An Architecture for Spam Regulation

I. INTRODUCTION II. BACKGROUND A. The Spammers' Tools B. The Case for Spam Regulation III. LEGAL HISTORY A. Common Law Remedies B. Legislative Responses C. First Amendment Concerns D. Industry's Response IV. ARGUMENT A. Governing Principles B. A Different Approach 1. Technical Overview 2. Extending the Authentication-Based Framework 3. Proposed Regulatory Framework 4. Defining "Bulk" 5. Enforcement Procedures and Penalties 6. Global Implementation C. Scrutiny of Proposed Architecture 1. Narrowly Tailored to Spam 2. Privacy Preserving 3. Transparency 4. A Functional Opt-out System 5. Enforceability 6. Cost-Effectiveness D. Avoiding the Pitfalls of ICANN V. CONCLUSION "Architecture becomes the tool of law when the direct action of the law alone would not be as effective."--Lawrence Lessig (1) I. INTRODUCTION Both legal and technical attempts to regulate spam (2) have proliferated in recent years. As the problem of spam has grown to 12.4 billion messages per day, (3) legislatures, Internet service providers ("ISPs"), and software developers have all tried various responses. Legislative responses have culminated in the Controlling the Assault of Non-Solicited Pornography and Marketing Act ("CAN-SPAM Act") of 2003. (4) Numerous e-mail clients now include spam filters, and ISPs are using both technical and legal means to strike back at spammers. Indeed, the Online community appears quite united in its contempt for spam. In spite of the numerous attempts to regulate spam, the problem has not diminished. The spammers continue to win the war in spite of the Internet community's best efforts. The recent CAN-SPAM Act has had little effect. (5) Legislative responses are limited by jurisdictional obstacles to enforcement and the technical measures taken by spammers to disguise their source and identity. Technical approaches to dealing with spam, such as spam filters and blacklists, have probably been more successful, but have also faced their share of problems. Spam filters often struggle with filtering too much or too little. (6) Furthermore, filters fail to deter future attempts, and spammers often find ways to circumvent the filters. Blacklists and similar approaches represent an Online form of vigilantism with many side effects. (7) Innocent parties often have their messages blocked, (8) and there are few safeguards to make sure that parties are only being blacklisted for good cause. (9) David Sorkin has suggested that the "[c]oordination of technical and legal mechanisms seems to be the most promising approach to the spam problem." (10) Despite the fact that many people would agree with Sorkin, legislative and technical approaches to stopping spam have yet to be coordinated. Sorkin suggests that this is because the consensus required for such coordination is unlikely to be achieved. (11) This Note argues that the universal low regard for spam makes such coordination possible. Instead of making architectural changes that enforce a particular legislative approach to spam, the focus should be an architectural approach that enables both ISPs and end-users to more effectively identify and filter unwanted spam. The law is not excluded from this solution, rather it has an important role to play in enabling it. This Note begins by outlining the techniques employed by spammers to evade both technical and legal countermeasures, then goes on to explore the costs spam shifts from mailers to recipients. The First Amendment constraints placed upon any regulatory model are outlined, followed by a suggested regulatory and architectural framework that could enable a substantial reduction in spam while leaving filtering decisions in the hands of individual e-mail users. …