exactly the same for Spam. But with the insane gain and (let's be honest here) incredibly low penalty as an added bonus. You want to fight Spam? Then fight it. Making a law about it doesn't do jack if the law is toothless. It's like saying the penalty for dumping oil in the sea is about a tenth of what you save by dumping it instead of recycling it. Then the penalty is just a cost factor, not a penalty. Cost for dumping: Ship, loading, crew, penalty. Most likely even in descending order or magnitude.
And for $deity's sake, enforce it! A law unenforced is a dead law. We already got plenty of them, we don't need more.
We're currently making laws as if this is the perfect solution to any problem. It isn't. Just because something is illegal people don't stop doing it.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Email is a recipient pays system.
The AC parent is 100% correct. No way, shape or form is this a free speech issue. It's an advertising issue. A few decades ago, we had a small shop and did a bulk mailing to our neighborhood. We got a bulk rate from the post office - and we paid it. It was a cordial mailing, generated business and goodwill.
That method still exists - but it costs spammers money. TF bad for them and boo hoo!
Political emails and so forth are NOT freedom of speech - they're fucking spam. You want to BROADCAST your message? You get a web site. You pay other web sites to advertise for yours. Just like one TV show is advertised during another.
Any hijacking of any medium from its intended purpose is SPAM. It's really simple.
Please mod parent up - about +1E5, Right On! should just about do it.
PPS - For those getting free email - many providers have it backwards!!!! Who remembers Juno? It was free email. The ads came to you, the USER, until/unless you paid. The ads did NOT go out at the bottom as footers, fer crying out loud.
Pathological kinda promises Path + Logical - but instead, you get stuck with pathetic.
If you name it CAN-SPAM, you can't seriously expect it to have any effect, can you?
I'm a leaf on the wind, watch how I soar...
-Lucy-
I mostly use facebook to send and receive messages to/from my friends, its largely replaced my personal emails. How about a similar system where you can only receive messages from people on your white list (who have been authenticated)?