First published: 01st September 2005
By: Allan George Dyer
The Hong Kong government is developing anti-spam laws, but what effects will they have on the problem of spam in Hong Kong and the way enterprises do business?
Legislation alone will not solve the problem. We must combine laws, technology and user education, but the first step is to define what society considers acceptable behavior. Enacted legislation lasts for years, so it is important to get it right.
The administration presented the "Draft Framework of Proposed Anti-spam Legislation" to the July meeting of the Legislative Council Panel on Information Technology and Broadcasting. The recommendations were developed from six guiding principles. Legco members raised four interesting points about the proposals: the effect on freedom of speech, the types of messages to be controlled, the effect on SMEs and extra-territorial jurisdiction.
1. Freedom of speech
Freedom of speech is important in any democratic society, but is always balanced against the rights of the listeners. In the physical world, we can walk away from a speaker we do not choose to hear, and they do not have a right to follow us into our homes to force us to hear their message.
Similarly, businesses may be selective in what communications they allow on their premises: a person preaching in a cinema would be ejected because it interferes with the cinema's legitimate business. We need similar rights in the electronic world.
We can divide our communications into broadcasts (posters, shop windows, radio and TV) and addressed messages. Broadcasts are available to anyone who "looks" in the right place. Addressed messages are sent to uniquely identified recipients in the system, and are therefore much more intrusive: every message obliges the recipient to take action (even if that action is simply to delete).
Spam has become a problem because digital communications have made addressed messages extremely cheap. To redress the balance, email addresses should be considered a form of private property. The person (or organization) has paid for the address, and for the necessary equipment, therefore they should have the right to decide what use is made of it. Willful disregard of this right should be regarded as trespass.
The proposed legislation does not restrict broadcast forms of electronic communications like websites or newsgroups. It also does not restrict the content of consensual private communications. It simply gives the recipient some control. Therefore, anti-spam legislation will not affect freedom of speech so long as it respects the first guiding principle of the draft: recipients have the right to decide.
2. Types of messages to be controlled
The draft proposed that only commercial messages should be controlled, but Legco members pointed out that there are a wide variety of non-commercial activities. I think that good anti-spam legislation should be applicable to all types of messages, not just commercial messages. Charities I know utilize broadcast media and have mailing lists of subscribers-they do not "spam" their appeals. However, fake spam-appeals for donations follow disasters. By having clear and simple rules that apply to everyone, these fake messages will be more obviously bogus, and, hopefully, fewer compassionate-but-unwary people will be tricked.
3. Effect on SMEs
SME groups usually express concern that anti-spam legislation will block an important marketing channel-in other words, it will stop them from spamming. Unfortunately, this attitude can be traced directly back to campaigns that encouraged SMEs to get onto the Internet, to communicate better and make more sales. Perhaps there was too much emphasis on results and too little on responsibility-enterprises should consider that spammers show contempt for the value of their potential customer's time.
SMEs, or any enterprise, should be concerned about how to retain the benefit of cheap communications without the costs of the ever-increasing flood of unwanted messages. A business must publicize its addresses to communicate, but the draft proposes an opt-out solution: senders may continue to send messages until asked to stop. Unsubscribing from the mailing lists of approximately 300,000 Hong Kong companies would take an inordinate amount of time. How can an opt-out scheme be effective at allowing businesses to do business?
4. Jurisdiction
Most of the spam we receive originates outside of Hong Kong, so how can a local law be effective? This part of the draft properly specifies that offenses occur if the initiator or their agent is in Hong Kong regardless of the recipient's location. This prevents Hong Kong becoming a safe haven for spammers. Of course, it has no effect on the large amount of spam that has no Hong Kong connection, for this we have to depend on similar laws in other jurisdictions.
To meet the needs of our enterprises, the proposals need improvement to protect Hong Kong's international reputation and to prevent opt-out overload.
Allan Dyer is chief consultant of Yui Kee Computing and is one of the founding members of the Association of Antivirus Asia Researchers (AVAR). He often speaks on computer viruses and information security at various conferences and courses.