CAUCE

Huge US fine for NZ spammer - CAUCE President John Levine Assists in Case

The New Zealander identified by the United States Federal Trade Commission as the ring leader of an international spam network has been ordered to pay $US15.15 million by a US federal judge.

A year ago Lance Atkinson, who lives in Pelican Waters, Queensland admitted his part in the spamming operation in the High Court in Christchurch and paid a financial penalty of $NZ100, 000 plus costs of almost $NZ8000. The FTC took separate action against him but not his brother Shane and Christchurch courier Roland Smits who just last month were ordered to pay $100,000 and $50,000 respectively for their parts in the operation.

These settlements marked the final stage of Operation Herbal King, an investigation conducted by the Department of Internal Affairs’ Anti-spam Compliance Unit, the FTC and other overseas agencies. Within three months of the passing of the Unsolicited Electronic Messages Act in 2007, the Department had shut down the New Zealand component of what the anti-spam organisation, Spamhaus, ranked as the largest pharmaceutical spamming operation in the world. The spam gang deceptively marketed products such as male-enhancement pills, prescription drugs and weight-loss pills.

The operation organised and paid affiliates around the world to send spam emails marketing Herbal King, Elite Herbal and Express Herbal branded pharmaceutical products. These were manufactured and shipped by Tulip Lab of India, through a business known as the Genbucks Affiliate Programme. This business was operated by Genbucks Ltd, a company incorporated in the Republic of Mauritius.

Lance Atkinson’s American accomplice in the network, US resident Jody Smith, has had to turn over nearly all his assets to the FTC. He will pay approximately $US212,000 and will also assign any rights he has to $US91,000 frozen in the name of one of his co-defendants, and $US547,000 that may be held for his benefit in an Israeli bank. In addition to the $US15.15 million that Atkinson and his company, Inet Ventures Pty Ltd, have been ordered to pay, the three companies affiliated with Smith are liable for $US3.77 million. Smith is awaiting sentence on a criminal charge of conspiracy to traffic counterfeit goods and faces up to five years in prison.

Internal Affairs Deputy Secretary Keith Manch said the Department appreciated the co-operation its Anti-Spam Compliance Unit received from the FTC.

“The FTC provided technical information making it possible for our investigators to identify the spammers and obtain evidence of the offending,” he said.

The Department would also like to acknowledge the assistance of the following in the investigation: Telecom New Zealand; Vodafone New Zealand Limited; Safecom services; DMZGlobal (TelstraClear Ltd); Phil Hay, Senior Threat Analyst, M86 Security Labs; consultants Dr John R. Levine and Henrik Uffe Jensen; CSL NRW.NET Computer Service Langenbach GmbH; email compliance and anti-spam company, LashBack; Simon Cox and Richard Vadon, British Broadcasting Corporation.       

Maybe email IS dead -- part of it, anyway.

by J.D. Falk

I tend to chuckle at every new proclamation that email is dead. Google Wave won't kill it. Twitter and Facebook aren't killing it; they're using it. RSS didn't kill it. Instant messaging didn't kill it. "Push media" (remember that?) didn't kill it. AOL and Compuserve and Prodigy didn't kill it; they joined it. And before that, usenet and email lived happily side-by-side.

Over the years the Coalition Against Unsolicited Commercial Email (CAUCE), the world's oldest and largest email advocacy organization, has also predicted the death of email. Some day, we've said, we will reach a tipping point where spam finally makes email unusable for regular people. And for any people who doesn't have good spam filters, that's already happened. Avoiding email's death by spam has given rise to the spam filtering & security industry, and the equally powerful mailbox hosting industry. It has elevated open source projects like SpamAssassin from curiosities to necessities. I've lost count of the number of hardcore geeks who've finally given up on running their own severs, and moved their personal mail to Gmail.

Through these efforts, and these small personal concessions, email survives. But it's not the same, and I'm left wondering if a part of email has died.

Consumer Alert: Deep Inside a 'Work at Home' Scam: Mules Victimized by "Air Parcel Express"

Here at CAUCE, we don't often post articles unrelated to spam law, but this piece by RSA is remarkably well-written and relevant to all Internet users, particularly during these days of high unemployment. Scam job offers to 'work at home' have appeared on legitimate sites such as LinkedIn, Craiglist, and Monster.com, and even in the classified sections of newspapers. Before accepting such a position, or even engaging the scammers in a discussion please ask yourself 'would anyone really pay me several thousand dollars to receive high-priced goods, or cash their cheques, and if so WHY?' Such workers end up on the hook for receiving stolen goods, or bank fraud, the scammers leave the workers holding the bag. Do yourself a favour, and don't get involved in such scams. If you are wondering if it sounds too good to be true, it always is.

Deep Inside a Reshipping Scam: Mules Victimized by "Air Parcel Express"

by RSA FraudAction Research Lab on 11/12/2009
Since last fall the RSA FraudAction Research Lab has tracked several different reshipping scams engineered by online fraudsters to "Cash Out" merchandise purchased using stolen payment cards through the involvement of mules. We will profile one such scam in-depth — Air Parcel Express — that was discovered by RSA. First we will outline who is involved in a reshipping scam and how they generally operate.

#C27 Anti-spam bill by end of year - Dalhousie Gazette

C-27 one step closer to becoming law

Canadians could soon enjoy better protection when it comes to unwanted spam filling our e-mail inboxes.

Bill C-27, the Electronic Commerce Protection Act, passed through the House of Commons standing committee on industry, science and technology last week with few major amendments. First introduced to Parliament in April by the Conservative government, the bill seeks to prohibit the sending of spam without a consumer's consent. Individuals found in violation of the law could be fined up to $1 million.

"We have been pushing for this law for almost a decade," said Neil Schwartzman, executive director for the Coalition Against Unsolicited Commercial E-mail, a continent-wide, volunteer-based consumer advocacy organization.

Email's Not Dead, neither is Spam

by Neil Schwartzman

Over the past few years, we have seen a plethora of over-hyped articles in the popular press and blogosphere crowing wrong-headedly about how "email is dead". Social networks like Facebook and Twitter, new and as-yet unproven technologies are the supposed death-knell for our old reliable friend, e-mail.

I wrote about the rumours of email's death being exaggerated back in 2007 in response to such inanity.

Since then, we've seen such a cornucopia of silliness of the "Such & such is killing email" variety that Mark Brownlow compiled a bunch of articles, and their rebuttals at his excellent site emailisnotdead.com

Email ain't dead folks. Go look at your inbox. As the wags over at BoxOfMeat.com make note, they are becoming "tired of marketers calling their conferences and cliques "email whatever" as if marketing is the only thing email is for".

Just so! The vast majority of the email I receive daily, and I suspect the same for you, is from friends, email discussion lists, transactions from my bank, a few airlines and hotels, various online services I use, alerts about software updates, oh, and emails from social network services like Twitter, Facebook and LinkedIn reminding me to log in to see messaging that they keep in-house.

Facebook set up personalized domains some months ago for example facebook.com/spamfighter is me. What do you think the logical next step is? Rumour has it that Facebook will be doing email, sooner or later. MySpace already took the plunge. I promise you, Email is not dead because people want to write directly to one another, using their email accounts, in more than 140-character bursts.

Besides which, your Mom doesn't have a Twitter account. Your boss isn't going to relay an annual job assessment via Facebook. Your bank isn't sending you a statement to your MySpace page anytime soon, if ever. As if!

So what about spam? Is it dead? Some guy at Slate seems to think so (Surprise! We won the war on spam), and the Chicago Tribune slavishly gave him props (The spam plague is over, has anyone noticed?)

Really, these people should know better.

Their "fundamental proof" for the spam epidemic having run its course is that spam filters work. Well, duh. If they didn't, we would all be seeing about 90 for every one spam that gets into the inbox. That doesn't mean it is over, merely that we are not seeing the vast majority of the spam sent our way. The spam filtering-spam sending war is ever-escalating, and someone has to pay the piper for new technologies and filters. That someone is, you, dear reader, the end user of that wonderful technology, email.

The head of the Canadian Internet Service Providers Association said, some six years ago, that it costs each email user in Canada $5/month for filtering. That was well before things got really bad with great advances made with botnets and other spamming techniques. This is real money out of your pockets folks, and sure, you can opt for a freemail account. Freemail means the service doesn't cost you anything, but someone is paying for it, and that somebody are advertisers. Personally, I like an ad-free environment when I am peacefully reading an email from a friend or relative. I don't need yet another "targeted" message to add to the already intolerable clutter. I have been swooshed enough, thanks.

The "Spam is dead" crowd cites some legal initiatives, some successful, other not, as a failure of anything but technology to address the spam arms race. Of course, some spammers are going to win in court. That doesn't mean laws are ineffective. Just ask Adam "I owe Facebook $900,000,000" Guerbuez, Sanford "I owe Facebook $700,000,000" Wallace, Scott "I paid MySpace $6,000,000" Richter, and Alan "I face seven years in jail and a $1,000,000 fine" Ralsky.

These all sound like effective actions to me. Of course, a law isn't going to stop spam any more than it does murder. What laws serve to do is keep honest people honest, and allow society to take some punitive actions against those that flout our common mores.

Spam can and must be dealt with in a multi-pronged fashion — no single initiative is going to kill it off: User education, legal initiatives, spam filtering, the adoption of best common practices by legitimate mailers, cross-jurisdictional cooperation, all of the stuff that we agreed to in the ground-breaking Task Force on Spam, back in 2004.

Maybe this will have you scurrying to the supposedly safe confines of Facebook or Twitter? Then again, maybe you've noticed that the bad guys are spending an awful lot of time money and resources targeting these two platforms of late? If not, you should. A colleague of mine has had her twitter account hacked three times in as many weeks — and now, it turns out that Koobface, an infamous piece of Facebook malware, may have come to Twitter, too: Twitter spam worm stealing user logons.

Read more about this here: Facebook, MySpace, and crossdomain.xml or here: Massive Facebook And MySpace Flash Vulnerability Exposes User Data

Then, there are the fun games you can play on Facebook. Whoops, maybe not so much fun. Check out the Tech Crunch series about the CEO of the company behind Mafia Wars and Farmville, who laughs about his scamming innocent users like you out of the personal information, which he resells to marketers.

Former email spammer Scott Richter is now happily publishing Facebook apps from his new company, Lunatic Games at http://www.new.facebook.com/LunaticGames

As the old saying goes, fool me once, shame on you; fool me twice, shame on me. I think you’d have to be a lunatic to play one of those games. Did we mention that Scott’s other company is affiliates.com ? Now, what do you think he is doing with the information he gathers from game-playing Facebook users?

Spam ain't dead folks. It just got itself a Facebook account, and it tweets, too.

#C27 - Digital Copyright Canada "Debate on spam became innovation agenda discussion"

Russell McOrmond at DCC pointed out the NDPs support of C-27 and how it dovetails to other agenda points:

Charlie Angus was in full force yesterday. He took his contribution to the debate on Bill C-27 (often called the anti-SPAM bill, although it still contains anti-malware and other provisions as well), and spoke about it as one part of a larger digital agenda.

The full debate is available via Hansard, but I wanted to highlight a specific section of Mr. Angus' contributions. (Note: Debate resumes after C-50, which may be today or later.)

continues: http://www.digital-copyright.ca/node/5081

#C27 - Bill C-27 3rd Reading & Debate in House of Commons Day 2

Transcripts of the debate on The Electronic Commerce Protection Act, anti-spam Bill C-27 - it appears the bill has cross-party support:

http://www2.parl.gc.ca/HousePublications/Publication.aspx?Language=E&Mode=1&Parl=40&Ses=2&DocId=4204091#SOB-2935843

 The bill does not appear to be on the Order of the Day for November 04. it is unclear if it will be debated, read or voted upon today.

#C27 - Bill C-27 3rd Reading & Debate in House of Commons

Bill C-27 3rd Reading & Debate in House of Commons

According to a MessageLabs report of September 2009, which is a division of Symantec Corporation, spam accounted for as much as 86% of all global email traffic. Unfortunately, Canada is in part responsible for this problem.

Canada ranks as one of the top originating states for spam. In Cisco 2008 Annual Security Report Canada ranked fourth on the list of spam by originating country list.

Late last year in the United States, Facebook won $873 million U.S. in damages from an American court arising from the activities of a spammer based in Canada. That case was prosecuted in the United States and not in Canada. That speaks to the lack of Canadian legislation in place to prevent this kind of activity.

If Bill C-27 is passed by the House at third reading, Canada will go a long way to combating spam and spam-related threats. Based on the experience of other states with similar legislation, a reduction in spam is quickly expected. When Australia adopted similar legislation in 2004, it dropped out of the world's top 10 spam-originating states and major spammers in Australia closed their operations altogether.

While the legislation will not eliminate spam entirely, Canadians will see a reduction in the amount of spam in their inboxes. Equally important, the legislation will decrease the most damaging forms of spam from originating in Canada and will help drive spammers and their associated illegal activities out of Canada.

November 02, 2009, 16:55:

Hon. Michael Chong (Wellington-Halton Hills, CPC):
Mr. Speaker, I am pleased to rise to speak to the third reading of Bill C-27, Electronic Commerce Protection Act, or as it is also called the ECPA.

As chair of the Standing Committee on Industry, Science and Technology, I want to recognize the constructive work of all the members of the committee from all parties in improving the bill.

The bill, as amended, from committee has benefited from the work over the past months of the members of the committee. As a result, a number of key elements in the bill have been strengthened, clarified and have been done in a way without diminishing the core principles of what the government has been trying to achieve.

Email is a wonderful technology, and it has only been just over 10 years that we have all been using email broadly. In just over 10 years, it has completely changed our lives. However, many of the benefits of email have been offset by the problem of spam, which is unwanted and unsolicited commercial emails.

According to a MessageLabs report of September 2009, which is a division of Symantec Corporation, spam accounted for as much as 86% of all global email traffic. Unfortunately, Canada is in part responsible for this problem.

Canada ranks as one of the top originating states for spam. In Cisco 2008 Annual Security Report Canada ranked fourth on the list of spam by originating country list.

Late last year in the United States, Facebook won $873 million U.S. in damages from an American court arising from the activities of a spammer based in Canada. That case was prosecuted in the United States and not in Canada. That speaks to the lack of Canadian legislation in place to prevent this kind of activity.

The high volume of spam in recent years has negatively affected the productivity of the Internet and all the technologies associated with the Internet. When a high volume of email is spammed, many people spend hours deleting unwanted messages, networks slow down and companies are forced to spend millions, if not billions of dollars, upgrading their systems, their networks, their backbones, their routers, their pipes to the Internet in order to accommodate the additional bandwidth and network capacity needed to handle this volume of email traffic.

The high volume of spam has impeded the full potential of the Internet as a platform for both personal and commercial use. Spam is more than just unwanted email. It is often used as a vehicle to perpetrate fraud on Canadians. It can lead to online fraud by luring individuals to counterfeit websites, also known as phishing. It can lead to the theft of personal data to rob bank accounts and credit card accounts, called identity theft. It can lead to the collection of personal information through elicit access on one's laptop or on one's computer, known as spyware. It often is used as a vehicle to perpetrate fraud on Canadians

Not just Canadians suffer but Canadian businesses suffer and often this is an overlooked fact of spam. Canadian businesses suffer because they are the victims of the counterfeiting of their corporate website to defraud individuals. We all know of examples of getting emails from spammers or from other people who wish to perpetrate fraud. They ask for people's banking information. They send an email that contains a page that looks like a Royal Bank website or a TD Bank website and often many unsuspecting individuals give their information to these spammers, the people trying to perpetrate this fraud.

It also leads to spam borne viruses and other malicious software called malware, which are used to create networks of zombie computers known botnets without the knowledge of their owners. This undermines confidence not just that Canadians have in the Internet but that Canadian businesses have in the Internet as a platform for commerce, as a platform for doing business in the 21st century.

I do not think it is hyperbole to say that spam is costing Canadians and Canadian businesses billions of dollars a year in fraud, in network capacity and in the need to upgrade systems to handle the volumes of email which we are seeing. It costs the economy through malicious programs such as malware, spyware, phishing, viruses, worms and Trojans that enter computers. It costs the economy in terms of undermining Canadians and Canadian businesses in their confidence of the Internet, often having to rely on old-fashioned ways of doing business because the Internet is not seen as trustworthy enough to conduct certain types of business transactions.

In response to this problem, the Government of Canada launched a task force on spam to consult Canadians and their businesses. The task force was given one year to consult and report. In May 2005 the task force reported its findings and recommendations in a report to the Minister of Industry. I want to thank the members of the task force for their valuable work in this regard.

Our government has acted on the recommendations and findings of the task force by introducing Bill C-27, anti-spam legislation entitled "The Electronic Commerce Protection Act", or the ECPA. This legislation will deter the most damaging form of spam from happening in Canada and will help drive spammers and their associated activity out of Canada.

The legislation addresses the recommendations of the task force on spam, which brought together experts from industry, academia, consumers and other business experts to come together to craft a comprehensive set of measures to combat threats to the online economy. Successful legislative models in other states were also examined and taken into account when drafting the bill.

The legislation will allow Industry Canada to act as a national coordinating body to educate consumers, track and analyze statistics and trends and lead policy oversight and coordination.

The legislation will also facilitate the establishment of a non-governmental agency, the spam reporting centre, which will receive reports of spam and related online threats, allowing it to collect evidence and gather intelligence to assist the three reporting agencies, the Canadian Radio-television and Telecommunications Commission, the Competition Bureau and the Office of the Privacy Commissioner, with the investigation and prosecution of offences.

It is important to note that the ECPA does not apply to non-commercial activity. Political parties and charities, other organizations that contact Canadians through email will not be subject to the ECPA, provided these emails do not involve selling or promoting a product.

Bill C-27 will protect Canadians and their businesses from the most damaging and deceptive forms of electronic harms and provide a regulatory regime to protect the privacy and personal security of Canadians. The rules will encourage confidence in online communications and e-commerce on the Internet.

The bill before us provides the CRTC, the Competition Bureau and the Office of the Privacy Commissioner with the tools they need to pursue those who undermine our online economy and to work with one another and their international counterparts. The bill has sharp teeth, administrative monetary penalties of up to $1 million for individuals and up to $10 million for businesses.

The bill in front of us today resulted from a great deal of work from several different sources. On the one hand, we had the recommendations and findings of the 2005 task force on spam. On the other hand, we have also benefited from some of the work that former Senator Goldstein did in Bill S-220 in this regard.

Some of the features in this bill differ from what Mr. Goldstein had previously proposed. One of the most important is the use of the CRTC, the Competition Bureau and the Office of the Privacy Commissioner to enforce the provisions, in other words, using regulatory agencies to enforce the provisions of the spam bill rather than using police enforcement agencies as Bill S-220 had proposed.

The RCMP has other urgent law enforcement responsibilities, and I believe we should not redirect those precious resources to the monitoring of unsolicited commercial email. I believe that regulatory authorities are better positioned than law enforcement authorities for this kind of white collar problem.

In drafting Bill C-27, the government also drew on a wealth of experience in other states in combating spam. The bill drew on work that had been done in New Zealand, Australia and in the United States. The bill also benefited from the approach taken by other states as well. The bill before us is based on the best and most effective aspects of those legislative regimes in those states.

By being consistent with the approaches of other states, by using regulatory approaches and regulatory agencies in effecting this anti-spam bill rather than law enforcement agencies, we will help promote greater international co-operation to combat spam and other online fraud.

As members of the House know, Bill C-27 adopts an express consent regime designed to give businesses and consumers control over their inboxes and their computers. It requires that the individual's consent be sought and obtained in order to permit an ongoing commercial transaction. Once consent has been expressed by an individual, it remains until the individual opts out or revokes that consent. The industry committee took a careful look at how to ensure that the companies that used email could keep in touch with consumers so they did not inadvertently find themselves in violation of the law.

Members of the House will also know that the bill contains implied consent provisions that have been expanded to include suspicious publication of an electronic address. If someone publishes his or her email address on a website or in a print advertisement, he or she is considered to have consented to receive unsolicited commercial messages, provided the sender's message relates to the business or office held by the person.

Consent is also implied when a person gives out a business card or provides an email address in a letter. Similarly, the amended bill clarifies that when a business is sold, the purchaser has an implied consent to contact the customers of that business. Following the initial transaction between a business and a consumer, the period of implied consent has been expanded to 24 months from the original 18, as first contained in the original bill. This gives businesses even more time in which to obtain the express consent to further commercial transactions.

Another area in which the bill has been amended is in ensuring that updates to computer programs are not adversely affected by the protections we have put in place against malware and spyware.

The committee looked at the impact the bill would have on the installation of computer programs. It has been amended in the situation where the installation of updates, as it is understood as part of an original contract under which the software is installed, is not prohibited by the bill. Most of these programs call for automatic updates, such as daily or weekly updates, to anti-virus software. These updates will not require fresh consent for each instance. Running programs such as JavaScript or Flash programs will also not require express consent each time they are run.

Let me say a few words about the private right of action before I conclude. Some hon. members have questioned whether a private right of action is necessary. I believe it is. The private right of action enforces and complements the enforcement efforts of the CRTC, the Competition Bureau and the Office of the Privacy Commissioner. I would remind the House that this feature has been very effective in other jurisdictions in shutting down those such as spammers who have caused to the electronic economy. I believe it will be equally effective here in allowing groups or individuals to pursue violators. The private right of action will allow individuals and businesses suffering financial harm an avenue of recourse to be compensated and awarded damages.

Finally, the bill is technology-neutral. Bill C-27 recognizes that the convergence of voice and data is happening and will eventually be complete. It will allow the Government of Canada to prevent spam and associated threats regardless of how the technology evolves. Therefore, the bill will remain current in the future as technology evolves.

If Bill C-27 is passed by the House at third reading, Canada will go a long way to combatting spam and spam-related threats. Based on the experience of other states with similar legislation, a reduction in spam is quickly expected. When Australia adopted similar legislation in 2004, it dropped out of the world's top 10 spam-originating states and major spammers in Australia closed their operations altogether.

While the legislation will not eliminate spam entirely, Canadians will see a reduction in the amount of spam in their inboxes. Equally important, the legislation will decrease the most damaging forms of spam from originating in Canada and will help drive spammers and their associated illegal activities out of Canada.

The Internet has become the primary platform for online commerce and general communications. Canada has had a long history of global leadership in the telecommunications sector. E-commerce is now a part of the Canadian economy, with billions of dollars of goods and services being sold over the Internet each year in Canada.

If adopted by Parliament, this legislation would allow Canada to continue in that leadership, ensuring that we remain a secure locale for e-commerce and for Canadians. It is time for Canadian law to catch up with the Internet age. All parties in the House have expressed their desire to strengthen confidence in online commerce. All parties are opposed to spam and see the danger of it.

We have studied this bill at great length in committee and have emerged with important amendments that clarify it. The time has come to pass it at third reading.

debate at http://www2.parl.gc.ca/HousePublications/Publication.aspx?Language=E&Mode=1&Parl=40&Ses=2&DocId=4197556#TOC-TS-1710