I believe you're only 1/4 right. Spamming is an economic affront, and punishment should be based on economic sanctions. Thus, I don't believe a spammer should get 9 years in the pokey to develop a close relationship with a bruiser named Bruno.

But I DO believe that any fine--no matter how large--is appropriate. You grossly underestimate the damage that unremitting, voluminous spamming does in this and other countries. Literally billions of dollars in effort, software and stolen bandwidth costs are lost in the effort to unwillingly process, filter out and winnow through the windrows of spam overwhelming normal E-mail.

It's disingenuous to try to compare the penalties to the disaster in Bhopal. It's not that the spammers deserve smaller penalties--it's that the Indian government and Union Carbide (in that order!) should have paid SO much *more*.

The incentive to spam is economic. To stop spam, there has to be a two-fold attack on it at its roots--it must become uneconomical to spam. The first attack is on the spammers themselves. If the potential revenue from spamming is huge, the potential penalties must be even greater. The message must be unequivocal--if you spam, you may end up in debt forever.

But just offering the risk of loss to the spammers isn't enough; we've seen that for centuries in the effort to stop smuggling. The "spam consumers" must be penalized. Follow the money--anyone USING spammers must be investigated and fined, and fined in amounts that hurt enough to not make it worth engaging a spammer under any circumstances.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/287/29699#29699