A Briefing On Public Policy Issues Affecting Civil Liberties Online
from
The Center For Democracy and Technology
(1) Spam Continues to Plague Industry and Users
(2) Enforcement Efforts Increase, But Face Challenges
(3) Technology Proposals Are Seen as Key
(4) Technical Solutions May Implicate Non-Profits and Political Speech
Please note that CDT reissues Policy Post Volume 10, Number 15 to correct inaccuracies related to our description of the Sender Policy Framework. CDT regrets the error and apologizes for any inconvenience.
As of June 2004, approximately 60% of all email was spam. Measures such as the federal CAN-SPAM Act, which took effect in January 2004, have had limited impact. Certainly, nothing has yet turned the tide. If anything, spam appears to have become more invasive: spammers distribute viruses, spyware, and surreptitious spamware. "Phishing" capitalizes on spam to perpetrate fraud against online consumers.
In July 2004, CDT convened a meeting of industry, consumer advocates, human rights campaigners, and technologists to discuss the status of anti-spam efforts. As the CAN-SPAM Act had gone into effect six months earlier, mid-summer was an opportune time to evaluate the extent to which Internet users were experiencing some relief from spam, and to examine the responses of law enforcement, industry and technology developers.
The concerns of ISPs focus on the costs spam imposes, costs that end-user filtering does not address. Mainstream companies doing business online worry about the efficacy of email as a communications medium. Increasingly, they are concerned about whether legitimate email -- for example, purchase confirmations -- will get through. Some progress has been made in developing good practices for email marketing, such as committing to solely permission-based marketing lists. Strategies of email marketing may be moving away from acquisition of email lists and toward retention of existing customers.
Consumers are frustrated with the lack of reduction in the incidence of spam since the passage of the CAN-SPAM Act. Consumer advocates point to the fact that users have no private right of action against spammers under the Act. Businesses respond that an industry-sponsored consumer education program could focus on consumers' online behaviors that result in their receipt of spam.
Both consumer advocates and businesses note that providing the means to identify and authenticate senders is key to resolving the spam problem. However, issues of protection of legitimate anonymity remain to be resolved.
A report summarizing the July discussion and highlighting areas of agreement, disagreement, and ongoing concern is available at http://www.cdt.org/speech/spam/20040715consultation.shtml.
For CDT's analysis of the CAN-SPAM Act at the time it was enacted, see http://www.cdt.org/speech/spam/031211cdt.pdf
CDT's analysis of why consumers receive spam and what they can do to curtail it is at http://www.cdt.org/speech/spam/030319spamreport.shtml
Pursuant to the enforcement provisions of the CAN-SPAM Act, several states have brought cases against spammers under the law. At the federal level, at least 62 cases have been brought by the Federal Trade Commission. Most of the cases brought against spammers were based on allegations of deceptive trade practices.
Identifying spammers is a key challenge to efforts to enforce spam laws. Another is the lack of enforcement agents with the necessary experience, training and skills. In many states, the attorney general's office lacks the resources to train staff to adequately enforce spam laws.
ISPs have also begun to bring enforcement actions, and the industry says that the level of resources employed in fighting spam and the skill of personnel working on the cases have increased.
Given the limitations of enforcement, attention is turning to technological solutions. Proposals focus on key characteristics of email and email senders - reputation and identity; adherence to best practices; and filtering by the end user.
The Sender Policy Framework (SPF) contemplates an infrastructure that relies upon identity and evidence to assure that a sender is who he says he is; prevention agents that detect denial of service attacks, assess sender reputation and filter outbound messages; and protection filters that prevent spam from reaching the end user's inbox. SPF is a technical standard that works in conjunction with a program that includes government-industry partnerships, strong spam laws, interagency cooperation in enforcement efforts; industry standards and policies; and educational programs to inform users about tools and best practices for dealing with spam, as well as about how to assure the deliverability of their own messages.
The TRUSTe-Bonded Sender program identifies and authenticates legitimate email. The program identifies senders who are pre-qualified through the Ironport service. Once certified, the sender must post a bond for a specified amount, based on anticipated email volume. The Bonded Sender program debits the bond amount based on customer complaints. Once certified, Bonded Sender places the sender on its whitelist. If there is a sudden rash of complaints or other significant cause for concern about the sender's behavior, the sender is temporarily suspended. Bonded Sender employs a business-to-business dispute resolution process.
Habeas promotes sender best practices, provides feedback about senders, and ensures deliverability of messages. The goal of the Habeas solution is to help senders establish identification and authentication practices. Habeas uses a complaint resolution process that currently investigates every complaint received by the company.
For more information:
TRUSTe-Bonded Sender program: http://www.bondedsender.com/
SPF: http://spf.pobox.com
Ironport: http://www.ironport.com/
Habeas: http://www.habeas.com/
Anti-spam technical solutions, especially those implemented at the ISP level, raise issues non-governmental organizations. Several issues warrant further consideration, including:
CDT expects to continue its examination of the spam issue with a follow-up meeting focusing on these free expression issues.
Detailed information about online civil liberties issues may be found at http://www.cdt.org/.
This document may be redistributed freely in full or linked to http://www.cdt.org/publications/pp_10.15.shtml.
Excerpts may be re-posted with prior permission of ari@cdt.org
Policy Post 10.15 Copyright 2004 Center for Democracy and Technology
