Guidelines for Use of Email for Official Purposes

The following are guidelines for using email to communicate with large numbers of people (over 50) for official University purposes. If you have questions, or would like advice on appropriate ways to use email, please contact your OIT campus director.

Email Directed at Destinations Outside Rutgers

Faculty, staff, and departments may want to use electronic means to publicize events and services at Rutgers. If not done carefully, this can cause significant difficulties for Rutgers. Unsolicited bulk email (usually called “spam”) is currently a significant problem on the Internet. Because not all areas have laws covering these matters, controls depend upon the actions of system administrators. In one incident, bulk email connected with Rutgers caused a system administrator at an uninvolved site to have to deal with 100 complaints from users. This person was understandably upset at Rutgers.

There has been so much trouble with spam that system administrators are becoming increasingly intolerant. It is quite possible that a well-meaning but incorrectly implemented message could cause some system administrators to disable network contact between their site and Rutgers.

There are now specific laws covering unsolicited commercial email in several states, and additional laws are in progress. The most recent law is the CAN-SPAM Act of 2003. For a good summary of the laws regarding Spam, see http://www.spamlaws.com, a site maintained by David Sorkin, a Professor at the John Marshall Law School.

The Rutgers Acceptable Use Policy requires all uses of Rutgers facilities to be in compliance with the law. Thus, independent of any other restrictions in this document, consider carefully whether your email could be considered commercial. If so, you are responsible for investigating the legal situation sufficiently to understand the implications of your proposed action. It appears that advertisements of Rutgers programs are regarded as commercial under at least some State laws. Detailed regulations have not yet been posted for the CAN-SPAM Act, but it is likely that advertisements of programs will be covered.

Outside counsel has advised one unit within Rutgers that it is not clear whether our email to alumni would be classified as commercial or not. However they recommend that until detailed regulations are issued, we treat such email as if it were. Most of the requirement of the CAN-SPAM act are reasonable enough that there’s no reason not to comply.

The situation is complicated because there are companies that specialize in sending bulk email. The quality of their services vary greatly, from groups that deal primarily in pornography to more sophisticated organizations. If you are thinking of using an organization like this, be very careful to discuss the way they build up their lists, and the way they transmit their mail. The following problems have occurred with some such organizations in the past:

The following guidelines are intended to avoid the kinds of problems discussed here. They are intended to cover all email sent to non-Rutgers addresses, except correspondence with individuals, or with small numbers of people (less than 50) with whom the sender has a pre-existing relationship that would lead them to expect the sort of email you intend to send. If you are considering use of a commercial service to send mail for you, please talk over these guidelines with them, and if possible include them in your contract. Be aware that some of the services would find it difficult to comply with these guidelines.

System administrators are expected to deal with violations of these guidelines coming from their systems. They should be aware that there are now very strong feelings throughout the Internet about unwanted email. Some system managers will cut off all email from systems whose administrators do not take action against improper large-scale email.

Specific Requirements

These requirements have been modified to be consistent with the CAN-SPAM Act of 2003. Note however that this Act is not fully operational. It will be implemented by regulations to be issued by FTC. Until those are operational, we are asking the Rutgers community to make a good faith effort to comply with the terms. Make sure you keep track of progress of the implementation. If the final rules treat university announcements as commercial, you will be required to check with a national do-not-spam registry, removing any addresses registered there. There will almost certainly be a fee. Items in the following list from the CAN-SPAM act are flagged with [CAN-SPAM]

1) The first time you do this, consult with the director or senior technical staff in the OIT division associated with your campus. They can help you prevent mistakes that can be very embarrassing.

2) Email should be targeted to people who would reasonably expect to be receiving announcements of the sort you intend. The rest of this section will attempt to provide guidance in meeting this requirement.

[CAN-SPAM] You must not use any lists that were “obtained by an automated means from an Internet website or proprietary online service operated by another person, … stating that the operator of such website or online service will not give, sell or otherwise transfer addresses…”, nor addresses generated by trying random names, letters, etc.

Email addresses should have been given for the purpose you are using them for, or the use must be approved by a person who understands our relationship with these people, and can verify that this is a reasonably expected use. When you get addresses that were not given directly to you, you must verify with the source of the addresses that the use you intend to make of them is something that would reasonably be expected by the people involved.

CAN-SPAM exempts communications that are “transactional”, i.e. messages associated with current customers intended to carry out a transaction or deal with warranty issues. See the Act for details.

Some units at Rutgers purchase mailing lists from professional organizations or other sources. If you do this, you should find out the way addresses are collected. The main question is “would people on this list reasonably expect to be getting mail of this kind?” We would hope that professional organizations would make it clear that addresses they collect will be sold to others for use in sending relevant announcements, and that they would provide members the option of not having their address sold (or not submitting an address). In that case, use of the list would be OK, as long as what you are announcing is within the area that members of that organization would reasonably consider relevant.

Some units at Rutgers send email to those who have previously participated in their programs. When you collect email addresses from participants, make sure that you tell them you are going to be using the addresses in this way, and provide them an option to have their address not used (or not supply an address).

3) In some cases there may be a unit within Rutgers that is responsible for the population with which you intend to communicate. E.g. there are specific units within Rutgers that are responsible for our relationship with alumni. The Alumni Foundation maintains a service for communicating with alumni. Thus all communications with alumni must be coordinated by the Foundation. They are responsible for making sure that the total volume of communications with the group is reasonable, and that we respect requests by individuals not to use their email address for certain purposes.

4) Email must be sent with a valid From: address, which is a person prepared to deal with complaints and requests to be removed from your list. Make certain that this person is aware that recipients of unsolicited email often react with angry or threatening responses

5) [CAN-SPAM] Email must contain “clear and conspicous identification that the message is an advertisement or solicitation.” Presumably the FTC will give more details here. For the moment it would seem sufficient for the subject line to say something like “invitation to … sponsored by …”. Several States require ADV: at the start of the subject line. My reading of the Act is that the FTC will not be permitted to require any specific identifier such as ADV.

6) [CAN-SPAM] “A valid physical postal address of the sender” is required.

7) Each unit that sends unsolicited email must maintain a list of people who have asked not to receive further mail. [CAN-SPAM] CAN-SPAM requires that requests not to receive further email be honored. It appears that CAN-SPAM permits separate “lines of business” to be treated as separate senders. In the Rutgers context this seems to allow individual departments or centers to maintain their own lists of people not to get email. Thus it currently does not appear to require a single registry for all of Rutgers. However this may be modified by specific regulations issued by the FTC.

8) All agents involved in sending the mail must be properly identified in the headers. If you send the mail yourself, this will happen automatically. But some commercial organizations that do mailings will attempt to hide their identity. [CAN-SPAM] Header information (e.g. From and Subject lines) must not be materially false or misleading. The From line must be functioning and remain so for 30 days, and must be prepared to deal with requests not to receive further email. CAN-SPAM permits “other Internet-based mechanism”, presumably a web page, as an alternative for being removed from the list, however it still does not permit a false or misleading From address. If you provide the user with options, one of the choices must allow him to choose not to receive any commercial email from your unit or anyone acting as your agent.

9) One good approach is to use a mechanism such as a Mailman mailing list, which allows recipients to add or remove themselves from the list. See Mailman mailing lists or newsgroups for information about Mailman mailing list and related mechanisms maintained by Rutgers. Rutgers can set up a Mailman mailing list for you, or you can use existing Mailman mailing lists or newsgroups. If you use existing Mailman mailing lists or newsgroups, you must make sure that your announcement is consistent with the announced intent and actual “culture” of the list.

10) Make certain that people responding to the message (e.g. requesting to be removed from the list) do not end up sending their request back to the list. (a) Make sure that the mechanism you use to send does not include all the destination addresses in the message or headers. (b) if you are using an automated system such as a Mailman mailing list, make sure that the list is set to be “moderated”. I.e. messages sent to the list will not go out to the list as a whole without review by a human being.

Email Directed at Destinations Within Rutgers

1) OIT is asking all groups that want to send large-scale email within Rutgers to contact OIT before doing so. You should consult the director or senior technical staff in the OIT division associated with your campus. Note that we’re not asking for advance discussion for every individual message. However OIT would like to discuss the procedures that will be used.

2) Email should be targeted to people who would reasonably expect to be receiving announcements of the sort you intend. These would be people who have requested you to notify them, or whose relationship would otherwise reasonably lead them to expect mail from you. The email addresses should have been given for the purpose you are using them for, or the use must be approved by a person who understands our relationship with these people, and can verify that this is a reasonably expected use. When you get addresses that were not given directly to you, you must verify with the source of the addresses that the use you intend to make of them is something that would reasonably be expected by the people involved.

3) There are special provisions for mail to an entire population, e.g. all faculty, all students, all majors in a department. This should be done only with permission of the unit responsible for the population. E.g. departments may send to all of their staff or majors, Deans may authorize email to all students or faculty in their college, Personnel may authorize email to all staff, the VP for Academic Affairs may authorize email to all faculty, etc. By having a single office coordinate all mail, they can make sure that the total volume is within reason.

4) In some cases there may be regular means of sending announcements to a specific group. E.g. University HR sends a weekly digest of announcements to faculty and staff. Where mechanisms like this exist, announcements to that group should go through that mechanism, or an exception should be approved by someone who is responsible for the population (as defined in 3).

5) Mailings to an entire population should be done very seldom, and should be limited to items that are genuinely essential to the entire population. Announcements of events and special programs should be done using a mechanism that allows recipients to choose whether to participate or not. For example it would probably be appropriate for a University office to send mail to all faculty saying “from time to time we have announcements of …. These will occur roughly once a … If you’d like to get these announcements, please reply to this message.” Such an invitation could reasonably be sent to all faculty, though the normal UHR-maintained digest. For other populations, the invitation would need to be approved by the unit responsible for the population.

6) Any email to more than 50 people must be done through a mechanism such as Mailman mailing lists or RAMS. Mailman mailing lists have three useful properties:

7) Email must be sent with a valid From: address, which is a person prepared to deal with complaints. Make certain that this person is aware that recipients of unsolicited email often react with angry or threatening responses

8) All agents involved in sending the mail should be properly identified in the headers. If you send the mail yourself, this will happen automatically. But some commercial organizations that do mailings will attempt to hide their identity.

9) Make certain that people responding to the message (e.g. requesting to be removed from the list) do not end up sending their request back to the list. (a) Make sure that the mechanism you use to send does not include all the destination addresses in the message itself. (b) if you are using an automated system such as a Mailman mailing list, make sure that the list is set to be “moderated”. I.e. messages sent to the list will not go out to the list as a whole without review by a human being.

Format of Email

This section is not exactly policy. Rather, it contains recommendations based on the experience of a number of different mailing lists.

We recommend that email messages be kept brief. Experience suggests that most people will not read messages unless something at the beginning of the message makes it seem relevant to them. Even then, they are unlikely to read messages that go on for more than a few screens.

We also recommend keeping traffic on lists used for announcements to about once a week. (This does not apply to lists intended for discussion, or lists that users subscribe to voluntarily.) Where there are several announcements in a week, we suggest combining them into a single weekly message. When traffic is more often than once a week, many users will regard it as “spam” and ignore it.

Many areas are using a format that starts with a “table of contents”. This is particularly useful where several messages are combined into a weekly summary. The table of contents consists of one-line summaries of topics covered in the message. This should attract the reader’s attention to messages that have something important for him or her.

In these combined messages, we recommend keeping individual items to a single paragraph of about 5 lines. If there is more material, we recommend putting it on a web page and referring the reader to it. Readers are more likely to read substantial documents from a web page than from long email message.

Even in email messages that are not combined, we recommend limiting the length to about 50 lines or so, referring to a web page for longer material.

People read email using quite a variety of software. For some of this software, messages will be more readable if they are formatted in lines that are between 72 and 79 characters long. Attachments should not be used for large-scale lists. For such lists, it is generally better to refer readers to a document on a web site than to include it as an attachment. For lists where attachments are appropriate, we recommend HTML or Adobe Acrobat format. Word and Excel attachments are useful when a group of people are collaborating on a document. However they are less useful for distributing documents to large group of people to read. Some people are using non-Windows systems, which can’t easily read Microsoft formats. Furthermore, formatting varies slightly from version to version. Thus documents prepared in the latest version of Word may not look as expected when viewed with the previous version.

Procedural Issues

Note that the following items apply primarily to people who are running mailing lists such as Mailman. Messages to more than 50 people should always be routed through such systems.

1) Email to more than 50 people should be sent in such a way that the entire list of addressees does not appear in the header. We encourage such mechanisms to be used for any list with more than 10 members. One easy approach is to put the addresses in a “bcc” field.

2) All email sent by faculty, staff, or students at Rutgers must contain a valid From: field, identifying an email address to which questions and complaints may be directed.

3) You should try to minimize the number of separate messages you send. For example, if you are sending the same message to 200 people, you should send a single message addressed to all 200 people, not 200 individual messages. (But see point 4.) As we have improved the performance of our mail systems, this is no longer quite so serious an issue, but Internet best practice is still to send a single message with multiple addressees unless you know specifically that a system is better off with a large number of individual messages.

4) When sending mail to New Brunswick students, don’t send a message to more than a few hundred addresses at a time. When combined with the point (3) this means that if you are sending mail to 1000 people, you should send it as 5 separate messages, each to 200 people.