CNN.com - Bush signs anti-spam bill - Dec. 16, 2003

Basically, Bush just made SPAM legal. People don't want it to be legal, people want to stop getting it.

* People can just use offshore companies to send SPAM (many do already)

* You can't prohibit or legislate SPAM sent from other countries.

* The bill uses an opt-out approach, as opposed to a better opt-in approach. Now spammers can just send you SPAM and keep sending it unless you tell them to stop. Of course, we all know that opting out just lets them know the email address is valid, and valid email addresses are sold more than Russian women.

* The bill makes sure that SPAM contains certain things to be legal. Such as an accurate subject line, and certain info in the SPAM itself. If the SPAM has these elements then it is Government Approved Grade A SPAM. A spammer can send your mail system a million pieces of SPAM, clogging your customer inboxes and using your resources. Too bad, no legal recourse since it is legal. Want off the list? Go opt-out. Opted out? Watch yourself just get more SPAM.

* 37 states already have anti-spam legislation. This law supersedes it. California and Deleware only allow SPAM to people who have opted in to get it. Sorry, you don't have to opt-in anymore. California also allowed for people to sue offenders. No more, since the federal law supersedes this and doesn't allow for this.

* The internet is global, which the US gov't seems to forget. When a EU based, or Canadian business sends SPAM it can't be legislated. They can continue to send SPAM as they always have.. using open proxies, with subject like "Remember last night?" which contains kiddie porn info, no valid return email addresses or opt-out info. Remember, the US also bans online gambling businesses. They are all offshore, booming with income and out of the reach of legal recourse from the US gov't.

* If the SPAM is sent by company A for product XYZ, and you opt-out of email for product XYZ, will this stop company A from sending you SPAM about product ABC? Or, from their subcontractors from sending you email from XYZ?

I could go on with why it won't cut the amount of SPAM you get (which should be the real purpose of the law), and the legal questions the wording of bits of the law doesn't answer. For example, the "Sender" of a message is defined, in part, as "...a person who initiates such a message and whose product, service, or Internet Web site is advertised or promoted by the message..." Who is really the sender? See the "and" in there? If you make widgets, and people resell your widgets and SPAM using your branding to do so.. who is the sender? A parent company should be able to prevent their products from being sold via SPAM.

The wide range of opinion is that this bill won't cut SPAM in your inbox and won't really help the battle against it. And, I agree... since it won't. I think the only things I really like in the bill is that SPAM can't be sent via open relays. Also that it bans harvesting emails and directory service attacks.. but of course, how can you prove the spammers did this? I'm not even sure the bill prevents me from harvesting emails, then selling them to spammers. The spammers didn't do the harvesting, they just purchased a list of email addresses. But, even with these, since SPAM is now legal, they have no reason to do so. Just make sure the SPAM follows the rules, and send them all you want.

This is going to be a nightmare for IT managers and server admins. And SPAM will continue to flow freely and legally from within the US and not dent the offshore SPAM business. One of the other sad things is that people will probably hooray for Bush for signing this in without ever have reading it or researching the issues with it.