State of Maine AG OKs Spam List

The idea of "opt in" is central to the legitimate, non-spam use of bulk e-mail. Without "opt in" policies, any and all e-mail addresses will be spammed relentlessly until they "opt out", and likely even after that. "Opt in" means that the recipient--the e-mail address owner--knowingly and intentionally subscribes to a specific list before the bulk list-mail commences. Permission to send bulk e-mail to that address does not extend beyond the specific list to which the recipient subscribed, nor does subscribing or using their address solely for a specific contact grant any other use of their address without their informed consent. Spamhaus has always advocated only "opt in" policies.

So, while Spamhaus has never been favorably impressed by the USA's policies regarding spam, we are still dismayed and find it unconscionable that the Maine Attorney General has required that state's Fisheries & Wildlife Department to turn over the e-mail addresses of its customers to a private third party. Customers who simply wanted a fishing licence, who never intended to subscribe to any bulk e-mail, let alone have their personal information distributed to an advocacy organization bold enough to demand it from the state, are the victims. Such abuse would contravene UK and EU privacy laws.

Time and time again Spamhaus has witnessed the illicit distribution of e-mail addresses as part and parcel of the spam epidemic. Once control over an e-mail address is wrested from its rightful owner, spam is inevitable. "Nadine" is a classic account illustrating such problems. There are also many incidents of lists leaking or otherwise changing hands illicitly, both recently and historically. The more widely a list is shared, the more likely it is to leak. By distributing its customer list to a third party, Maine is contributing to spam and the abuse of its customer's mailboxes.

Even if Maine's release of customer e-mail addresses didn't lead directly to spam (which it will), and even if Sportsman's Alliance of Maine (which stretched Maine's Freedom of Access Act to obtain the list) doesn't spam the list (which it will, by definition, as soon it sends any e-mail to it), Maine's AG's decision to distribute that list exposes all of Maine's e-mail customers, at any state department, to abuses from subsequent possessors of such lists, however such spammers may come into the list's possession. Maine, like the rest of the USA, needs to rethink its policies on spam and personal privacy.