Lost in Reception

Opting out of email filtering may now be an even less viable option than it was a month ago.

John Levine comments on the recent Haselton (Peacefire)/Quicken decision and the requirement to take reasonable protective measures that the court adopted from Gordon/Virtumundo:

In the decision, reiterated in the appeal, the court held that to have standing under CAN SPAM you have to show actual damages from the spam, and have to show that you tried to filter the spam out. Actual damages make some sense, but requiring filtering is just wrong, since it flips the point of CAN SPAM on its head–the only reason we have to filter is that people send us the spam that CAN SPAM presumably is intended to deter.

From the Gordon/Virtumundo ruling:

Courts must of course be careful to distinguish the ordinary costs and burdens associated with operating an Internet access service from actual harm. We expect a legitimate service provider to secure adequate bandwidth and storage capacity and take reasonable precautions, such as implementing spam filters, as part of its normal operations. Courts should take an especially hard look at the cited harm if it suspects at the outset that a plaintiff is not operating a bona fide Internet access service, as is the case here.

I’d suggest that John has this wrong, that across multiple areas of law it is taken for granted that before a citizen seeks to avail him/herself of a court’s assistance in resolving a problem that he/she has taken all reasonable (in some cases “all possible”) steps to prevent, avoid and/or resolve the problem him/herself and that this perhaps applies no less to the delivery of unsolicited email. Examples include

• the obligation of a trademark holder to vigorously defend a trademark independently of a particular court action,
• the requirement for those seeking equitable relief to have clean hands
• the requirement for those who are wronged to act swiftly.

What this implies for the running of filters is interesting (Levine again):

Haselton also explained why he doesn’t use filters: all the ones he’s tried have blocked an unacceptable amount of wanted mail, particularly since unlike most people in the US he gets a lot of mail from India and China, which spam filters tend to block. I suspect that his experience says as much about his limited ability to manage his mail system as it does about the inherent failings of filters, but he has a legitimate business reason not to filter.

My experience with BoxSentry suggests that spam filters really are typically worse at dealing with email emanating from Asia, for a number of reasons (dictionaries of bad words are generally better developed for English-speaking recipients, DNSBL maintainers tend to be in North America or Europe and so tend to correct erroneous listings in these areas more rapidly than those for senders in Asia, traffic-analysis systems tend to have more collectors deployed in Europe and North America than in Asia, etc.), however an individual who has taken upon himself the operation of an email security system might reasonably be expected to take on the burden of compensating for all of that too, which may have been John’s point.

More broadly this suggests that opting out of the use of filtering to begin with, which is what I did until joining BoxSentry a few years ago, has as an additional consequence the opting out of equitable relief as well. Those who would choose not to use a filter are vanishingly small in number, but the situation for those who choose to do so has now become just a little more unpleasant.