Re: An alternative to remailer shutdowns

> > The second is to simply include the
> > consent-code along with the encrypted peice of mail and a legal notice
> > stating that decryption of the mail constitutes your consent to receive
> > the mail, as well as your agreement to hold the remailer-operator harmless
> 
> By reduction - you could just do a rot13 on the message and 
> append the "legal notice".   If all the information for decoding
> a message is present in that message, is a different encoding
> mechanism really any different from straight ASCII text?  
> (i.e. Netscape 9.13 might have auto decoding built it....)
> Then, the user doesn't do anything "extra" - does this invalidate
> the notice?
Donno. IANAL. :)
> I might be wrong, but I don't think that this second method would
> gain you anything in the 2 situations where operators will get 
> hassled.  1) Posting of copyrighted material - the lawyers will
> at least harass you no matter what kind of legal notice is up front.
> 2) Mailing of "harassing" information - the person still gets
> unwanted email, and has no way to stop it.

[RANT MODE ON- skip to the next paragraph if you dont like politiks]

Here we are back at step one again. In the end, it would seem that there
isn't much that can be done about the worst forms of abuse, without
filtering mail for content. However, someone pointed out that other
package delivery services have acheived freedom from responsibilty for the
content of the packages they deliver - and I beleive that a part of the
explanation for this lies in the fact that they /do/ make attempts to
limit abuse in-so-far as they are able. Part of limiting the remailers
liability is tied up with legitimizing them as a useful service, and
establishing to the public that we are concerned with abuse. Too many
people beleive that the whole point of a remailer is to facilitate illegal
and abusive communication, and unless that changes we can expect to be
dealt with as criminals at worst, or at best as purposfully negligent.
I'm not certain what the solution is, but I am certain that doing nothing
isnt it...

[RANT MODE OFF--]

One idea that came up a while back was a sort of limited tracking of mail
-- an example would be keeping a hash of the email address where mail was
received from for 48 hours, with the hash value being attached to the
peice of mail as a header.

This would accomplish two things: We could source block an address without
knowing the source; and if push came to shove an address could be
backtracked to its original source, provided a complaint was made in time,
and that the Bad Guy sent another mail from the same address. I think
that legally there would be a good argument that the remailer ops had made
a reasonable attempt and holding lawbreakers accountable, while still
preserving the anonymity of non-abusers.



Just a thought.. 

Ben.

On Tue, 21 May 1996, Ben Holiday wrote:

> 
> 
> On Tue, 21 May 1996, Daniel R. Oelke wrote:

> 
> > > The second is to simply include the
> > > consent-code along with the encrypted peice of mail and a legal notice
> > > stating that decryption of the mail constitutes your consent to receive
> > > the mail, as well as your agreement to hold the remailer-operator harmless
> > 
> > By reduction - you could just do a rot13 on the message and 
> > append the "legal notice".   If all the information for decoding
> > a message is present in that message, is a different encoding
> > mechanism really any different from straight ASCII text?  
> > (i.e. Netscape 9.13 might have auto decoding built it....)
> > Then, the user doesn't do anything "extra" - does this invalidate 
> > the notice?
> 
> Donno. IANAL. :)

A person has notice of a fact if he knows the fact, has reason to know it,
should know it, or has been given notification of it.  Restatement,
Second, Agency section 9.

The important issue here is what constitutes constructive or implied 
notice (the second example above).

Constructive notice exists where a party could have discovered a fact by
proper diligence and where the situation casts a duty on him to inquire
into the matter.

A person who has _actual_ notice of circumstances which would set of the
"alarm bells" of a prudent person has constructive notice of the issue
itself where a notice clause was available and easily referenced.

See F.P. Baugh, Inc. v. Little Lake Lumber Co., 297 F.2d 692, 696.

Also comes the question what notice is adequate?  Notice reasonably
calculated, in all circumstances, to apprise all interested parties of
actionm and opportunity to present their objections, says U.S. v San Juan
Lumber Co., 313 F.Supp. 703, 709.

I'm not going to discuss what constitutes a legal agreement here for the
purposes of waiving rights to hold the remailer operater harmless.  These
are traditionally unnegotiated agreements that courts are not likely to
want to enforce.  (Back of a ski lift ticket, notice that the garage is
not responsible for theft).

If a court feels that the remailer operator is being negligent or some
such, a notice like you are talking about is not likely to be very
effective.

I find that making the user decrypt the message as acceptance of the mail
is clever, but what exactly does it accomplish?  The user can still have
his copyrights violated in the text, what does it matter that he did or
did not accept the mailing?

> This would accomplish two things: We could source block an address without
> knowing the source; and if push came to shove an address could be
> backtracked to its original source, provided a complaint was made in time,
> and that the Bad Guy sent another mail from the same address. I think
> that legally there would be a good argument that the remailer ops had made
> a reasonable attempt and holding lawbreakers accountable, while still
> preserving the anonymity of non-abusers

Let's call this the "hash policy."

I'd be interested to see what the ration of volume between mailers with a
hash policy and mailers without a hash policy would be.

Simply the perception that records are being kept could have a chilling
effect.

The user is in no position to verify how secure those records are, or that
they are indeed hashed at all.

While the same is true with regards to logging at all (hash or no) I think
the feeling that the existance of records somehow makes it more likely the
the remailer operator will (with resistance) cooperate with the
authorities is amplified.

Either you do or do not believe that a remailer operator is keeping
full and unhashed records.

If you KNOW that records are being kept, well, to the user, what's the
difference between this and the mailer logging all traffic fully and
putting the information in a "Secure" directory?

How precisely does hashing protect the user?

> Just a thought.. 
> 
> Ben.

---
My preferred and soon to be permanent e-mail address:unicorn@schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell@pacifier.com

> One idea that came up a while back was a sort of limited tracking of mail
> -- an example would be keeping a hash of the email address where mail was
> received from for 48 hours, with the hash value being attached to the
> peice of mail as a header.
> 
> This would accomplish two things: We could source block an address without
> knowing the source; and if push came to shove an address could be
> backtracked to its original source, provided a complaint was made in time,
> and that the Bad Guy sent another mail from the same address. I think
> that legally there would be a good argument that the remailer ops had made
> a reasonable attempt and holding lawbreakers accountable, while still
> preserving the anonymity of non-abusers.

	This would have two problems (I think :):

1) How do you tell that the source address isn't a remailer?  If
things go to the disposeable remailer heads (Aren't those bad for the
environment or something? :), you might wind up blocking part of the
remailer chain.

2) Depending on the strength the hash function, there's a trail that
you submitted traffic into the remailer network for that 48 hours.
Not that sendmail/packet sniffing wouldn't show the same thing w/o IP
layer encryption . . . .

	Now if there was a DC net you could submit traffic/noise into
that would deliver into the remailer net . . . .

---
Fletch                                                     __`'/|
fletch@ain.bls.com  "Lisa, in this house we obey the       \ o.O'    ______
404 713-0414(w)      Laws of Thermodynamics!" H. Simpson   =(___)= -| Ack. |
404 315-7264(h) PGP Print: 8D8736A8FC59B2E6 8E675B341E378E43  U      ------