Slashdot Mirror
CAN-SPAM Act Turns 5 Today — What Went Wrong?
alphadogg writes "Five years ago, the US tech industry, politicians, and Internet users were wringing their hands over the escalating problem of spam. This prompted Congress to pass a landmark anti-spam bill known as the CAN-SPAM Act in December 2003. Fast forward five years. The number of spam messages sent over the Internet every day has grown more than 10-fold, topping 164 billion worldwide in August 2008. Almost 97% of all e-mails are spam, costing US ISPs and corporations an estimated $42 billion a year. What went wrong here?"
especially when they are anonymous(or at least obfuscated) and in many cases, overseas and therefore beyond prosecution under this law
'I'm just saying
Enforcement would be nice. How hard would it be for some FBI office to sign up to get all the possible spam out there, and start replying to all the great offers from African banks?
Of course, a lot of the perpetuators do not reside in the US, but quite a few do. The more legitimate a business looks like, the more likely it has a US presence that can be used to stop it.
So vote with your US tax dollars and force your government to allocate serious funds to the problem. Please!
--
http://fairsoftware.net/ -- where software developers share revenue from the apps they create
What went wrong? Nobody stopped to define "Spam" before trying to make it illegal. So they made something up, called it spam, and made that illegal. And when people called them up to ask why they were still getting spam, they replied: I don't see any spam here!
#fuckbeta #iamslashdot #dicemustdie
something to do with the fact that the US Congress doesn't have jurisdiction over international crime rings.
That, and the allure of free advertising in a world full of idiots.
1) Legislation was flawed
2) Problem transcends US Jurisdiction
3) Enforcement is spotty at best
4) Idiots buy their stuff
Look at the name of the law. Working as designed.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
All the legislation in the world won't fix teenage pregnancies, the War On Drugs, etc etc.
Since there is really no technical mechanism to kill spam, the legislation itself is ineffective.
Engineering is the art of compromise.
You mean you guys have still been getting spam?
What signature defines me as a person?
Anything that fails to remove the financial motivation behind sending SPAM will fail to prevent SPAM.
No one in their right mind ever thought CAN-SPAM would have any tangible benefit.
Why am I not surprised. Ironic, kind of like the war on drugs. The stoners are winning.
Remember when we made weed illegal and now you can't buy... ooh, wait a second.
To summarize the summary of the summary: people are a problem. - Douglas Adams
Quite seriously, this law was specifically not aimed at spam. It was aimed at certain types of online fraud, and it deliberately took power away from local law enforcement to put it in the hands of a federal power that does _nothing_ about mere spam. It was carefully designed to allow 'opt-out' advertisements, and that first advertisement from any spammer, and it was carefully legislated that way by the Direct Marketing Association to avoid interfering with the advertisements of their funding agancies. It was also carefully designed to overrule more effective, state efforts.
Such laws should instead be modeled on the junk fax law, which has withstood the test of free speech challenges and ease of prosecution.
Your Congress advocates a
( ) technical (X) legislative ( ) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
(X) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
(X) Lack of centrally controlling authority for email
(X) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(X) Asshats
(X) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
(X) Willingness of users to install OS patches received by email
(X) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
(X) Extreme profitability of spam
( ) Joe jobs and/or identity theft
(X) Technically illiterate politicians
(X) Extreme stupidity on the part of people who do business with spammers
(X) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook
and the following philosophical objections may also apply:
(X) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
(X) Any scheme based on opt-out is unacceptable
(X) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
(X) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
(X) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
( ) Sorry dude, but I don't think it would work.
(X) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!
In fairness, nobody with any amount of knowledge expected it to have any impact. It's not really accurate to say it 'went wrong' when most of us never expected it to work in the first place.
I know where it is, and why it is still a problem. It is not in my email box, or the email box of most people. It is in the spam filters of our email providers. And that is the problem. I don't see it so I don't care. Sure, it may increase my cost to get online, but by how much. DSL is dirt cheap to what I was paying 10 years ago, and at better bandwidth. So what do I care? I don't see it, the problem is solved. And I can delete the 5 messages of spam that get through.
So out of sight, out mind, right? Wrong. I also know for the average person, and for the average spammer, those five messages per person that gets through can mean huge amounts of money. Even if nothing is bought, the way that mail clients are set up and vulnerabilities in the mail and web clients can make the spammer money. For instance, most clients now render HTML and load images automatically. Apple still refuses to set an option in mail.app to turn off HTML permanently, though it does allow one to not load images. Still, most people load images, which registers as a hit on some scam web site and registers the email as valid. Rendering the HTML can allow viruses on the receivers machine. And even the semi legitimate spammer still has hope that someone will buy a product.
We won't be able to get rid of all spam, even though we can't get rid of mail scams though it is a felony. The best we can manage it. If we are to fix it more, then we have to bring the problem to the forefront by letting spam through, or some other methods.
"She's a scientist and a lesbian. She's not going to let it slide." Orphan Black
The bill got the people who paid for it, what they wanted. Permission to send spam.
To fix the bill, it needs the following:
1. Outlaw spam. (yeah, won't probably happen, but I can dream.)
2. Require labeling. Make it easy for spam filters.
3. Permit private right of action for individuals.
4. Require attorney fees to be paid to successful plaintiffs.
5. Strict liability for the advertised party. No more, "Oh yeah, that affiliate didn't get permission to send that e-mail to you -- don't blame us."
The bill is incorrect, you can go after foreign spammers, it is just harder.
Fight Spammers!
Seriously, the problem with every anti-spam countermeasure I've seen so far is that they are all based on using SMTP as a mail transport. And SMTP is a protocol designed for a civilized Internet - one where every email sent is assumed to be one that the designated recipient wants.
In order to stop spam, we need to stop using SMTP and switch to a protocol that rejects mail by default. Unfortunately, this requires a flag day, and nobody's put forward a protocol like this yet, so we're still stuck with insane amounts of spam.
Congress had no idea why spam was a problem and therefore did not draft legislation designed to address the problem. http://ssrn.com/abstract=487162 Instead, they took a shotgun approach of trying to legislate against a panoply of problems, which meant that the law was not designed to fix any single problem and therefore was not going to succeed even from day 1. Eric.
The problem is not that the CAN-SPAM act of 2003 is flawed.
The problem is that the US seems to assume that laws made in their country are globally accepted.
Prohibiting pretty much anything will just make those people that want it get it from another source. For example, look at the prohibition of alcohol in the US... suddenly many people had the urge to visit Canada and/or Mexico more often (even bring back 'souvenirs').
Just my 2-cents in the matter.
I say don't drink and drive, you might spill your drink. Before you get behind the wheel just stop and think.
Freedom of speech is more important than $42 billion a year.
Political speech, asking for a petition to be signed, telling someone about your faith, selling door knobs... there is a plethora of good bad and highly subjective things people can say, repressing speech, even 'commercial' speech both a constitutional violation and a vary dangerous precedent to set.
I don't like receiving 'get a bigger penis' adds any more than the next guy, but the legal action should be against the individual for lying, not for communicating speaking.
Look at the people who blew up the hotels in Bombay (Mumbai these days) - just a few men in boats with guns -- sophisticated protection can't stop them every time. We might as well give up and spend the money on something useful.
The number of spam messages sent over the Internet every day has grown more than 10-fold, topping 164 billion worldwide in August 2008.
Those are great numbers. Imagine how much SPAM would have been sent had the law NOT been passed!
Private right of action got stripped out of it due to complaints from the direct marketers. That was strike one. With so much spam it's completely unreasonable to expect anyone to enforce the law. Crowdsourcing the enforcement through private right of action would've worked. And the direct marketers knew it...
The second strike was that the bill didn't anticipate the success of botnets and Russian organized crime. The law doesn't do jack s*** about that problem.
In Soviet Russia, I ruled you
Our clients include many bands and music venues. We make every effort to be legit (unsubscribe links, legit reply email addresses, and all legit headers and DNS entries), but the rules of the game are not even available.
See, many ISP's (AOL, and my new target of wrath, earthlink) have rules about the maximum number of messages allowed to come from a single source to their domains in a given time period. Exceed those, and you are an abuser. Except they won't tell you how many messages or how long the period. On the one hand I understand as spammers could use this to get through. But you can't even call them and get info. I've emailed their abuse lines with no reply. It's as if NO ONE knows this info. How does one follow the rules when they are undocumented and beyond the legislative code?
Or when earthlink this past weekend decided we were a spammer, and spammed us back with abuse notices. But then they delivered our email to their customers many, many times in repetition. Like a dozen or more. It was not a server flaw on our side as confirmed by the database and log files. It was 'something' on their side that acted as a repeater for our legit email even as it was notifying us that we were spamming. We then get lots of nasty emails, which we reply to by hand. I spent half of the morning yesterday trying to get anything out of earthlink regarding the issue, but if you don't want to subscribe for service, they don't know what to do or where to have you call. I don't even know what the hoops are, much less can I jump through them.
I get lots of unwarranted spam, but I also get many distribution lists that I want and look forward to reading. Some places make that a nightmare if you want to provide that service.
Um, flag day?
Yes, a Flag Day.
I know others have said this and it's been argued before, but SMTP as it is right now should be dead. A new protocol should replace it. Yes yes, I know what a huge Herculean feat that would be - but if you look at the effort and $$ the world has collectively dumped into spam control up until this point, to me it just makes sense to start over and gradually replace the old protocol. I'm in the same boat as you, as well as my users... hardly any spam makes it to the inbox, but the damned maintenance on perimeter spam control devices and all the eaten-up bandwidth is just nuts.
Just disrupt the deflector shield with a tachyon burst.
> Makes me wonder why do they bother.
Because sending email to many people is cheap. If one out of 200 spammed people buys the product the spam is advertising, the spammer is making a decent profit.
http://news.bbc.co.uk/1/hi/technology/7719281.stm says 1 in 12 million.
I'll see your Constitution and raise you a Queen.