Subject: All IETF posted email addresses MUST be real.

From: tglassey <[email-masked]>
Date: Thu, 21 Jan 2010 19:26:01 -0800

So Fred and Russ - we talked about this once before - Now there is a 
court ruling on using fraudulent email addresses in any public process. 
So this also means that all IETF posted email addresses MUST be real and 
functional so responses can be sent to those parties directly according 
to the 9th Circuit's interpretation...

Bummer that eh? Think what this means to the IETF and its policies.

Todd
--------------------------------------------------------

Jan/12/10| WHOIS Privacy Considered "Material Falsification" /A recent 
decision by the Court of Appeals for the 9th Circuit/ /By Ryan Sadler, 
Legal Team/

A recent decision by the Court of Appeals for the 9th Circuit has 
determined that using WHOIS privacy on domains may be considered 
"material falsification" under federal law. The defendants in US v. 
Kilbride (9th Cir., 2009) were convicted under the CAN-SPAM Act in a 
case that involved criminal charges of intentional email spamming. 
Enacted by the US Congress in 2003, the CAN-SPAM Act prohibits false or 
misleading transmission information, deceptive headers, and requires 
email solicitations to give an easy opt-out method and be labeled as an 
advertisement, including the senders physical post address. Commercial 
emails that use false or misleading headers, or violate other CAN-SPAM 
provisions, such as falsified registration information, are subject to 
fines of up to $11,000 for each unsolicited email sent.

The CAN-SPAM act states that "registration information is materially 
falsified if it is altered or concealed in a manner that would impair 
the ability of a recipient of the message...to identify, locate, or 
respond to a person who initiated the electronic mail message..." The 
defendants argued that since the terms "impair", "materially falsify" 
and "conceal" are not defined in the statute they should be considered 
unconstitutionally vague. The court responded to the defendants' 
assertion by clarifying that "when Congress does not define a term in a 
statute, we construe that term according to its ordinary, contemporary, 
common meaning." The court then made it clear in their ruling that the 
defendants' use of private WHOIS information in this case materially 
falsified the registration information. The court declared that "It 
should have been clear to the defendants that intentionally falsifying 
the identity of the contact person and phone number [through WHOIS 
privacy] for the actual registrant information constitutes intentionally 
decreasing the ability of a recipient to locate and contact the actual 
registrant, regardless of whether a recipient may still be left some 
avenue to do so. We therefore conclude defendants had notice that their 
conduct violated the CAN-SPAM act."

Although the ruling does not make use of WHOIS privacy illegal, it does 
serve as a clear message from the court that coupling the use of privacy 
services with intentional spamming will likely result in a violation of 
the CAN-SPAM act. This is an important decision that members of the 
domain community should refer to prior to utilizing a privacy shield.

-----------------------------------------------------------

---

From: tglassey <[email-masked]>
Date: Fri, 22 Jan 2010 10:17:05 -0800

On 1/22/2010 9:51 AM, [email-masked] wrote:
> Todd,
>
> Question - would this interpretation still count if the emails specified they were from the ietf and gave the recipient the ability to unsubscribe? I can think of tons of instances where a nonresponding address would need to be used.
>    
Great question and no - the problem is that the sender has to be 
physically identifiable. from my reading of the law and this ruling it 
means we MUST have a functional return address for everything and many 
people in the IETF use addresses like "[email-masked]" as their 
RETURN TO addresses and the FROM address is equally toast. That makes 
the IETF responsible for formally certifying and ensuring the positive 
service of any notice. Also there has to be a legally created point of 
contact available so IP Notices can be sent to the parties. The IETF 
fails this miserably and bluntly its probably the ISOC managements fault 
they they have operated under these failings for so long IMHO. Now its 
time to do something about this and fix these processes so that all 
parties are properly defined and all points of contact properly 
enumerated so that things like Cease and Desist or Patent Infringement 
Notices can be sent. The IETF's direct intent to hide that contact 
information makes it and its management liable as well in my opinion, 
something that is a real issue and that will cause litigation at some 
point if the IETF doesnt get its act together.
> I'm not a lawyer, but when I read this it seemed to say that the court felt it was a violation when you (a) concealed your identity using a private registration and (b) used a shadow email address with no option for self-removal. I might be wrong on that, just trying to understand how that ruling relates to ietf practices.
>    
It means ANY cooperative contractually controlled group process  (like 
the donation of IP to the IETF through NoteWell or other submission 
models) needs full disclosure on the IP Owners and their commitment to 
the use of that IP in the IETF. It also means that the refusal to 
actually disclose the true sponsor is also a 'hiding of contact 
information' as well. All parties to any contractual process MUST be 
properly identified in  order for the contract's provisions to be 
enforceable IMHO...

Todd
> Endre
>
> Sent via BlackBerry from T-Mobile
>
> -----Original Message-----
> From: tglassey<[email-masked]>
> Date: Thu, 21 Jan 2010 19:26:01
> To: Russ Housley - IETF<[email-masked]>; [email-masked]<[email-masked]>; Fred Baker<[email-masked]>; IETF Discussion<[email-masked]>; [email-masked]<[email-masked]>
> Subject: All IETF posted email addresses MUST be real.
>
> _______________________________________________
> Ipr-wg mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipr-wg
>
>    
>
>
>
> No virus found in this incoming message.
> Checked by AVG - www.avg.com
> Version: 8.5.432 / Virus Database: 271.1.1/2638 - Release Date: 01/22/10 07:34:00
>
>