CAUCE

Do People Still Care About Email Spam Anymore?

This may seem like a strange question for an anti-spam organization to ask.

CAUCE obviously still cares about email spam, and always will, but does anyone else?

If you talked to your friends or relatives over the holidays and asked them about the amount of spam they get in their inboxes, most of them may tell you that they rarely see it (even basic spam filtering on free email accounts has gotten pretty good).

When you talk to some younger people about email spam, be prepared for them to laugh.

They'll tell you that when they need to communicate, they'll usually use some sort of instant messaging, or maybe send text messasges from their Blackberry or their iPhone. Email just isn't relevant to them any more. ("Sheesh! What will you ask about next? Faxes? Telegrams? Papyrus? Stone tablets? Get with the modern era! Who cares about stupid email?")

For all those sort of users, email is about as relevant as horse-drawn buggies. Email is archaic. They don't care about email, much less email spam.

Other users may tell you that they do care about unsolicited email, but if you probe a little, you'll find that they really only care about certain types of "spam." Everyone hates spam that might infect their computer with a virus or other malware, and many may find it creepy to get personalized phishing messages, but we empirically know that most spam doesn't contain malware or phishing-related content.

In fact, we even find ourselves wondering about email spammers themselves.

Do any smart spammers still care about email spamming? When's the last time you saw anything even relatively creative when it came to spam? I remember being impressed the first time I saw randomized image spam, and fast flux web hosting, but since then I haven't seen a whole lot in the way of spam-related developments that are very technically impressive. (I think this may be evidence that the smart spammers have already moved on to greener and more lucrative cyber crime fields.)

Image by Getty Images via @daylife

Sending email spam has acquired an increasingly last-decade (or last-century!) sort of feeling, sort of like being a person from the Eastern Bloc still proudly driving a rattle trap Trabant. The world's moved on, even if a few Communist-era fossils haven't.

True, there are some back-of-the-pack guys who are still sending cliché spam for illegal pharmaceuticals and quick-to-break knock-off watches or untrustworthy casinos.

I'm sure it's partially a matter of intertia. If sending email spam using someone else's seldom-updated and easily detected spamware is all you really know how to do, well, I suppose that's what you're going to keep doing, even if it doesn't pay nearly as well as it used to. You're trapped in a dead end job, just like a soon-to-be unemployed factory worker who never got retrained for the the modern era.

In fact, it must be sort of depressing to be a professional email spammer. As a professional email  spammer, you really only have two career tracks: mediocrity or infamy.

If you work really hard and end up being one of the rare persons who excels at email spamming, your success virtually guarantees that you'll be the focus of undesirable attention from law enforcement. They can't go after everyone, so they understandably like to use what resources they do have to target the rare "spam king" -- someone like you.

And then there's all the waiting. Law enforcement may not work fast, but boy oh boy, some of those guys are pretty dang dogged once they get on your trail. It may take them years and years to get all the paperwork lined up, but these are very patient guys. They will eventually get all the evidence they need, and then they will reach out and arrest you, sometimes just when you're getting ready to retire somewhere nice and warm.

As a spammer, you do have options. You could intentionally try to "stay small scale" and thus stay off law enforcement's radar, but if you do, is small scale email spamming even really worth it?

See what I mean when I ask, "Do people really even care about email spam anymore?"

 

(This article was contributed by a long-time CAUCE supporter who wishes to remain anonymous.)

The Stockings Were Hung by the Chimney with Care

The ARPA Computer Network is susceptible to security violations for at least
the three following reasons:

(1)  Individual sites, used to physical limitations on machine access, have
     not yet taken sufficient precautions toward securing their systems
     against unauthorized remote use.  For example, many people still use
     passwords which are easy to guess:  their fist names, their initials,
     their host name spelled backwards, a string of characters which are
     easy to type in sequence (e.g. ZXCVBNM).

(2)  The TIP allows access to the ARPANET to a much wider audience than
     is thought or intended.  TIP phone numbers are posted, like those
     scribbled hastily on the walls of phone booths and men's rooms.  The
     TIP required no user identification before giving service.  Thus,
     many people, including those who used to spend their time ripping off
     Ma Bell, get access to our stockings in a most anonymous way.

(3)  There is lingering affection for the challenge of breaking
     someone's system.  This affection lingers despite the fact that
     everyone knows that it's easy to break systems, even easier to
     crash them.

All of this would be quite humorous and cause for raucous eye
winking and elbow nudging, if it weren't for the fact that in
recent weeks at least two major serving hosts were crashed
under suspicious circumstances by people who knew what they
were risking; on yet a third system, the system wheel password
was compromised -- by two high school students in Los Angeles
no less.

We suspect that the number of dangerous security violations is
larger than any of us know is growing.  You are advised
not to sit "in hope that Saint Nicholas would soon be there".

Sound familiar? Bob Metcalfe wrote that in December of 1973, and it was published as RFC 602. Today, gaining access to the internet is far easier than finding a dial-in number written on a bathroom wall — but the rest is more true than even Bob imagined.

C-28 Receives Royal Assent

By Shaun Brown:

It's been a long time coming, but Canada finally has an anti-spam law. Bill C-28, the law with no name, was just passed.

First introduced in April 2009 as C-27, the Electronic Commerce Protection Act, it died when parliament was prorogued in December 2009, only to be resurrected in May of this year as the Fighting Internet and Wireless Spam Act. Industry Committee members, who were unimpressed with the government's bizarre decision to amend the short title, approved the entire bill last month, except for the name. Rather than forcing the issue, everyone involved decided that it would be better to have the law passed before Christmas than go through the process of adding a new short title, which would have required approval of both the Senate and House of Commons, and delayed its passing until next year.

The bill was approved by the Senate yesterday, and received Royal Assent early this afternoon. As of right now, the unofficial name is "Canada's Online Protection Legislation", or COPL.

For those who are not familiar with C-28, it deals not only with spam by establishing an opt-in regime for the sending of commercial electronic messages, but it also addresses a number of related internet threats, including malware, spyware, phishing, and pharming. It provides the Canadian Radio-television and Telecommunications Commission (CRTC) with broad enforcement powers, including the ability to impose hefty administrative monetary penalties (AMPs) for non-compliance. It also includes a private right of action, allowing for private enforcement where public enforcement falls short.

Having been involved since the beginning, and eagerly awaiting its passage, CAUCE is excited and relieved to see Bill C-28 become law. We would like to congratulate everyone at Industry Canada as well as the agencies who worked diligently and tirelessly on this, fighting the endless bureaucratic and political process, as well as the naysayers who would have preferred to see the bill reduced to a gutless, meaningless shell of what we now have (anyone remember Do-Not-Call?).

While COPL will not solve all of the world's online problems, it provides Canada with the tools to do its part in the global fight against spam and related threats. No longer will Canada be the infamous "spam haven" of the G8. Based on best practices from around the world, it is now the gold standard for online protection that will undoubtedly serve as a model as other countries look to improve their own laws.

COPL will come into force in September, 2011, giving organizations plenty of time to ensure that they are in compliance.

C-28 The Law of The Land!

VICTORY!

It’s been a long time coming, but Canada has an anti-spam law, and one, which sets a new world standard, and a tough, but fair, opt-in protocol for everyone in North America who sends commercial email and other  electronic messages.

Yesterday, The Canadian Senate voted to accept Bill C-28, and today, December 15, at 13:00 eastern, it will be given Royal Asset of the Governor General of Canada, His Excellency the Right Honourable David Johnston.

It has been a long, arduous road to get to this point. In 1998, born as an offspring of U.S. anti-spam organization CAUCE, CAUCE Canada came into being.
 
Our mission? To get an anti-spam law passed in Canada.

Over these dozen years, there were fits and spurts along the way, with private member’s bills like that of Dan McTeague, and Senator Oliver, and several others. In 2004-2005 CAUCE played a prominent role in The Federal Task Force on Spam with full hopes of a law being forthcoming.

Years passed, and despite the final report of FASTF being readily accepted, and in fact setting standards world-wide as the seed for other laws, regulations and industry best practices, still no law.

Then, in 2009, a breakthrough – a bill, C-27, was introduced. Over the course of the year, there was testimony by CAUCErs Matt Vernhout & Dennis Dayman to parliamentary committee. There was support. There were naysayers. There was misinformation right up to the last minute, and there was grassroots use of social media.

There was heavy lobbying against the bill, and there was Conservative Minister of Industry Tony Clement who stuck to his guns and resisted attempts to gut the bill. That session of parliament came and went, and in 2010, the bill, slightly amended to deal with some technical issues, was re-introduced. Senders, industry, receivers, politicians from all parties, mandarins, and CAUCE were all in agreement: Canada needed a law, and C-28 wasn’t just good enough – it was great. C-28 now sets a best-of-breed world standard.

To all my colleagues worldwide who have helped this effort in every way possible, I extend my deepest gratitude and most profound thanks, particularly to Scott Hazen Mueller whose visionary thought lead to the creation of CAUCE in 1997.

We have had many board members come and go along the way, but CAUCE founding members Mike ‘der Mouse’ Parker, John Levine, JD Falk, and Chris Lewis stuck with the organization through highs and lows; through it all, with solid support and determination, and they deserve special mention for 12 years of work. Our newest additions, Dr. Joe St. Sauver and Shaun Brown provided sage guidance in the final stretch. Gentlemen, I thank you all, as do all Canadians (whether they know it or not) for your help to get us here.

CAUCE must also share congratulations with many from Industry Canada: André Leduc, Richard Simpson, Michael Binder, Jennifer Kealy, Shari Scott, Andy Kaplan-Myrth, Serge  Presseau, Janet Difrancesco, and many others – please forgive me if your names are forgotten in my excitement to write this - your support and work are decidedly not.

My friend Tom Copland of the Canadian Association of Internet Providers, CAIP, was a stalwart supporter of this bill, and he too merits our thanks. Of course, The Right Honourable Tony Clement who was nothing less than fantastic, for understanding the Internet well enough to have a vision, and a Twitter account, @TonyClement_MP which I abused mercilessly.

CAUCE has an incredibly talented and diverse board, with legal experts, top-notch markers, malware & botnet research elites, all faced with no shortage of work ahead to see that the law is properly implemented, and applied.

Someone recently said C-28 renders CAN SPAM obsolete. Just so, but there is still much work for us to do, to promote a harmonized legal régime throughout North America and the Caribbean, and internationally.  CAUCE will continue to be there, nagging, cajoling, pleading, advocating and demanding that the governments of the world put into place legal protections for all users of the Internet.

Governments, Politicians and Bureaucrats take note: We are your brothers, your mothers, fathers, friends and sisters. We are not consumers, we are Internet users. Respect us for that, do your duty, and protect our right to enjoy our connective technologies unsullied by the harassment of abusive, unwanted communications in all its manifestations. Your job is to draw distinct lines, well overdue, to stop rampant insanity perpetrated upon us all by the rapaciously greedy violators of our fundamental right to privacy.

The net is a place where commerce is done, but it is far more so a place where friends meet, people fall in love, students learn, dissidents agitate for political change, artists create, and folks live an enriching part of their lives. C-28 and laws like it help to protect this invaluable resource, our worldwide shared commons. Today, C-28 made all this a little more possible, and I couldn’t be happier or more proud.

One down, so many more to go! Onwards!

Neil Schwartzman
Executive Director
CAUCE, the Coalition Against Unsolicited Commercial Email

Canadian Anti-spam Bill C-28 Goes to senate Committee Tuesday Dec. 14

TRANSPORT AND COMMUNICATIONS

NOTICE OF MEETING
Tuesday, December 14, 2010
9:30 a.m.
Room 2, Victoria Building 140 Wellington Street

Clerk: Keli Hogan  (613-993-9021)

(Televised live on PTN) Webcast of Senate Meetings : http://senparlvu.parl.gc.ca/Guide.aspx

AGENDA
Bill C-28, An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities, and to amend the Canadian Radio-television and Telecommunications Commission Act, the Competition Act, the Personal Information Protection and Electronic Documents Act and the Telecommunications Act.

WITNESS


          Witnesses to follow

With reporting and interpretation.

Use this link to obtain the latest information about this meeting: http://www.parl.gc.ca/Common/Committee_SenNotice.asp?Language=E&meeting_id=11575&comm_id=19

Déja-Vu All Over Again! C-28 Goes to Senate Committee

C-28 finished second reading in the Senate yesterday, and has been refered to the Standing Committee on Transport & Communications  for review.

 

 

 

 

Remembering the Good Times

The most effective early email-borne viruses didn't need botnets. They didn't change your computer settings, or steal your login credentials. And they somehow convinced regular users to help them spread.

The first warnings about the Good Times virus began to appear in November of 1994, and by December the warnings were seen all over as people did what the warning said, and forwarded it to all their friends. There was another outbreak the following March, which quickly mutated to include a reference to a report from the Federal Communications Commission. After return in October, Good Times virus warnings became a part of the landscape which didn't fade away for years.

According to the primary Frequently Asked Questions document about Good Times, warnings were spread within AT&T, CitiBank, NBC, Hughes Aircraft, Microsoft, Texas Instruments, and many other large, technologically savvy companies. It was reported on news radio stations, and FAXed between branch offices.

The Good Times virus was said to spread via email messages with a subject of "Good Times" -- which was also the subject line for many of the warnings. It would erase your hard drive, destroy all your files, fill your ASCII buffer, send copies of itself to every address in your saved mail files, and/or place your computer's processor "in an nth-complexity infinite binary loop."

"Its an opportunistic self-replicating email virus", explained professor Clay Shirky, "which tricks its host into replicating it, sometimes adding as many as 200,000 copies at a go. It works by finding hosts with defective parsing apparatus which prevents them from understanding that a piece of email which says there is an email virus and then asking them to remail the message to all their friends is the virus itself."

Yep. The warning was the virus.

The internet was first becoming available to the wider public in 1994; most university students and faculty had accounts on educational systems, and AOL and other formerly standalone proprietary online services had hooked in. Information services, including what eventually became the World Wide Web, were connecting people as never before.

Some of these people were worried. They knew they didn't understand how email worked, or how computers worked. But they also wanted to help each other -- to learn, to stay safe, and just to share. So they forwarded the warning, and their friends forwarded it, and so forth.

All that the virus needed in order to get sent around the world over and over and over was a whole lot of gullible people who honestly thought they were being helpful.

If a virus's measure of success is how far it spreads, then the Good Times virus warning virus was the most successful virus of its day...and much of what made it so successful in the mid-1990s still holds true today. Just last week, Facebook users posted warnings for each other about a Christmas Tree virus which doesn't exist. Last year, misinformation about swine flu spread unbelievably quickly on Twitter, even with official sources posting hourly. And now, of course, any popular news headline quickly becomes the topic of black hat SEO trying to trick people into visiting malicious web sites. It has never been more important to stay aware, up to date...to confirm every claim, especially before installing new software you find on some unknown web site...to be just a bit more paranoid than really seems necessary.

As the Good Times warnings said: Happy Chanukah everyone, and be careful out there. Could you pass this along to your global mailing list as well?

(This article was originally published on Return Path's Received: Blog; reprinted with permission.)