What is Wrong with the CAN SPAM Law?

No Consistent Labeling of Spam

The law requires that spam be labeled but leaves choosing the label up to the spammer. It won't be possible to automatically filter spam since there won't be one consistent label that the filtering software can trigger on. Spammers will be allowed to be as creative as they wish in choosing the label.

No Consistent Opt-Out Method

Under the law spammers have to provide an internet based method of opting out, but there is no requirement to make this consistent or easy. Requiring the email spammee to jump through hoops is allowed. The opt-out page may even have multiple opt-in links on it to intentionally confuse the user and prevent automatic opt-out programs from automatically unsubscribing the user from further spam. The spammers get to choose how they implement the opt-out and there are no standards, so they will almost certainly get highly creative.

No mandated mechanism to opt out all possible user names at a domain

People that own their own domain name usually have things set up so that all mail addressed to any address in that domain comes to them. There is not just one address associated with them, but an infinite number. Opting a single username at their domain out of the spam will have absolutely no effect, since a untold myriad of usernames will reach the spam victim. Without legislating a method of opting out whole domains it simply won't be possible for someone with a domain for themselves to get any relief.

No mandated mechanism to opt out all possible host-names and subdomains

Users with their own domain don't only have the problem with multiple usernames, but also multiple host-names and sub-domain names. If the domain the user owns has several machines, then each address at each machine needs to be opted out. If a new machine or subdomain gets added to the pool of machines then the users have to all go back and opt-out with their address on the new machine too. Eg. if user "jim" has an account on machines alice.example.com, bob.example.com, and charlie.example.com then they need to opt-out 3 times as jim@alice.example.com jim@bob.example.com jim@charlie.example.com. If the institution has hundreds of machines the opt-out will become quite tedious. Whenever the institution adds another machine everybody has to drop what they are doing and opt that new address out of all the hundreds of spammer sites too.

Sheer Numbers Problem

Opting out of all the spam is not possible for many people. We currently get 82,000 (82 THOUSAND) spam attempts per month. It just isn't possible for the two users of this machine to opt out of all of that spam. The opt-out needs to cover all the spammers. It just isn't possible to go to each spammer's web site and individually opt out from that.

No Requirement to Honor the "NO UBE" "NO UCE" Notice*

The receiving machine's email program will sometimes display the electronic equivalent of "No Loitering or Trespassing". At a bare minium the spammer's mailer should be obligated to honor the "NO UBE" "NO UCE" request. Even better would be if the spammers were mandated to remember seeing that notice for a minimum of one year and not waste the time and bandwidth of the receiving machine every time they tried to deliver more spam.

* "Unsolicited Commercial Email" and "Unsolicited Bulk Email"


Contact your Senators

Now that this loophole-ridden CAN-SPAM law is in effect we should insist that the government start enforcing the law and arresting the spammers that can't even be bothered to follow it, as lax as it is. The current level of spam is outrageous and something needs to be done about it now. Let your senators know how you feel!


Valid XHTML 1.0!.Valid CSS! [ Powered by Fedora Core ] IPv6 Ready

wolfgang.rupprecht+web@gmail.com (Wolfgang S. Rupprecht)
WSRCC Home Page || Up One Level
last updated $Date: 2007/05/24 22:21:54 $ ..