response 20 of 133:

Apr 14 03:38 UTC 2001

Re #14: The check *had* an address on it, but the address was carefully
typed over with the letter "s" before the check was mailed.  There was no
return address on the envelope.

response 22 of 133:

Apr 14 03:48 UTC 2001

I commend you Mark.  You did the best you can.

response 24 of 133:

Apr 14 04:46 UTC 2001

I'm really skeptical that an "honest internet user" would have taken
the login "usgov," especially when hiding behind a wall of anonymity.
Wish them well and speed them on their way.

response 26 of 133:

Apr 14 06:38 UTC 2001

I should have mentioned that Richard M. Jacobs is an attorney, and that
is his business address. (The business address may be coming up in
the world, with an address change from 7720 to 7730... :)). Also,
just to make it more interesting, there is a Richard Jacobs in St. Louis,
who is a big real-estate wheeler-dealer. Might be the same person. 

response 28 of 133:

Apr 14 12:21 UTC 2001

(Getting in a bit late, because I forgot to post this Friday night)

If Michigan state law doesn't allow photocopying of driver's licenses,
lots of car dealerships and real-estate agents are in gross violation
because they take photocopies if you go out with one of their vehicles
or agents.

The line about the Social Security number is a red herring, at best.
Only *government agencies* have any restriction on their use of the
SSN; they can only use it for purposes consistent with the Privacy Act,
IIRC.  You're free not to give your SSN to any private company you
like... and they're free not to do business with you.

I didn't see anyone asking PE&S for an SSN (does Missouri put them on
the driver's license?  If so, the legislature is full of idiots).  An
Employer Identification Number would be analagous, and who the heck
would bother impersonating a business?

It sounds very much like PE&S wants to run software on Grex that uses
more than e-mail and Lynx.  I suspect that they want to run spamming
software that hits open mail relays.  We should not allow that.

On the other hand, we have a check.  Mark, I suggest that you deposit
it and inform PE&S that they have themselves a tax deduction.  If they
want access to telnet etc. they can meet our ID requirements, and if they
want their money back they can give you their mailing address. ;-)

I suggest that we change the policy on business/corporate users to
eliminate their access to telnet etc. and allow them to sponsor a
conference for the duration of their membership if they so desire.
Keep the voting restriction as-is.  This way we have no need for ID.

response 30 of 133:

Apr 14 16:00 UTC 2001

Yes.

response 32 of 133:

Apr 14 17:52 UTC 2001

I don't quite understand why member access to the net would be required to
send out spam. Certainly it's possible to do a

foreach N in `cat maillist`
    mail -s "GET RICH QUICK" $N < spamfile
end

with just normal access to mail. Isn't it?

response 34 of 133:

Apr 14 23:19 UTC 2001

Re #28: Russ - the check has some text on it indicating that it is for a
Grex membership.  Valerie and Steve Gibbard convinced me that that might
mean that by depositing the check, we would be agreeing to give them a
membership.

Re #31: Rane - We have a policy in place that says what kind of
identification institutional members must provide us, and it doesn't include
using resident agent information from the state government.  So if we were
to accept that as ID in this case, we would be making an exception to our
policy for this member.

response 36 of 133:

Apr 15 03:49 UTC 2001

I'm tired of this, and the $60 is not worth the effort that has been put 
into this.  If a potential customer/donor is looking for trouble, we have 
no business trying to find ways to let them make it.

Inform user usgov that since they are not interested in complying with 
our policies, we are not interesting pursuing this further, and that we 
will return their check uncashed as soon as they provide an address to 
which to send it.  If they choose not to provide an address and express 
the preference, we will simply destroy the check.

response 38 of 133:

Apr 15 05:03 UTC 2001

It's been said or implied several times, both here and in staff mail, that
it's this company that wants something from Grex, rather than Grex wanting
something from them, and that as such it should be them trying to make Grex
happy, rather than Grex trying to make them happy.  That sounds to me as
backwards (at least for an organization not based in California ;) ).  A Grex
membership is not something of value, but rather a thank you for a certain
size of donation.  Judging by the number of requests for money Mark sent me
last time my Grex membership expired, and what I know from having been active
in the running of Grex for several years, membership donations have certainly
seemed in the past to be something of great value to Grex.  If I've been
mistaken about this, and Grex doesn't need membership donations and has only
been asking me for them becasue people are under the impression that a Grex
membership is something that I desperately need, I suppose I could find
something else to spend the money on.

It appears to me that under current Grex policies, Grex is not able to offer
a membership under terms acceptable to this company.  That's unfortunate, but
may not be something that can be gotten around at this time.  It does raise
the question of whether Grex's current membership and ID policies are
reasonable.  It seems that in this case, we do know the identity of this
potential member at least as well as any form of ID would establish, as
Missouri turns out to make it very easy to find out that information about
corporations.  Our problem is that that isn't a method of validating members
approved by our policy, and adding it is unlikely to help in other cases,
since none of my not very random sampling of other state government websites
had that information available.  The required policy change could be something
as simple as adding "or other easily verified identification information" to
the list of acceptable ID.

The larger question, though, seems to me to be why Grex has these ID
requirements at all.  Initially it was to protect the insular Internet from
our public users, but that's a very different issue in 2001 than it was in
1993 or 94.  The corporate membership list requirements are a red herring,
since no other non-profit organization I've ever been a member of has wanted
anything more than my word as to what my address was.  The misunderstanding
there seems to be that Grex has approached corporate fundraising law from the
perspective of computer security people, and that's not the perspective
anybody else approaches it from.

In any case, speculation about what abusive uses this company might use their
account for is completely inappropriate.  If that were the purpose, they could
be up and running doing whatever they wanted to do much more effectively from
any of the free ISPs.  I'm not sure why people find it so hard to believe
that this isn't just some somewhat paranoid person wanting a membership, a
case we've certainly had and dealt with plenty of times before.

response 40 of 133:

Apr 15 05:13 UTC 2001

Steve slipped in.  I agree, this is just some paranoid wanting a membership.
And maybe we should revisit our membership ID requirements.  HOWEVER, I have
to disagree that much has changed since 1991 on "protecting the insular
Internet from our public users."  If anything, it is becoming _more_ important
to identify such users, not less.  Even if the Michigan law requiring ISPs
to identify the people they let out on the Internet fails.

response 42 of 133:

Apr 15 16:23 UTC 2001

(I disagree fairly strongly with most of Steve's comments in resp:38 
and in resp:41.)

(firstly, Steve [as well as Rane] seem to take the position that 
Grex is a business.  that's incorrect:  Cyberspace Communications, 
last I checked, was recognized as a *not-for*-profit.  this is a 
key distinction, because business lives and dies by the whim of the 
consumer.  business *needs* customers, and wants repeat business.  
that's why, for business, "the customer is always right."  I, for 
one, would rather NOT see Grex run like a business all the way to 
the logical extreme, which is to change its services and policies 
to meet the needs of its customers, because that's not IMO where 
I want to see Grex go.  speaking of which, I pribly never should 
have used the word "customer" in any of my previous responses, even 
though the distinction was clear in my mind.)

(secondly, Mark, IMO, was as accomodating as he could be, given 
what he had to work with.  all he requested was a way to verify 
that someone at the company would take responsibility for the use 
of the account.  while Steve's suggestions for potentially 
modifying the ID policy certainly bear a look, they're not relevant 
in this instance.  the point isn't to verify the existence of the 
company, or even to verify the identity of the user.  the point of 
the ID policy is to identify someone who will take responsibility 
for the use of the account by providing a reasonable means for 
contacting said person.  it doesn't matter where the company is 
located, who the officers are, what their status as a legitimate 
business is, or why they want the account.  again, the ID policy 
only requests that *someone* take responsibility for the account.  
there's zero reason, despite Steve's [and Rane's] implications to 
the contrary, that the Resident Agent identified as responsible for 
the business in Missouri would also want to take responsibility for 
a shell account created on a Michigan computer.  I would pose this 
question to Steve [and Rane]:  if I were to create an account and 
send in a check to create a corporate membership for, say, AOL-Time 
Warner, would it be OK if I simply pointed Grex's treasurer to the 
Resident Agent as the person responsible for the account?  I see 
a "yes" answer as creating a Pandora's Box.)

(I agree that changing the ID policy probably belongs in a 
different item.  suffice to say, I disagree with Steve's take on 
why [and whether] Grex needs to ask for I.D. for outgoing access, 
and would be happy to expound on those points separately.)