Anti-Spam update Unsolicited Electronic Messages Bill and ISP Spam Code of Practice 2 February 2006 Keith Davidson Executive Director

2 Overview The Government is legislating against Spam with the Unsolicited Electronic Messages Bill expected mid-late 2007 The ISP Spam Code of Practice will work in conjunction with the bill Code outlines obligations on ISPs, Bill now has none specifically

3 August 2006 changes to Bill “Promotional messages” no longer banned - only unsolicited commercial banned, as in Australia Major change from INZ saw removal of requirement that all spam complaints be addressed to the customers ISP. Enforcement agency (DIA) role expanded - to enable customers direct access to enforcement agency - creates industry monitoring, public awareness, and international advocacy and liaison role

4 Changes to Bill + No-cost unsubscribe facility required on all commercial - must be unsubscribed within five days Address harvesting clarified - blocks use of, but not supply and purchase of, software and lists

5 Additional points in Bill In the Bill spam is not just - includes instant messaging, SMS - but not phone calls, VoIP calls or fax Exceptions to what is unsolicited There are regular business exceptions, for example warranty and recall information, to what is defined as Spam

6 Spam Code of Practice Industry benefit - Aim for industry is to minimise Spam, increase customer satisfaction, and improve operational efficiency Sign-up expected - from ISPANZ, TCF, and Marketing Association Code status - In draft form The Code applies only to

7 Code – Inform customers… About complying with the Act, changes to it, the existence of the Code, consequences of breaching Acceptable Use Policy, and about laying complaints with DIA and others About minimising Spam, Spam filters, default filters, false positives InternetNZ has as a resourcewww.stopspam.net.nz An example AUP Spam template is included as Code appendix

8 Code – Assist enforcement Comply with lawful requirements of law enforcement Provide spam issues manager contact for DIA Provide after hours urgent Spam contact to DIA

9 Code – Provide spam filters Spam filters must be offered directly or indirectly, at reasonable cost ISPs should minimise the risk of false positives with reporting options, local whitelists, and by avoiding lower quality blacklists

10 Whitelist Significant interest in a whitelist of NZ IP addresses which send bulk , but is not spam. Key issue is how to verify who goes on the whitelist, trust in the whitelist maintainer, and how one removes addresses from there if they do spam Thinking is that ISPs who sign Spam Code of Practice and Businesses which sign the e-marketing code (which is strictly opt-in, no spamming) would be eligible. Up to each ISP if they use it, and how they use it. May start as a manual list, but over time will want ideas on how to automate it.

11 Code – Fight open relays Acceptable Use Policy must allow for suspension or termination of customers using open relays or open proxies Notify the customer and work with them when breaches occur, providing information and suggested resolution Suspend or terminate if serious or continuing breach

12 Code – Misc obligations ISPs to keep all IP assignment information for at least 28 days “Best Practices” – examples in Code – acknowledged this may change over time

13 Code – Reporting Spam Customers to be advised how to report spam ISPs not to charge for handling spam reports Maintain an address Acknowledge receipt of any Spam report with full information on handling procedure, minimising Spam and laying complaints with DIA

14 Thank You Keith Davidson