Anti-Spam update

1. Anti-Spam update Unsolicited Electronic Messages Bill and ISP Spam Code of Practice 2 February 2006 Keith Davidson Executive Director

2. Overview • The Government is legislating against Spam with the Unsolicited Electronic Messages Billexpected mid-late 2007 • The ISP Spam Code of Practice will work in conjunction with the bill • Code outlines obligations on ISPs, Bill now has none specifically

3. August 2006 changes to Bill • “Promotional messages” no longer banned- only unsolicited commercial email banned, as in Australia • Major change from INZ saw removal of requirement that all spam complaints be addressed to the customers ISP. • Enforcement agency (DIA) role expanded- to enable customers direct access to enforcement agency- creates industry monitoring, public awareness, and international advocacy and liaison role

4. Changes to Bill + • No-cost unsubscribe facility requiredon all commercial email- must be unsubscribed within five days • Address harvesting clarified- blocks use of, but not supply and purchase of, software and lists

5. Additional points in Bill • In the Bill spam is not just email- includes instant messaging, SMS - but not phone calls, VoIP calls or fax • Exceptions to what is unsolicitedThere are regular business exceptions, for example warranty and recall information, to what is defined as Spam

6. Spam Code of Practice • Industry benefit- Aim for industry is to minimise Spam, increase customer satisfaction, and improve operational efficiency • Sign-up expected - from ISPANZ, TCF, and Marketing Association • Code status- In draft form • The Code applies only to email

7. Code – Inform customers… • About complying with the Act, changes to it, the existence of the Code, consequences of breaching Acceptable Use Policy, and about laying complaints with DIA and others • About minimising Spam, Spam filters, default filters, false positives • InternetNZ has www.stopspam.net.nz as a resource • An example AUP Spam template is included as Code appendix

8. Code – Assist enforcement • Comply with lawful requirements of law enforcement • Provide spam issues manager contact for DIA • Provide after hours urgent Spam contact to DIA

9. Code – Provide spam filters • Spam filters must be offered directly or indirectly, at reasonable cost • ISPs should minimise the risk of false positives with reporting options, local whitelists, and by avoiding lower quality blacklists

10. Whitelist • Significant interest in a whitelist of NZ IP addresses which send bulk e-mail, but is not spam. • Key issue is how to verify who goes on the whitelist, trust in the whitelist maintainer, and how one removes addresses from there if they do spam • Thinking is that ISPs who sign Spam Code of Practice and Businesses which sign the e-marketing code (which is strictly opt-in, no spamming) would be eligible. • Up to each ISP if they use it, and how they use it. • May start as a manual list, but over time will want ideas on how to automate it.

11. Code – Fight open relays • Acceptable Use Policy must allow for suspension or termination of customers using open relays or open proxies • Notify the customer and work with them when breaches occur, providing information and suggested resolution • Suspend or terminate if serious or continuing breach

12. Code – Misc obligations • ISPs to keep all IP assignment information for at least 28 days • “Best Practices” – examples in Code – acknowledged this may change over time

13. Code – Reporting Spam • Customers to be advised how to report spam • ISPs not to charge for handling spam reports • Maintain an “abuse@” email address • Acknowledge receipt of any Spam report with full information on handling procedure, minimising Spam and laying complaints with DIA

14. Thank You Keith Davidson keith@internetnz.net.nz