In the 191st Issue of EFFector (now with over 29,300 subscribers!):

• ALERT UPDATE: "Anti-Terrorism" Surveillance Bill To Pass This Week
• Public Interest Postion on Junk Email: Protect Innocent Users
• EFF Comments On W3C's Draft Patent Policy
• EFF Participates in FMC's Panel Discussion on Digital Music
• Announcing the EFF Contest of the Century!
• EFF Thanks CoffeeCup Software, Inc.
• Administrivia

For more information on EFF activities & alerts: http://www.eff.org/

To join EFF or make an additional donation:
  http://www.eff.org/support/
EFF is a member-supported nonprofit. Please sign up as a member today!

ALERT UPDATE: "Anti-Terrorism" Surveillance Bill To Pass This Week

Both the US Senate and House of Representatives have passed slightly different versions of the "Uniting and Stregthening America Act" (USA Act), an ostensibly anti-terrorism bill with many terrorism-unrelated, alarming provisions that erode protection againsts improper government surveillance, among other problems. The House version contains (probably worthless) "sunset" provisions that would expire some of the wiretap-related sections of the bill after several years unless they are re-ratified; but these provisions are not expected to survive the final draft.

Final passage, despite our and your activism efforts, is essentially assured, and will be by way of a conference committee and a final vote on the merged version of the bill that results from the committee. However, it would not hurt to contact your legislators once again to express your disapproval of this legislation, and to contact the White House to urge President Bush to refuse to sign the final bill into law (not likely, but you'll be counted among those on record in opposition to the USA Act.)

EFF will issue a statement if/when the bill passes, and, with other organizations, will work to monitor implementation of the new law, and examine avenues for legal challenges against its more troubling provisions.

To our friends in other countries: You would do well to keep a close eye on what your own government is doing. The US is hardly alone in taking misguided steps toward become a more totalitarian society in the hope of stopping terrorism.

For bill texts and analyses, see the EFF Surveillance Archive:
  http://www.eff.org/Privacy/Surveillance/

- end -

Back to table of contents

Public Interest Postion on Junk Email: Protect Innocent Users

EFF Statement Regarding Anti-Spam Measures

Executive Summary: Any measure for stopping spam must ensure that all non-spam messages reach their intended recipients.

For the past several years, the Electronic Frontier Foundation (EFF) has watched with great interest the debate regarding what to do about unsolicited bulk email from strangers, or spam. We have been asked to lend our support to bills that have been introduced in Congress, and we have been approached in various other ways to help lead the fight against this annoying intrusion into people's email mailboxes.

While members of the EFF staff and board find this unsolicited email to be as annoying as everyone else, we believe that the two most popular strategies for combatting it so far--legislation and anti-spam blacklists--have failed in their fundamental design. Anti-spam bills have been badly written, are unconstitutionally overbroad, and frequently wander into areas where legislators have no expertise, such as the establishment of Internet standards. And anti-spam blacklists, such as the MAPS RBL (Mail Abuse Prevention System Realtime Blackhole List, the most popular), result in a large number of Internet service providers (ISPs) surreptitiously blocking large amounts of non-spam from innocent people. This is because they block all email from entire IP address blocks--even from entire nations. This is done with no notice to the users, who do not even know that their mail is not being delivered.

The focus of efforts to stop spam should include protecting end users and should not only consider stopping spammers at all costs. Specifically, any measure for stopping spam must ensure that all non-spam messages reach their intended recipients. Proposed solutions that do not fulfill these minimal goals are themselves a form of Internet abuse and are a direct assault on the health, growth, openness and liberty of the Internet.

Email is protected speech. There is a fundamental free speech right to be able to send and receive messages, regardless of medium. Unless that right is being abused by a particular individual, that individual must not be restricted. It is unacceptable, then, for anti-spam policies to limit legitimate rights to send or receive email. To the extent that an anti-spam proposal, whether legal or technical, results in such casualties, that proposal is unacceptable.

The Two Extremes of the Current Email Battlefield

The legislative proposals that have dominated the anti-spam policy debate for the last several years have failed, and rightly so. The several existing state laws against spam are of questionable constitutionality, too hard to enforce even if they should be enforced, and have done nothing to stem the tide of spam. National legislation will not solve the problem either, while creating a morass of unintended consequences.

Serious problems with the anti-spam legislation we have seen to date include:

• misdefinitions of key terms and concepts, including "commercial," "list," and "spam" itself;
• technology-specific requirements that will be rapidly obsolete;
• a focus on punishing expression rather than protecting privacy;
• the giving of broad power or obligation to ISPs to control the private email of their customers;
• jurisdictional problems;
• unnecessary and excessive criminalization of private, civil disputes;
• requirements with which senders will find it impossible to comply;
• and a clear pattern of providing a defense for ISPs in the form of immunity from the simple realities and responsibilities of the marketplace, rather than one of enabling individuals to protect themselves.

But poorly-focused legislation is not the only failing proposal here. Many groups of often well-meaning people have worked on ways to avoid the various annoyances and problems caused by unsolicited bulk email. Anti-spam blacklisting groups, such as MAPS and ORBs, put heavy pressure on ISPs to conform to a set of restrictive anti-spam policies and to virally pressure other ISPs to adopt the same policies. It is estimated that over 50% of US-based ISPs and up to one third of global ISPs already participate in the blacklisting.

But blacklisting is interfering with the delivery of a significant amount of non-spam email. Systems administrators who will not adopt the suggested anti-spam policies find themselves unable to deliver their non-spamming users' mail to recipients who are on systems that participate in blacklisting. This blocking is being done at too high a cost. Ultimately, civil rights and the ability of non-spammers to communicate cannot be sacrificed to serve the goal of blocking unsolicited bulk email.

The search for a nonexistent, and ultimately impossible, legislative or ISP-level blacklist "magic bullet" solution has actually distracted the Internet community for the last five years from the real solution: better voluntary user-end filtering and/or voluntary, informed and flexible ISP-level filtering. Only an end user-controlled solution will uphold the rights of the end users while serving to deter spam by removing most of the audience and making it unprofitable to continue junk emailing.

The Right Way to Look at Spam

Until we include the free speech rights of all end-users instead of trying to stop a few wrongdoers at the cost of innocent users, any solution for dealing with spam will be fundamentally flawed. End users, known as "customers" to ISPs, should demand that none of their wanted email be censored in attempts to filter out unwanted messages. In addition, Netizens should express their dismay at spam by boycotting products advertised with spam.

On a larger scale, EFF supports combatting spam by providing end-users with adequate tools to filter unwanted messages on the receiving end. We also support the development of more robust and subtle technology for this purpose. Brightmail, for example, has created a system that does a good, if still imperfect, job. Others that attempt to do this are listed at http://spam.abuse.net/tools/mailblock.html. From a technical standpoint, we would like to see the development of better filtration software on servers, something that could work interactively with the mail recipient in defining what he or she regards as spam using pattern recognition. That is, every time somebody gets a message of a sort he or she does not want, s/he could send it to the filter, thereby making that filter smarter over time, as well as giving it the ability to "learn" as spam techniques develop.

The rights of users to send and receive email must not be compromised for quick and dirty ways to limit unsolicited bulk email. Neither misguided and ignorant legislation, nor collusive, high pressure protection schemes, have a legitimate function or place in our online future. The Constitution, and the promise of a free, open Internet that exists for and is controlled by its participants, requires us to do better.

- end -

Back to table of contents

EFF Comments On W3C's Draft Patent Policy

Staff Technologist's Letter to Patent Policy Working Group

Dear W3C Patent Policy Working Group Members:

The Electronic Frontier Foundation (EFF), the leading civil liberties organization working to protect rights in the digital world, submits the following comments on the PPWG's draft patent policy.

We focus our attention on the most controversial provision, Section 5.2, which creates a RAND ("reasonable-and-non-discriminatory") licensing mode for W3C Working Groups. Adopting this policy would mean that, for the first time, W3C would have a formal mechanism for promoting some patent-encumbered web standards -- with the knowledge that these standards could not be implemented by everybody.

As WWW inventor Tim Berners-Lee observes in _Weaving the Web_, "patents ... are a great stumbling block for Web development. ... Small companies may be terrified to enter the business [in the face of patent claims]." Because of its harmful effects on smaller organizations, and the resulting risks to openness and interoperability on the web, we urge W3C to reconsider its support for a RAND licensing mode.

The draft policy notes that

participants in a standards body will be unwilling and unable to work collaboratively if, at the end of the process, the jointly-developed standard can only be implemented by meeting licensing terms that are unduly burdensome, unknown at the beginning or even the end of the design process, or considered unreasonable.

This uncertainty is a significant risk to standards development, but participants are not the only beneficiaries of the process (nor the only parties whose support is called for). Where a standards body undertakes to develop public standards for general use -- clearly the aim of W3C standards work -- the larger community of prospective users and implementors also has a deep interest in standards' licensing terms. As the policy continues, this community has a "longstanding preference for Recommendations that can be implemented on a royalty-free (RF) basis".

This "preference" must not be treated lightly; it has been essential to the success of the World Wide Web and the Internet as a whole, and one of the key features setting the Web apart from closed, proprietary content-delivery systems. Royalty-free web standards have provided the raw material for an explosion of creativity and the development of diverse but interoperable implementations.

Much of the software which runs today's web is open source, like the W3C's own reference implementations. The world's most popular HTTP server package, Apache, is a leading example; W3C's own web site is using it, as is EFF's. But although a flat royalty structure might seem perfectly "reasonable" to a large corporation, the Apache Software Foundation -- and Apache licensees -- might well see things otherwise. Prospective implementors are all different, but when any implementor is left behind by a patent licensing system, everyone suffers.

The draft policy attempts to distinguish between high-level and low-level web standards, in a largely informal way. Section 2.2, reporting on consensus within the Patent Policy Working Group, draws this distinction: