Subject: Spam

From: ColorNet Robin <[email-masked]>
Date: Tue, 21 Sep 1999 00:39:07 +0200

Hello all. .....

I have started rereading the draft run and there are a number of points
that could be brought out.
For example the case of theft is seriously weakened with increasing
recourse to free internet access and cable connection.
Also, and I will go into this deeper after my lunch on wednesday with the
Commissaire of the CNIL (French Data Protection Agency), there are a
number of changes in the pipeline including opt in agreements due to start
in Europe in January, and agreed on by all the European Data Protection
authorities.

I have suggested that those on this list also join the ISTF list - it is
by invitation so drop a note to Vint  [email-masked] and you will have open
access .... enjoy.

The first part of this e-mail contains my thoughts which can be further
developped or ignored as concensus sees fit.
The second part is an initial rewriting of the draft, which could in turn
be further trimmed down (small is said to be beautiful by some),
developped or ignored as .... :=)

Best regards Jonathan
.................................................................................
SPAM

At a time when Internet users are increasingly subjected to unsolicited
e-mail, or SPAM, and are put to financial inconvenience or restraints of
time and of ressources :

At a time when some  Internet actors are obliged to commit significant
ressources to vehiculing SPAM, and when others can be tempted to use some
of the potential mechanisms of controlling SPAM in a manner held counter
to the Internet Society Guiding Principle that  "On-line free expression
is not restricted by other indirect means, such as excessively restrictive
governmental or private controls over comuter hardware or software,
telecommunications infrastructure, or other essential components of the
Internet" :

At a time when governments and governmental organisations throughout the
world are adressing the specific problems associated with SPAM and
unsolicited communications of whatever nature :

finding or even defining a common platform which could be acceptable to,
and easily adopted by, all parties is a difficult exercise.

Although the Internet Society has elected to restrict its area of
competence to the Internet, this restriction does not apply to the
individuals, groups or institutions mentionned above.  As direct and
indirect Internet influence extends, frontiers - both physical and virtual
- become blurred, and the very term multimedia defines the convergence of
industries or territories previously regarded as distinct or even
separate.  Therefore, at a time where the law, and definitions of legal
responsibility and jurisdiction are evolving much faster than before, is
is appropriate to reexamine the areas in which the Internet Society (ISOC)
through the "User Services" area of the Internet Engineering Task Force
(IETF) can contribute to an open and mutually beneficial discussion by all
actors.  This discussion may be extended through consultations with the
Internet Societal Task Force (ISTF) recently formed by ISOC to examine the
societal impacts of Information Technologies.

The paper draws from the following points quoted from the ISOC Mission
Statement
The Internet Guiding Principles,
Open, unencumbered, beneficial use of the Internet
Self-regulated content providers, no prior censorship of on-line
communications.
Personal information generated on the Internet is neither misused nor used
by another without informed consent of the principal
and from the ISOC Principles
Purposes and Goals of the Organisation,
harmonization of actions and activities at international levels to
facilitate the development and availability of the Internet
liason with other organisations, governments and the general public for
coordination, collaboration, and education in effecting the above purpose.

This document seeks to lay the groundwork for future discussion between
all actors in a context aiming at reinforcing the open, unencumbered, and
beneficial use of the Internet.  Although the paper is not unaware of the
different possible interpretations applicable to certain key words in the
ISOC Mission Statement, the aim herein is to provide a working platform
that all can draw on, and to provide ongoing examination of these matters.

Although the scope of the document was initially restricted to the use, or
misuse, of bulk commercial unsolicited e-mails, frontiers are becoming
blurred.  While the terms "bulk" is not an issue here, the term
"commercial" can be variously interpreted  according to end use, or user
impact. "Unsolicited" can be taken too far.  Just as it is becoming
impossible for the off-line world to ignore the existence of the on-line
world, the on-line world can no longer ignore the legal extension of
national or international authorities into an area which until recently
was regarded as extraterritorial.  In this context IETF and since 1992
ISOC has a recognized legitimacy and a recognized role to play as the
historical body responsible for initiating, maintaining, extending and
adapting the protocols and the usages of the on-line world, and, through
"Netiquette" the internationnally accepted exchanges attached thereto.

ISOC's mission is to assure the open development, evolution and use of the
Internet for the benefit of all people throughout the world.  To
accomplish this mission, ISOC wants to create a clear image, or
positioning. The credibility, the clarity and the relevance of ISOC and of
the USER SERVICES area of the IETF, both in the eyes of Governmental
Organizations, of Business interests, and of the Civil Society, could be
called into question if topic areas relating directly to the use of SPAM,
of unsolicited on-line commercial communications ignored the interrelated
areas of unsolicited "non-commercial" mail, of advertising in that the
latter is almost always by definition unsolicited, and of censorship,
privacy and of the use or misuse of personal information.  Ignorance of
the off-line context, and of the legal interrelationship between ON and
OFF line would be mistaken.

Although historically "Netiquette" had no legal force, and where peer
pressure has been the only effective arm available to counter abuse of the
open, unencumbered and beneficial use of the Internet, a recent body of
legal precedents is taking both the word and the spirit of netiquette into
account.

ISOC objects to SPAM as it misuses shared ressources and impedes bandwidth
availability.
The USER objects to SPAM because of the above and because it is rarely
held informative, and frequently incurs increased direct and indirect
connection time (and therefore in many cases cost) while rarely offering
perceived benefit.

The user can be confronted with unsolicited e-mails on one of two levels.
These communications can be either "relatively" untargeted, or they can be
directly targeted.

Business is understandibly divided on this area :

Businesses or individuals ressorting to SPAM perceive a useful and
profitable business model.

Businesses active in internet related are opposed both because of the
negative image of SPAM, and because at this stage of the Internet it
increases costs while often slowing down the system.

Businesses wishing to extend from traditionnal markets on-line through
advertising, branding, or purely on a sales and information basis,
sometimes have conflicting priorities.  They may be torn between
"e-commerce" as an extension of traditional options in the form of
advertising banners, sponsorship etc. - with a vested interest in
unsolicited communication on what at this stage of the on-line/off-line
equation appears socially, politically and economically acceptable.  They
may be concerned by any "censorship" of unsolicited communication, because
this would further complicate the ONLINE learning experience of how to
prosper economically, - and thus foster "CRM" Customer Relationship
Management programs or ONLINE "1:1 Marketing Strategies" made economically
possible by the real-time planetary nature of the Internet.

Regulatory Authorities throughout the world are coming out of a period of
observation and the learning curve which until now has caracterized the
low profil adopted. Governments are seeking to actively stake a claim
before all ability to do so is lost.

The spirit of this has been explicitly formulated by the French Council of
State in its synthesis published on July 2nd 1998
http://www.internet.gouv.fr/francais/textesref/rapce98/synthese.htm#anchor298164

The Internet and the digital networks open up a new area of human
expression, an international space which transcends frontiers, a
decentralised area which no operator and no state controls, a
multicultural area where everyone can act, express himself, and work, an
area where freedom is held essential.

This area is not naturally that of the law.  The law, with its territorial
limitations, is supported by stable behaviour patterns categories -
elements totally lacking on the Internet. This antagonism with the law,
according to some, fostered the initial stages of the online experience,
devoid of all restraint except that self-imposed by the community of
researchers who created it.

This situation can no longer continue.  The success and vulgarisation of
the Internet, which is now a general public and commerce area linking over
100 million users, leads to the necessity of fixing regulations and legal
guidelines.  Who fixes these rules, according to what standards and with
what efficiently.  The answers can no longer come only from a small group
of specialists.  They must be discussed by all governmental and private
actors." …….

This has been further extended in the chapter dealing with Privacy
http://www.internet.gouv.fr/francais/textesref/rapce98/rap1.htm
where one of the major legal instruments being primed for online extension
is that regarding the privacy part of the advertising chain.  The argument
runs more or less on the grounds that much unsolicited e-mail comes from
mailing lists taken from individuals unaware that they have been
segmented, and are thus illegally hung drawn and quartered.  It is thus
natural to prosecute offenders on a number of (ad)counts - generally drawn
from precedents set in the telecommunications sector.

However although the privacy issue is in itself a justification for
governmental intervention, this is not the only area that should be
adressed in this document.  Other issues turn around governmental concern
to take the initiative away from both a small group of specialists  and
from the general public.  Where this can have short term benefits for the
Internet as a whole in "cleaning up" some of the less savoury aspects of
online practices the medium to long term implications are less certain.
This revolves around who has the right to allow who to contact who.  It
also extends to pixel watermarking, and any number of bio-identification
techniques.  The security aspects revolving around digital signatures are
also involved, because, on the one hand, online security is indispensible
for stable and secure electronic commerce, but on the other hand
Government is trying to steer an uncertain course between privacy
protection (which implies increased cryptography) and identification of
"the criminal element" which implies easily accessible keys.  Where the
criminal element of today is understood to be the pornographer or the
money launderer, who can tell where the line may be drawn tomorrow.  At
present self regulated PEER PRESSURE provides an easy, and some would say
simplistic answer.  This peer pressure will not necessarily have a net to
stand on in the brave new world of tomorrow.

Another problem that must be adressed is that of restricted lists.  How
will the merchant know if his targetted customer refuses online
advertising.  One answer is subscription to restricted list information.
Can [email-masked] be contacted ?  Here, all steps must be taken to ensure easy
and cheap, almost public service access to such lists, to avoid situations
where only medium to large corporations would be economically able to pay
an annual consultation fee, leaving the "little man" with the choice of
paying an excessive subscription fee or risk the consequences.

In the past, governmental regulators have justified the legal foundations
of internet law by affirming (and correctly so) that ONLINE legislation is
an extension of OFFLINE legislation and therefore fully justified in a
number of areas.  After an initial period of uncertainty this is called
"filling the vacuum".  Unsolicited e-mails are thus the prime example of a
convenient institutional scapegoat - especially as they not only have an
irritant value (time spent), but also a potential social value (no
pornography or online gambling) but also a security value (no virus
transmission).  Their eradication is thus socially, politically,
electorally and economically justified.  Nevertheless, the internet
community has to weigh other factors before coming to an informed
decision.  These include free speech (who can send what to whom),
technological filters from free choice  (cookie killers, advertisement
killers and spam identifiers) and imposed technological filters with
watermarking techniques which aim at end to end message control,
identification and thus open the door to less savoury practices.  We are
now witnessing a role reversal where the very advantages of "free email
advertising" in respect of real-time accessibility and flow through are
being challenged in the sacred name of privacy by some interests that are
using the real-time information flow to control rather than to ensure
internet freedoms.  It is interesting to note that there is a great deal
of effort being channelled towards ONLINE control mechanisms, while
equivalent measures that could be taken OFFLINE are conveniently ignored,
or postponed as too difficult to efficiently implement.   Recognition of
some of the issues at stake here is to be found at the Global Internet
Liberty Campaign, whose recent statement
http://www.gilc.org/speech/ratings/gilc-munich.html underscores the double
edged sword of content control.

..//..
I could ramble on from here to eternity but to conclude at this stage and
leave the field open for the RUNning ....
There are a number of other issues and subissues addressed by Internet
actors.  Some areas of reflection lie in the Internet Society's assumption
of third party certification role, or of a joint role with an
internationally recognised NGO or inter governmental organisation.
Another area of interest concerns a Universal Anonymous Identifier which
although it could protect privacy would not necessarily prevent
unsolicited communications - but only render them meaningless through lack
of appropriate identification methodologies.  It must be noted in this
respect that the national data protection agencies like the CNIL in France
only have authority to express an opinion where the nominative identity of
an individual can be either directly or indirectly extrapolated.  In a
totally self-regulated anonymous environment then the data protection
agencies have no mandate.  This brings us to individual identification as
an economic agent rather than [email-masked].

To put out a draft ignoring the basic arguments around the whole spam
issue would be, IMHO, at best misguided.  There should be a serious
rethinking of the guidelines of the draft document.  All due attention
drawn to the fact that whatever document is produced, it reflect ongoing
thinking in such a way as to pave the way to well defined platform from
which all actors could draw, and to which all could refer, while at the
same time protecting the interests of freedom both on and off line.

That is all for part 1 for tonight folks !  I can now look forward to
execution with a clear conscience :=)

Best regards Jonathan

.........................................
IETF RUN Working Group                           Sally Hambridge / Intel
draft-ietf-run-adverts-01.txt                        Donald Eastlake 3rd
                                                          September 1999

REWRITE pages 1-6

            How to Advertise Responsibly Using the Internet

Abstract

The Internet is not a free resource. Access and online presence comes at a
cost to the participants, the service provider, or the recipients of those
services made available through the Internet.  Because of the rapid growth
and "mainstream" acceptance of the  Internet, new opportunities have been
found for the distribution of information to the vast and ever-growing
community of Internet users. Economic opportunities afforded by the
unprecedented access that has been enabled by a more readily available
Internet, has encouraged some groups and individuals to use shared
Internet ressources for purposes for which it was not intended, defying
consensus among the practitioners and the unwilling recipients.

This document examines is the sending of Unsolicited Commercial and Bulk
E-Mail messages, posts to Netnews (usenet) groups, or other unsolicited
electronic communication. This document aims at clarifying the definitions
of Internet Marketing and at highlighting the interconnected issues
connected therewith.  These include advertising, privacy and traceability
issues which are currently attracting the attention of legislators world
wide, and will propose a common ground where advertiser, recipient, and
the Internet Community can coexist in a mutually respectful and productive
fashion.

Status of this Memo

This document is an Internet Draft.  Internet Drafts are working
documents of the Internet Engineering Task Force (IETF), its Areas, and
its Working Groups.  Note that other groups may also distribute working
documents as Internet Drafts.

Internet Drafts are draft documents valid for a maximum of six months.
Internet Drafts may be updated, replaced, or obsoleted by other documents
at any time.  It is not appropriate to use Internet Drafts as reference
material or to cite them other than as a "working draft" or "work in
progress."

Please check the I-D abstract listing contained in each Internet Draft
directory to learn the current status of this or any other Internet Draft.

It is intended that this document will be submitted to the IESG for
consideration as a standards document.  Distribution of this document is
unlimited.

1. Introduction

   There are stereotypes that must be broken before continuing.  Not all
persons new to the Internet are ignorant of its history and evolution, or
its proper and ethical uses.  Nor are all experienced, "long-term"
Netizens against the use of the Internet for advertising, marketing, or
other  business purposes. Where these two groups can find commonality is
in their opposition to the use of the Internet in irresponsible ways,
including the sending of Unsolicited Bulk or Commercial E-Mail to mailing
lists, individuals, or netnews (usenet) groups. In the vernacular, this
activity is called "spamming" (the sending of "spam" - for a history on
the evolution of that term, refer to RFC-2635, Section 2). To understand
why such activities are    irresponsible, one must first understand the
true cost and the privacy implications of such actions.

   The protocols and architecture upon which the Internet is built, which
are recognized and adhered to as standards, provide for an openness and
availability which foster and encourage easy communication. These
standards were developed at a time when there was no need to consider the
concept of "rejecting"     information. While those standards have
evolved, they continue to emphasize open communication. As such, they do
not associate costs or impact with the user-initiated activities which may
occur.

Because of this openness, persons can and do send large volumes of E-Mail,
with little-to-no cost or financial impact for the volume of messages
sent.  To some groups or individuals, this presents the attractive of
multiplying the recipients of their marketing material, and presumably,
increasing their success-rate. However, there are inherent costs to borne,
and above all it is difficult to dissociate the privacy issues from the
economic arguments in favour or agains this communication relationship.

Even if every E-Mail message bears no direct cost, either direct (cost per
message received, an incremental increase in connection charges) or
indirect (higher service fees to recoup infrastructural costs associated
with the additional 'Net traffic    which such mass-mailings create) other
resources, such as the disk space and time of the recipient, can be
consumed.

As recipients have little control over whether or not they receive such
messages, the aforementioned costs are incurred without consent. It is
this condition (the absence of consent to bear the costs of receipt of a
mass-distributed message) that initially shaped the Internet Community's
viewpoint - that the act of sending Unsolicited Commercial or Bulk E-Mail
("spam") constitutes a willful theft of service, money, and/or resources.
Those who choose to ignore the financial   impact, and instead focussed on
the consumption of indirect resources, have been known to label spam
"Internet Pollution".

At one level, this paper provides the reader with a framework through
which  the marketer, the advertiser and the Internet community can coexist
as well as possible. At another level the document draws the attention of
all online actors to the legitimate concerns in the area of privacy
protection, censorship, and those areas directly covered by ISOC's
submission.
2. Image and Perception of the Advertiser

The sender of  unsolicited e-mail will be increasingly obliged to weigh
potential  income generation, and market or business expansion against the
risks that such actions implies

        -   The alienation of many of the recipients of an advertising
message

        -   The damage or loss of credibility in the advertiser's other
markets

        -   Possible loss of advertiser's and/or seller's Internet
connectivity (most service providers will be enforcing "zero tolerance"
policies which prohibit the use of their systems for the sending of
"spam", or for encouraging or enabling such activities)

Civil and Criminal litigation (in the United States, and progressively in
other sovereign states, it is becoming accepted that the theft-of-service
associated with spamming is equitable to real theft).  However, especially
in Europe, with the spread of free internet access services, and fixed
price cable or wireless connection the theft issue may become marginal in
future.

-    In Europe, the various national data protection agencies are
considering        either opt in or opt out clauses on all sites under
their jurisdiction.  Increasing use of the issue of personal privacy in
restricting unsolicited electronic communication does not concern itself
with the notion of theft, but with the use or misuse of personal
identification for purposes of unsolicited commercial and in some cases
non commercial communication.  The borders between the two are in many
cases difficult to define.

   It is a fundamental tenet to any Internet presence that a party will be
responsible for their Internet "image"; the personae that they create. The
advertiser is held responsible for his actions, and the effects those
actions have in the marketplace, which is to say, the Internet community.
"Peer pressure" can be generated far more effectively in real-time online
than offline.

   Until recently, the Internet rendered all parties anonymous. The
methods used to sell products in the traditional sales channels;
language, image, relationships, eye contact or body language; have had to
adapt to an Internet sales environment.   This is changing, with the
digital signature becoming increasingly integrated into national laws.
Reputation,  reliability, honesty, trustworthiness, and integrity have,
online taken the place of the more direct sales approaches previously used
offline. These are dictated by the rate at which both information and
misinformation travel on the Internet. Just as an Internet user cannot
control messages received, neither can Internet marketers control the
information that is disseminated about them, or their activities.
Responsible advertising on the Internet explicitly implies prior consent
by potential recipients.

3. Understanding Theft

 The sending of Unsolicited Commercial or Bulk E-Mail ("spam") has
generated a significant level of undesirable.  "Spammers" (and in
particular, those entities providing mass-mailing services for third-party
businesses) often try to ensure their anonymity. These actions take
various forms, and have been known to include:

        -   Forging the sender name, domain name, or IP Address
            of the sender (called "spoofing")

        -   Sending messages through any type of hardware, software or
system which belongs to an uninvolved third-party (called "relaying")

Such activities are criminal acts in many countries. It is unethical to
use the
resources of any other party without the latter's express permission.
Offenders have been successfully prosecuted in numerous jurisdictions.

4. Caveat Mercator

"Let the Seller beware." Advertisers and Sellers can be held responsible
for the appropriateness of messages sent.  Prospective advertisers must be
certain that the recipients of their advertising are appropriate.

        - Sales to minors cannot always be enforced, and, depending on content,
are often illegal.

        -   In many countries, providing a link to a website where content
of an overt sexual nature is displayed to under-age minors is a crime. As
the provider of the link, the advertiser's position is tenuous. In some
countries, such material is a crime to view, possess, or distribute
("trafficking") content of an overt sexual nature. A party engaging in
such activities must consider the implications of international law.

In the interests of personal privacy, advertisers should have no way to
both nominally identify and to qualify a prospective recipient as an adult
with complete discretionary and plenipotentiary authority.  How does the
prospective advertiser/seller determine audience ? The essential
requirement is that the advertiser "know" his audience.  This can help to
ensure that the recipient is genuinely interested in receiving
information, as with some PUSH technologies.

If an advertiser maintains an active website or uses other mass-marketing
tools (such as direct-mail), and is interested in pursuing Internet
Advertising, the "Opt-In" concept, to be discussed in detail later in this
document.  The advertiser MUST inform the person that data is being
collected. In addition,   the reason why the information is being
collected should be clearly stated. BE AWARE! There are jurisdictions
which restrict the collection of Personal Data. The laws addressing
collection and future handling of Personal Information vary from place to
place. Avertisers must gain an understanding of those laws and of
rationales behind them.

---

From: "Donald E. Eastlake 3rd" <[email-masked]>
Date: Mon, 20 Sep 1999 23:09:07 -0400

This is an IETF Working Group.  We have no business talking about or
for ISOC unless there is some clear public ISOC statement we want to
quote that relates to how to how to advertise on the Internet.  While
ISOC sometimes asserts that the IETF is part of ISOC there has never
been general agreement in the IETF on this point.  Statements like
"ISOC objects to SPAM' are totally out of place.  Go talk to the ISCO
Trustees if you want statements out of ISOC.

We already have a recent general RFC on spam.  This is uspposed to be
a targetted RFC on what advertisers should do.

Frankly the text below was so overblown and tugid, beside being off
topic, I found it virtually unreadable.  I think merchants would also.
We are not going to be able to effecitvely give merchants advice in a
document they will not read.

Donald

From:  ColorNet Robin <[email-masked]>
Message-ID:   <[email-masked]>
Date:          Tue, 21 Sep 1999 00:39:07 +0200
Reply-To:  IETF-RUN <[email-masked]>
Sender:  IETF-RUN <[email-masked]>
To:  [email-masked]