From: James M Galvin <galvin+ietf(_at_)elistx(_dot_)com>
...
What is required is a full list (with or without subscribers) with an
archive that includes everything (except viruses and obvious spam) for a
period of time.
yes, provided you error on the side of inclusion when it comes to anything
that might or might not be spam. I'd forward any spam or viruss to
news.admin.net-abuse.sightings for permanent archiving by Google.
I happen to like 10 days but I've heard others suggest
that it really needs to be much longer, perhaps 30, 60, or even 90 days.
The ASRG case, including the recent effort involving out of context
quoting, demonstrates that more than 90 days is required.
If there were a problem with permanent archiving, the one could archive
the full list but not the filtered list, with some kind of added X-header
indicating messages that were filtered. The non-spam that is not
filtered had better be a trivial number of bytes (for this century)
or someone should be cut off by an ISP.
About the supposed high costs of archiving spam--perhaps Google's
archive of spam has been overlooked. See
http://groups.google.com/groups?scoring=d&q=group%3A*.sightings
It's valuable when dealing with spammers claiming to not be spammers.
Vernon Schryver vjs(_at_)rhyolite(_dot_)com