Subject: RE: DEPLOY: Legal liability for creating bounces from forged mess ages

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 24 Aug 2004 09:22:22 -0700

> Suppose the original message, copied into the bounce, 
> contains pornography which is illegal under English law.

First off, there is nothing that requires you to copy anything into the
bounce.

Secondly if it is an automatic process your liability would be no greater
than it would be following original SMTP. 

There is no English law against 'pornography', the actual offense is
publication of obscenity. 

There is a whole rack of issues here, first publication on the Internet has
been addressed in the English courts, there has to be actual knowledge or at
the very least a constructive effort to avoid knowledge of the contents for
publication to have occured. Then when you get into the obscenity
definitions you have a whole rack of further intent issues.

If you are worried about creating liability don't copy information.

---

From: <[email-masked]>
Date: Tue, 24 Aug 2004 13:05:49 -0400

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Hallam-Baker,
> Phillip
> Sent: Tuesday, August 24, 2004 12:22 PM
> To: 'Chris Haynes'; IETF MARID WG
> Subject: RE: DEPLOY: Legal liability for creating bounces from forged
> messages
>
>
>
>

Providing that you are willing to accept the original email LOST.  Bounces are done to:
1)  inform the sender the delivery failed
2)  inform the sender WHICH email the deliver failed, where the WHICH is best defined by including
the email so one can view the specifics of the email to deal with the matter further

> than it would be following original SMTP.

Wrong.  When you bounce it now knowing the validity of the bounce recipient has you have less
liability then if you bounce it KNOWING that the bounce recipient is invalid.

> publication of obscenity.
Irrelevant, especially for many other countries, but even for areas under "English" laws because
"publication" is not sufficiently concise in this context and hence open to interpretation.

> definitions you have a whole rack of further intent issues.
That may be sufficient for some to believe, but "ignorance is no excuse" has been the big stick that
many courts have wielded time and again.

> If you are worried about creating liability don't copy information.

If your "mail as reliable communication" means nothing to you, yes.

---

From: <[email-masked]>
Date: Tue, 24 Aug 2004 13:17:50 -0400

Sorry for the typo, that should read:
Wrong.  When you bounce it <NOT> knowing the validity of the 
bounce recipient you have less liability then if you bounce it KNOWING that the bounce 
recipient is invalid.

Terry Fielder
Manager Software Development and Deployment
Great Gulf Homes / Ashton Woods Homes
[email-masked] 
Fax: (416) 441-9085

> [mailto:[email-masked]]On Behalf Of
> [email-masked]
> Sent: Tuesday, August 24, 2004 1:06 PM
> To: 'Hallam-Baker, Phillip'; 'Chris Haynes'; 'IETF MARID WG'

---

From: "Chris Haynes" <[email-masked]>
Date: Tue, 24 Aug 2004 18:27:59 +0100

> First off, there is nothing that requires you to copy anything into the

If I reject at SMPT time with a 5**, it is common practice, over which I have no
control, for the offering MTA to include the message content. Nevertheless I
will have been the 'agent' requesting that message to be propogated, when it was
I who knew that it had been forged.

Also note the repost of [email-masked]

> than it would be following original SMTP.

I am legally liable for any process I put in place, automated or manual.

Original SMTP had no way of telling me 'this is a forgery'.

The whole point of this thread is that it appears to me that Sender-ID may
change the legal liabilities and obligations.  In the absence of authoritative
legal advice, I choose caution, I choose not to deploy Sender-ID.

> publication of obscenity.

I never said there was. I was using teminology which would be appropriate for an
international readership.

In any case, substitute Phishing a.k.a. Attempted Fraud throughout my argument,
if you prefer.

> definitions you have a whole rack of further intent issues.

Are you / your employer / Microsoft / the IETF prepared to indemnify my
businesses against prosocution?

> If you are worried about creating liability don't copy information.

All I need to do to avoid this worry is to not deploy Sender-ID. Then I can
continue with my business of copying and moving information with a clear
conscience.

Chris