The National Anti-Spam Registry, or a Pretender?

The National Anti-Spam Registry, or a Pretender?
( Page 1 of 2 )

Don't be fooled by all the flag waving and mentions of a "new federal law." Be warned: this so-called National Anti Spam Registry is not official, and worse, it's a wolf in sheep's clothing.One interesting e-mail that recently found its way into my inbox was from an organization calling itself the "National Anti Spam Registry." The site is filled with American flags and the Statue of Liberty and references to the recently-signed and about to go into effect federal CAN-SPAM act.

As I wrote in my recent analysis of that law, CAN-SPAM calls in Section 9 for a report by the FTC to relevant congressional committees to set forth a plan for "a nationwide marketing Do-Not-E-Mail registry." This report would include an analysis of potential problems with such a list (and boy, would there be a lot of problems); and also specifically deal with childrens e-mail accounts.

The legislation also specifically mentions that the registry is not to be implemented less than 9 months after the enactment of the act. Its scheduled, I believe, for January 1, 2004, meaning that October 1, 2004 is the earliest that we could see its "nationwide marketing Do-Not-E-Mail registry."

So now the NASR appears. If its not the registry envisioned by the new law, what is it?

Despite the flag waving, its authenticity is difficult to determine. The site is filled with misspellings and grammatical errors. Some of what the site claims to do is plainly phony, some of it tempting, but suspicious, and some of it is impenetrable gobbledygook.

Resource Library:

But who is behind the National Anti Spam Registry? The only contact information on the page, apart from a few e-mail addresses, is a postal box in Hammond, La. Much more interesting is the Whois information for nationalantispamregistry.com. The addresses for all the contacts is in Tonawanda, N.Y., which is on the Niagara river just north of Buffalo.

On closer inspection, the zip code looks wrong (in fact, its not a valid zip code), and there doesnt appear to be a street with that specific name from the record in Tonawanda.

Now, its not illegal to put inaccurate information in Whois records, and its arguably a wise thing to do, but its suspicious from an organization trying to engender trust in the public. The phone contact is a Hammond number.

The FAQ and other descriptions describe a service that sounds vaguely like a centralized opt-out facility. One major criticism of the law is that it doesnt mandate opt-in relationships, but rather mandates that marketers honor opt-out requests. So the idea of the NASR is that you register with them and they handle all the opt-outs.

At the same time, its hardly clear that such a thing is possible; unless you grant the National Anti Spam Registry control over your mail account, it would be difficult indeed to do what they appear to be claiming to do.

Besides, this plan assumes that the opt-out will be honored. The NASR "How to avoid spam" page itself says "If you are receiving junk email NEVER respond to them and NEVER request to be removed, you are just confirming to the spammer that your email is active." So how will this company opt-out for you without having the same problem?

The site also says "you can register your email address free to be submitted to the F.T.C and be included in the National Do Not Email registry." Guess what: when there is such a registry you will be able to register your address yourself, almost certainly for free, and in all likelihood third parties wont be able to register you.

This pitch, in particular, reminded me of the first spam on Usenet years ago. It came from a lawyer offering to help people register for the green card lottery, which can be done for free, directly by individuals. As I recall, there was quite a stink that someone had posted off-topic messages on a newsgroup! It seems so quaint now, but eventually Usenet was ruined by such people, just as they are now trying to ruin Internet e-mail. The FTC recently shut down such an operation that posed as a government agency.

Next Page: The Interview And The Punch Line

>>> More Network Security & Hardware Articles          >>> More By Larry Seltzer