Subject: RE: Certificate / CPS issues

From: "Dan Kohn" <[email-masked]>
Date: Fri, 6 Jun 2003 08:12:48 -0700

Regarding a "passport" mechanism, have you taken a look at
www.habeas.com?  Specifically, they offer such a "this is not spam"
warrant mark, and the pricing for individuals is free.  The trick is
that they use copyright and trademark law as the enforcement mechanism. 

(NB: I helped start the company.)

          - dan
--
Dan Kohn <mailto:[email-masked]>
<http://www.dankohn.com/>  <tel:+1-650-327-2600>

-----Original Message-----
From: Graham Klyne [mailto:[email-masked]] 
Sent: Friday, June 06, 2003 03:50
To: Hallam-Baker, Phillip; [email-masked]'

At 12:12 05/06/03 -0700, Hallam-Baker, Phillip wrote:
>A spam sender could attempt to use disposable certificates in the same
way
>that IP addresses and dialup accounts are considered disposable. This
is
>unlikely to work for long, the spam sender can set up lots of shell
>companies at the same address but if the CA keeps authenticating to the
same
>address or phone number the pattern will soon become apparent.

Hmmm... is there an economic play here?

<background>
First, briefly, my view of the spam situation.  I don't think it's 
fundamentally an Internet protocol design issue (though some design
tweaks 
may help).  Essentially, I think people currently have the choice of
(1) putting filters in place and accept the loss of some non-spam mail,
or
(2) accepting a deluge of spam, and not lose any mail.  In practice, I 
think this option doesn't exist, because I find that (lacking spam
filters) 
I do lose a few pieces of non-spam mail because I don't recognize the 
sender or subject.  So I see a way forward to be a "passport" mechanism
to 
reliably bypass automated spam filters, a kind of whitelist++.
</background>

So back to my question: is there an economic play here?

(I was offered the opinion once that a big *disadvantage* of email
compared 
with fax for business transactions was that it has almost zero
incremental 
cost of use.)

I'm thinking of a cert issued for a small sum of money, without any 
authentication other than the purchaser promises something like "I
promise 
not to spam with this certificate".  At the earliest evidence of it
being 
used for spamming, it is revoked.  The price should be small enough to
be 
accessible to any reasonable person, but high enough that the bill for 
daily or hourly renewal would become significant.

Maybe crazy, just thinking aloud...

#g

-------------------
Graham Klyne
<[email-masked]>
PGP: 0FAA 69FF C083 000B A2E9  A131 01B9 1C7A DBCA CB5E

_______________________________________________
This message was passed through [email-masked],
which is a sublist of [email-masked]. Not all messages are passed.
Decisions on what to pass are made solely by Raffaele D'Albenzio.

---

From: Zefram <[email-masked]>
Date: Fri, 6 Jun 2003 17:26:13 +0100

>that they use copyright and trademark law as the enforcement mechanism. 

I'm surprised that Habeas has caught on even to the extent it has, as I
see a fatal flaw in this use of copyright to get legal control.  It is
reminiscent of a legal case I recall where a games console refused to
execute any game unless a certain copyright notice (ascribing copyright to
the console manufacturer) appeared in a known location in the game ROM.
Third-party game manufacturers put the notice in their games, and were
hauled into court.  The court held that the copyright notice in question
was a functional part of the interface between the game and the console,
and that this overrode its normal semantic of signifying copyright
ownership.  The notice that the console looked for therefore didn't
mean anything legally, and the notice elsewhere in the game (the real
notice, ascribing ownership to the game manufacturer) was the legally
significant one.

What Habeas does is akin to publishing a protocol or file format in
a copyrighted document, and then suing implementors of the protocol
for copying sections of protocol data from the document.  It's mixing
expression with content (copyright protects one and not the other).
We wouldn't stand for it if Microsoft did that, and I don't think the
courts would either.  In fact, Microsoft has tried things very similar to
this, and we didn't stand for it.  I'm astonished that members of this
overwhelmingly pro-freedom and pro-reverse-engineering subculture have
themselves tried to deploy exactly the same odious trick.  Although I
approve of Habeas' aims, for the sake of our freedoms I hope that their
technique is held to be ineffective.

FWIW, my spam filter picks up Habeas headers as a strong ham indicator,
appearing in 0.4% of ham in my corpus and not at all in spam.  I'm waiting
to see which of these numbers is going to increase more significantly.

-zefram
-- 
Andrew Main (Zefram) <[email-masked]>

---

From: Dave Aronson <[email-masked]>
Date: Fri, 6 Jun 2003 13:19:00 -0400

Zefram <[email-masked]> wrote:

 > I'm surprised that Habeas has caught on even to the extent it has, as
 > I see a fatal flaw in this use of copyright to get legal control.  It
 > is reminiscent of a legal case I recall where a games console refused
 > to execute any game unless a certain copyright notice (ascribing
 > copyright to the console manufacturer) appeared in a known location
 > in the game ROM. Third-party game manufacturers put the notice in
 > their games, and were hauled into court.  The court held that the
 > copyright notice in question was a functional part of the interface
 > between the game and the console, and that this overrode its normal
 > semantic of signifying copyright ownership.

Where this analogy breaks down, is that Habeas is not interfering with 
the functionality of non-Habeas email.  First, what to do with marked or 
unmarked email is entirely up to the recipient (or his ISP, or whoever 
else is doing spam filtering).  Second, it is not saying "everything 
else is spam" (and therefore delaying it getting through, except by 
comparison), just "this is not spam".

A better analogy would be, say, any sort of optional certification.  
You're perfectly welcome to buy electrical devices not approved by 
Underwriters Laboratories, but if you (or your electrician, or 
purchasing department) DO insist on UL-approved devices, you'll have a 
lower risk of shorts, shock, fire, etc.  I don't know for sure, but I 
ass-u-me UL would take a Very Dim View of manufacturers putting a 
UL-Approved label on devices that really weren't, and may have legal 
recourse through lawsuits asking for damages (especially punitive) that 
outweigh the faker's likely profit.

 > FWIW, my spam filter picks up Habeas headers as a strong ham
 > indicator, appearing in 0.4% of ham in my corpus

Their web site explains the name, but I just gotta wonder if they were 
punning on that as well....

-- 
David J. Aronson, Unemployed Software Engineer near Washington DC
See http://destined.to/program/ for online resume, and other info

---

From: "Anthony Atkielski" <[email-masked]>
Date: Sat, 7 Jun 2003 00:45:37 +0200

Dan writes:

> Regarding a "passport" mechanism, have you
> taken a look at www.habeas.com?

Habeas represents one of the most egregious perversions of trademark and
copyright law that I've ever encountered.  Their copyright and trademark
claims are invalid prima facie, and they hope to get their way by
intimidation and distortion of the law to their ends.  I cannot condone
this, as it dramatically erodes the foundations of intellectual property
law.

Copyright law was intended to protect real, creative, original, non-trivial
works of the mind for the benefit of their creators--and not as a
techno-gadget to prevent spam.  Trademark law was intended to protect the
commercial value and goodwill of creative, real, original, non-trivial
identifying marks for specific products and services--and not as a
techno-gadget to prevent spam.

I've love to see Habeas lose a couple of lawsuits.  They are setting a very
unhealthy precedent.

> Specifically, they offer such a "this is not spam"
> warrant mark, and the pricing for individuals is
> free.

If I see that warrant mark on my incoming mail, I'll bounce it.

> The trick is that they use copyright and trademark law
> as the enforcement mechanism.

That's just it:  it's a trick, and a glaring abuse of intellectual property
law.

Incidentally, the name of my domain is a service mark, and so any e-mail
coming to me from Habeas is an infringement on my service mark, since it
will contain the name of my domain.  You can't argue with this, since it is
no less stupid than the premise conjured up by Habeas.

---

From: [email-masked]
Date: Fri, 06 Jun 2003 22:42:29 -0400

> no less stupid than the premise conjured up by Habeas.

I hereby request the list management to remove Anthony's email address from
the subscriber list, so as to not expose the IETF to liability.  Hmm.. maybe
that's not the right attitude, Anthony. ;)

It's pretty clear that there's a fair-use exemption if you actually want to
USE that domain name for anything.

> works of the mind for the benefit of their creators--and not as a

Given that the song "Happy Birthday" was/is copyrighted ( don't know when it
expires, especially after the whole Sonny Bono thing), I'd say that any haiku
that the Habeas crew comes up with qualifies.  And although you may find the
creative use of the law distasteful, to state that their claims are 'invalid
prima facie', you need to be able to show that they are in fact invalid.
Let's see... are the haiku original?  Do they meet the Bern Convention
requirements for copyrightability? Note that "total doggerel" is NOT a factor,
as Sturgeon's Law would put 90% of everything in the public domain then.

Note that major companies have had *no* trouble enforcing copyright/trademark
on slogans as short as "it's the real thing" or "you deserve a break today".
It may not be what the founding fathers had in mind in 1790, and it may not
match what you *wish* it was, but it's how the *current* laws are held to read
as of today.  Barring a major judicial reversal (such as was attempted in
Eldred), we're all stuck with the current laws as currently interpreted.

IANAL, but it looks to me like the Habeas crew is on fairly strong legal
footing.  Also, they're not trying to stop spam directly.  They're providing
two services:  (a) a header tag that you can use to filter your inbound
mail for *NON*-spam, and (b) the chance for any spammers to spend enough
money on legal fees to render it unprofitable.

---

From: Richard Welty <[email-masked]>
Date: Fri, 6 Jun 2003 23:35:46 -0400 (EDT)

On Fri, 06 Jun 2003 22:42:29 -0400 [email-masked] wrote:
> footing. 

i might add that the CEO of Habeas, Anne Mitchell, is an actual lawyer. i
am not familiar with Anthony's credentials in the field of law. casually
throwing legal terms about does not impress.

this email happens to have Habeas headers, so i presume that he will not
see it if he is throwing such mail out the way he says he will.

cheers,
  richard
--
Richard Welty                                         [email-masked]
Averill Park Networking                                         518-573-7592
              Unix, Linux, IP Network Engineering, Security

---

From: "Michael Froomkin - U.Miami School of Law" <[email-masked]>
Date: Sat, 7 Jun 2003 00:39:37 -0400 (EDT)

You cannot get trademark protection for anything "functional".  To the
extent that the Habeus magic words are used functionally, I do not think
they are eligible for trademark protection.

Ditto copyright: "Works that may not be protectable by copyright include:
.... short phrases and slogans, familiar symbols or designs, and other
works lacking sufficient creativity or independent effort; designs of
useful articles or products where the designs are not conceptually
separable from the functional aspects of the article or product; works
consisting only of information that is in the public domain; and blank
forms and other works which are designed for recording information and
which do not in themselves convey information." 

(source: American Law Institute - American Bar Association Continuing
Legal Education April 10-11, 2003 Trademarks, Copyrights, and Unfair
Competition for the General Practitioner and the Corporate Counsel COURSE
OVERVIEW Ronald L. Panitch SH085 ALI-ABA 361)

Functional things are eligible to be patented.

Thus, I have grave doubts as to the strength of this footing under IP law.
There might be alternate legal theories that would work a little
better....

I could go into considerably greater detail as to why, and also as to what
the counter-argument might look like, but I'd have to charge you...

On Fri, 6 Jun 2003 [email-masked] wrote:

[...]

-- 
		Please visit http://www.icannwatch.org
A. Michael Froomkin   |    Professor of Law    |   [email-masked]
U. Miami School of Law, P.O. Box 248087, Coral Gables, FL 33124 USA
+1 (305) 284-4285  |  +1 (305) 284-6506 (fax)  |  http://www.law.tm
                        -->It's hot here.<--

---

From: [email-masked]
Date: Sat, 07 Jun 2003 00:55:25 -0400

> they are eligible for trademark protection.

I stand corrected.  :)

> There might be alternate legal theories that would work a little

Of course, it's quite possible that Habeas's legal theory *is* a complete
load of dingo's kidneys - the biggest question is which spammer (if any)
is willing to risk the lawsuit to find out.  The same thing is going on
currently over on the patent law side of the fence - companies will just
fold and pay the licensing fees rather than fight an obviously bogus patent.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Sat, 7 Jun 2003 12:47:52 +0200

> I hereby request the list management to remove
> Anthony's email address from the subscriber list,
> so as to not expose the IETF to liability.

Too late ... my incredibly valuable service mark has already been
distributed to the list many times in the headers of my messages.  Clearly
this dilutes the well-nigh awe-inspiring value of the mark and impacts the
staggering commercial value of my business.

> Hmm.. maybe that's not the right attitude, Anthony.

I agree.  But that's exactly what Habeas is trying to do.

> It's pretty clear that there's a fair-use exemption
> if you actually want to USE that domain name for anything.

Fair use doesn't apply to trademarks and service marks.

> Given that the song "Happy Birthday" was/is
> copyrighted ( don't know when it expires, especially
> after the whole Sonny Bono thing), I'd say that any haiku
> that the Habeas crew comes up with qualifies.

Not necessarily.  The Habeas haiku comes closer to a business form or
boilerplate text in a contract, which is not necessarily protected by
copyright.  Additionally, it's not clear that the appearance of the haiku in
(normally invisible) message headers is an infringement, even if it is
covered by copyright.

Overally, there are just too many questions in this case, and the intent to
pervert copyright law is patent.  It's difficult to quarrel with the
copyrightable nature of "Happy Birthday" and the infringing nature of
unauthorized performances; but it is easy to quarrel with Habeas' bizarre
distortion of IP law, and hopefully it would not hold up in court, as it
sets a bad precedent and would significantly chill freedom of speech if it
were upheld.

> And although you may find the creative use of the law
> distasteful, to state that their claims are 'invalid

The haiku in question is trivial, like the title of a book.  Additionally,
it is not published in the normal course of e-mail routing.  Users do not
see it, and simple transmission of the work is not necessarily infringement
(after all, the transmission of Web pages to your PC is not infringement,
either, and even caching of pages seems to be okay).  Just about every
principle of and behind copyright protection is being ignored by Habeas.

Odd that Habeas considers this okay, but if spammers went to the same
lengths to distort the law to their own ends, people would form lynch mobs.
I guess the law is great when it protects you, but bad when it protects
someone else, eh?

> Let's see... are the haiku original?  Do they
> meet the Bern Convention requirements for
> copyrightability?

Each message posted to this list is more subject to copyright than Habeas'
haiku.  In fact, the error messages I sent to domains that I reject in
sendmail are more validly protected by copyright than this haiku, and
domains that receive the messages and communicate them to end users are
infringing my copyright.  If that sounds absurd, keep in mind that it is no
more absurd than the ideas promoted by Habeas.

> Note that major companies have had *no* trouble
> enforcing copyright/trademark on slogans as short
> as "it's the real thing" or "you deserve a break today".

Actually, they do.  First of all, short phrases like this are not protected
by copyright; copyrighted works must be non-trivial.  And as trademarks,
they are protected only in narrow contexts (those that might lead to
confusion in the minds of consumers, or those that might dilute the value of
the marks for their proprietors).

> It may not be what the founding fathers had in
> mind in 1790, and it may not match what you *wish*
> it was, but it's how the *current* laws are held to read
> as of today.

No, they aren't.  See above.  Think about Xerox, Coke, and Aspirin, for
example.

> Barring a major judicial reversal (such as was
> attempted in Eldred), we're all stuck with the
> current laws as currently interpreted.

Habeas has not been tested, and there are no highly relevant guiding
precedents (I think).

> IANAL, but it looks to me like the Habeas crew is
> on fairly strong legal footing.

On the contrary, they appear to be treading on extremely thin ice.  But only
a legal test will say for sure.

> Also, they're not trying to stop spam directly.  They're
> providing two services:  (a) a header tag that you can use
> to filter your inbound mail for *NON*-spam, and (b) the
> chance for any spammers to spend enough money on legal
> fees to render it unprofitable.

And what if I consider unnecessary headers in my incoming e-mail as spam?
Then what?  Can I sue or prosecute Habeas?  If not, why not?  After all,
that application of law would be no less farfetched than Habeas' own
attempted application of IP law.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Sat, 7 Jun 2003 12:50:08 +0200

Richard writes:

> i might add that the CEO of Habeas, Anne Mitchell,
> is an actual lawyer.

So?  Is she the _only_ lawyer??

There are probably any number of lawyers who would enjoy eating Habeas for
breakfast.

> i am not familiar with Anthony's credentials in the
> field of law. casually throwing legal terms about
> does not impress.

Neither does distorting legal principles in an attempt to control spam.

> this email happens to have Habeas headers, so i presume
> that he will not see it if he is throwing such mail
> out the way he says he will.

I haven't started filtering on it, since Habeas really doesn't appear on the
radar to speak of.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Sat, 7 Jun 2003 12:56:38 +0200

Valdis writes:

> ... the biggest question is which spammer (if any)
> is willing to risk the lawsuit to find out.

There might be quite a few.  It might be easy to have Habeas' claims
invalidated, and it would be worthwhile to spammers to get that out of the
way.  Additionally, some organizations might back them, such as the DMA or
the ACLU.

> The same thing is going on currently over on the
> patent law side of the fence - companies will just

They aren't choosing between fighting and going out of business, though.
Would Habeas license its haiku to spammers?