Ivan Trundle Manager, communications, systems and publishing [please remove the '.nospam' from address]

inCite : January-February 2004 : article

The great battle of our time

'The board is set. Pieces are moving. We come to it at last... The great battle of our time.' Gandalf stating the obvious as the Orcs head towards the city of Minas Tirith, in The return of the king, JRR Tolkien

And a happy New Year to you all. For many office workers, the Christmas/New Year break (if a break is taken) is a chance to reinvigorate, to return to a clean desk and a diminished in-tray, and to begin afresh. Well - it would be, but for the mountain of e-mail spam that many of us have collected over that time. And if any of you thought that the latest anti-spam legislation from Australia and America would make a dent in your in-box, you will be sorely disappointed. Here is an example: my spam to 'real e-mail' ratio is presently appalling: I returned to a depressing 768 spams and 6 'genuine' e-mails after the Christmas break.

Legislation introduced in Australia (Spam Act 2003) and more recently in the United States (CAN SPAM Act of 2003) could best be described as tentative steps in the right direction, but ultimately doomed to fail without the full support of the entire world internet community. The great battle of our time has just begun. We might not have dive-bombing Nazgûl or other terrifying monsters attacking us from all sides (apologies to the three people in Australia who are unfamiliar with Tolkien's imagination), but for some, spam in e-mail in-boxes can be equally demoralising and can ultimately bring us to our knees.

Australia's spam legislation becomes law on 11 April 2004 (by Royal Assent, no less), according to the Minister for Information Technology and Communications, Daryl Williams, who said in a statement that the legislated grace period will give Australian businesses 'time to adjust their practices where necessary.' Whilst the Australian Bill passed through parliament some time before US president George Bush signed his government's so-called 'CAN-SPAM bill', Americans already have their own bill in place (since 1 January). Daryl Williams has also signed a memorandum of understanding with the Korean Information Security Agency to co-operate on spam-related issues, which must surely be a relief to some. Multilateral approaches to fighting spam might eventuate from an OECD (Organisation for Economic Co-operation and Development) workshop to be held in February, but don't hold your breath on this one.

What does our spam legislation offer? Most importantly, the Act prohibits the sending of 'commercial electronic messages' without prior consent - unless there is an existing customer-business relationship. This is defined in the Act as where a person has made a prior 'positive indication' that they wish to receive messages from a business or other source. The Act also requires that contact details of the [Australian] sender of the message be sent with the message as well as a 'functional unsubscribe facility' (let's ignore the fact that the person might not be 'subscribed' in the first place, or the plain and simple fact that the sender must be identified as residing in Australia) to allow recipients to 'opt-out' from receiving further messages. The Act also prohibits the 'supply, acquisition and use of electronic harvesting software and lists generated for spamming purposes'. The Act instructs the ACA (Australian Communications Authority) to act as watchdog and to enforce penalty provisions. Australian courts will be given powers to award compensation for damages causes by spam.

However, let's look at the tricky bits (and the exceptions for political and religious organisations et al).

The Act proclaims that commercial electronic messages can be sent if they offer an 'unsubscribe facility', and/or 'accurate information about the individual or organisation who [sic] authorised the sending of the message'. Battle-hardened e-mail users will know that the offer of an unsubscription is used by spammers to identify and validate an e-mail address from their harvested collection of addresses. The moment that you respond, they add you to their database. And that database is often onsold to others. The unintended consequences of our Australian legislation is that many recipients of spam will respond with a 'cease and desist' to all incoming spam, thus increasing the likelihood that they will receive more spam from other sources - unless the recipient is absolutely sure that the e-mail is indeed covered by Australian legislation. This aside, there is no provision in the legislation to stop (Australian) spam from being sent in the first instance, merely to prevent further instances from the same business.

The Act also proclaims that commercial electronic messages can be sent if it can be identified as not being spam. A cynic might protest that the Bill was drafted by interest groups rather than government here, and it is clear that the exceptions allow for truckloads of 'spam' to be sent to recipients: if it does not promote or include illegal content, if it is not deceptive or breach common or statute law, if it does not collect or use personal information in breach of national privacy principles, or if the recipient has voluntarily dealt with the sender before, and can reasonably be assumed by the sender to accept messages of this type being sent.

Of course, exceptions apply to protect 'currently-accepted government, business and commercial practices, such as government-to-voter messages, and commercial messages to publicly-advertised addresses where the approach is specifically related to the addressees' employment function' (whilst not declaring if having your e-mail address discoverable through the internet is deemed 'publicly-advertised', how does one determine 'employment function' in this day and age?).

Don't get me wrong here: I am not advocating that the Australian Bill is faulty, but it is just that in many instances this Bill actually legitimises spam, rather than the opposite. The same can be said for the American 'CAN-SPAM Act', which must surely have the most ambiguous title in legislative history, and possibly intentionally so (for the record, the bill is an acronym for 'Controlling the Assault of Non-Solicited Pornography And Marketing Act of 2003', though you have to wonder at the focus on pornography here...).

Without any doubt, solutions to the spam problem world-wide will come from software and the online community, and not from legislation (and whilst the American legislation recognises this implicitly, it suggests that a regime of 'co-operative efforts with other countries' will block the rest). As an example, my non-work e-mail account uses a combination of SpamAssassin (which detects the likelihood of spam-worthiness in each message) and my laptop's mail client software, which uses a learning filter to detect spam and throw it into my 'junk mail' folder: this combination traps practically all genuine spam. The system is not perfect, but it helps: and before long my workplace will hopefully have equally-sophisticated methods of trapping spam.

Even if the entire world legislated against spam (and this is highly unlikely), it takes little effort to disguise the origin of any given spam message. And if money is to be made from spam (surely it is, otherwise spammers would have given up years ago), then it will continue unabated. Nonetheless, the Australian Spam Act 2003 is a small but significant step in the right direction. The great battle of our time is just begun.

Next month: what the Australian Spam Act means for Australian businesses - and what you need to know to be compliant.

Links

The Australian Spam Act 2003.

Information on sending commercial messages using 'best practice' (stop laughing, this is deadly serious): http://www.noie.gov.au/projects/confidence/Improving/spam.htm.

CAUBE (Coalition Against Unsolicited Bulk E-mail, Australia).

The United States CAN-SPAM Act of 2003.