CAUCE

33 Years of Spam? No, Not Really.

On May 3rd, 1978, a Digital Equipment Corporation (DEC) marketing representative named Gary Thuerk and a DEC engineer named Carl Gartley sent what many believe to be the first email spam. (The message was dated May 1st, but sent on May 3rd.) It advertised two events in California promoting the new DECsystem-20, the first DEC computer capable of connecting easily to the ARPAnet, predecessor to the internet. The message was addressed (by hand) to every ARPAnet user on the West Coast of the United States that they could find, but ran into an unexpected limit: the mail program would only accept 320 addresses. The rest of the addresses bled into the body of the message, and some recipients forwarded it on.

(Brad Templeton's mostly-outdated Essays on Junk E-mail includes a detailed history of the incident and reactions to it, based in part on a direct conversation with Thuerk himself.)

Scattered around the Internet today (and every May) you'll find various articles heralding the 33rd anniversary of spam, counting the years from Gary's message. They'll remark that spam has been with us a long time, maybe quote a few anti-spam vendor statistics, and say spam isn't going anywhere. But that's just bad research.

The ARPAnet and later the NSFnet were strictly non-commercial, both by contract and by social compact. Anyone who violated that got a stern talking-to, and could lose their access and get fired or expelled. So while there was indeed an occasional misstep, an occasional commercial message, they were very rare.

This changed in the mid-1990s, as the internet first became available to the general public. Commercial use was still hesitant, but increasing rapidly. Some of the early commercial users were entrepreneurs who are now considered geniuses; others were hucksters who are now in jail, or dead.

A common "get rich quick on the internet" scam was to sell books and kits for getting rich quickly on the internet. Often they were simply lists of ISPs by area code, some instructions paraphrased from The Internet for Dummies, and a few templates you could use to create your own web site. But there were also lists of email addresses and email blasting software — the unfortunate and unwelcome beginnings of both the email marketing industry and the ongoing malware epidemic.

Commercial use increased, and we have the internet we do today. Spam increased even faster. But that doesn't mean spam can't be controlled, and reduced. Every month there's another botnet taken down, another major bust by law enforcement — those used to happen maybe once a year, if we were lucky. There has never before in the history of the internet been so much focus on spam, malware, and other so-called "cybercrime" from so many different agencies, mostly (finally!) collaborating with each other. The internet won't return to the old, pre-commercial days, but it will get better.

And while it's true that the first bulk unsolicited commercial email was sent in 1978, there are stories of non-commercial mass messaging going back much further — such as the MIT user who transmitted, in 1971, the words "There is no way to peace. Peace is the way." Perhaps we should consider that the first Tweet?

The Stockings Were Hung by the Chimney with Care

The ARPA Computer Network is susceptible to security violations for at least
the three following reasons:

(1)  Individual sites, used to physical limitations on machine access, have
     not yet taken sufficient precautions toward securing their systems
     against unauthorized remote use.  For example, many people still use
     passwords which are easy to guess:  their fist names, their initials,
     their host name spelled backwards, a string of characters which are
     easy to type in sequence (e.g. ZXCVBNM).

(2)  The TIP allows access to the ARPANET to a much wider audience than
     is thought or intended.  TIP phone numbers are posted, like those
     scribbled hastily on the walls of phone booths and men's rooms.  The
     TIP required no user identification before giving service.  Thus,
     many people, including those who used to spend their time ripping off
     Ma Bell, get access to our stockings in a most anonymous way.

(3)  There is lingering affection for the challenge of breaking
     someone's system.  This affection lingers despite the fact that
     everyone knows that it's easy to break systems, even easier to
     crash them.

All of this would be quite humorous and cause for raucous eye
winking and elbow nudging, if it weren't for the fact that in
recent weeks at least two major serving hosts were crashed
under suspicious circumstances by people who knew what they
were risking; on yet a third system, the system wheel password
was compromised -- by two high school students in Los Angeles
no less.

We suspect that the number of dangerous security violations is
larger than any of us know is growing.  You are advised
not to sit "in hope that Saint Nicholas would soon be there".

Sound familiar? Bob Metcalfe wrote that in December of 1973, and it was published as RFC 602. Today, gaining access to the internet is far easier than finding a dial-in number written on a bathroom wall — but the rest is more true than even Bob imagined.

Remembering the Good Times

The most effective early email-borne viruses didn't need botnets. They didn't change your computer settings, or steal your login credentials. And they somehow convinced regular users to help them spread.

The first warnings about the Good Times virus began to appear in November of 1994, and by December the warnings were seen all over as people did what the warning said, and forwarded it to all their friends. There was another outbreak the following March, which quickly mutated to include a reference to a report from the Federal Communications Commission. After return in October, Good Times virus warnings became a part of the landscape which didn't fade away for years.

According to the primary Frequently Asked Questions document about Good Times, warnings were spread within AT&T, CitiBank, NBC, Hughes Aircraft, Microsoft, Texas Instruments, and many other large, technologically savvy companies. It was reported on news radio stations, and FAXed between branch offices.

The Good Times virus was said to spread via email messages with a subject of "Good Times" -- which was also the subject line for many of the warnings. It would erase your hard drive, destroy all your files, fill your ASCII buffer, send copies of itself to every address in your saved mail files, and/or place your computer's processor "in an nth-complexity infinite binary loop."

"Its an opportunistic self-replicating email virus", explained professor Clay Shirky, "which tricks its host into replicating it, sometimes adding as many as 200,000 copies at a go. It works by finding hosts with defective parsing apparatus which prevents them from understanding that a piece of email which says there is an email virus and then asking them to remail the message to all their friends is the virus itself."

Yep. The warning was the virus.

The internet was first becoming available to the wider public in 1994; most university students and faculty had accounts on educational systems, and AOL and other formerly standalone proprietary online services had hooked in. Information services, including what eventually became the World Wide Web, were connecting people as never before.

Some of these people were worried. They knew they didn't understand how email worked, or how computers worked. But they also wanted to help each other -- to learn, to stay safe, and just to share. So they forwarded the warning, and their friends forwarded it, and so forth.

All that the virus needed in order to get sent around the world over and over and over was a whole lot of gullible people who honestly thought they were being helpful.

If a virus's measure of success is how far it spreads, then the Good Times virus warning virus was the most successful virus of its day...and much of what made it so successful in the mid-1990s still holds true today. Just last week, Facebook users posted warnings for each other about a Christmas Tree virus which doesn't exist. Last year, misinformation about swine flu spread unbelievably quickly on Twitter, even with official sources posting hourly. And now, of course, any popular news headline quickly becomes the topic of black hat SEO trying to trick people into visiting malicious web sites. It has never been more important to stay aware, up to date...to confirm every claim, especially before installing new software you find on some unknown web site...to be just a bit more paranoid than really seems necessary.

As the Good Times warnings said: Happy Chanukah everyone, and be careful out there. Could you pass this along to your global mailing list as well?

(This article was originally published on Return Path's Received: Blog; reprinted with permission.)

Kidnapping, Theft and Rape Are Not "Cyber" Crimes

Kidnap. Rape. There are no lesser words that can be used to describe what happened to the daughter of an anti-spam investigator in Russia.

His daughter was recently released, according to Joseph Menn’s recent article on Boing Boing, after having been kidnapped from her home five years ago, fed drugs, and made to service men, as a warning to ward off further investigations.

The criminals behind these vicious acts were also responsible for large spamming organization associated with Russian Mob activity.

Note that we say "also."

When someone is mugged, harassed, kidnapped or raped on a sidewalk, we don't call it "sidewalk crime" and call for new laws to regulate sidewalks. It is crime, and those who commit crimes are subject to the full force of the law.

For too long, people have referred to spam in dismissive terms: just hit delete, some say, or let the filters take care of it. Others — most of us, in fact — refer to phishing, which is the first step in theft of real money from real people and institutions, as "cyber crime." It's time for that to stop.

Some of these crimes involve technology. So what? Criminals have used technology before.

Some of these crimes cross borders. So what? Crimes have crossed borders before.

Spam isn't illegal everywhere yet. So what? Spam 2.0 (spam, malware & spyware) is the leading edge of far worse activities, often things that have been illegal as long as we've had laws.

It is high time that governments and law enforcement stop thinking of computer crime as that perpetrated by teenagers in their parent’s basement. It is the Russian Mob and other organized criminals that are doing this.

While we are at it, we should mention ‘cyber-warfare’, something too often conflated with cyber-crime. Cyber-crime is not "cyber-warfare.” There may be state or terrorist agencies copying the tactics and methods of these criminals, but that does not mean that the criminals must be left alone until new cyber-warfare agencies have been created and funded.

As Purdue computer science professor ‘Spaf’ Spafford was recently quoted as saying in a note-worthy piece ‘Cyberwar Vs. Cybercrime’ on the GovInfo Security blog

"Why aren't we seeing the investment and prioritization being made in law enforcement, first? Why is all the publicity, funding and prioritization being given to the military - with efforts such as the build-up of the military cyber command - when so much of the clear and present threat is from the criminal element and not from other nation-states?"

Just so, Prof. Spafford!

As we have said repeatedly on this site, these are criminal gangs who have found an incredible loophole in the justice systems of the world: they can rob banks and people, with little chance of getting caught, let alone going to jail. This is not because they're doing things that aren't illegal; they've just found a new way to hide.

David Black, manager of the RCMP's cyber infrastructure protection section recently said to CAUCE Executive Director Neil Schwartzman “we don’t do spam”. OK, but why not? Spam is no longer, and hasn’t been for some time, about simply sending unwanted emails. Spam is now a delivery mechanism for malware, which in turn threatens infrastructure, and facilitates theft. We have seen precious few cases filed using existing Federal computer intrusions laws in Canada, and none, to our knowledge have been filed under the renovated anti-phishing law, S-4, passed in September 2009.

Governments and law enforcement agencies need to begin to treat online theft with the same seriousness as they do other physical crimes. It is time to bring this up to the diplomatic level, or seriously consider refusing packets from places that treat the Internet, and innocent victims, as their personal ATM.

CAUCE is made up of people who care about email qua email. We understand it, we love it. It is still the ‘killer app’. Furthermore, we understand why some folks in law enforcement or the judiciary might ask, "When there are people stealing millions or hurting people in the commission of violent crimes, why are you wasting our time with 'just' a spam case?” Here's why:

1. Most spam is sent by organized criminal gangs, just like other organized crime.
2. Those gangs intentionally operate trans-nationally, in an effort to frustrate investigation and prosecution.
3. Money laundering of the proceeds from spam is routine, and that money directly fuels official corruption and other social ills.
4. Some spammers are actually selling something. Their favorite product? Counterfeit pharmaceuticals. In many cases these may be scheduled controlled substances, sold in bulk, and available to minors; in other cases, critical medicines needed to properly treat cancer and other serious illnesses may be counterfeit placebos, with potentially tragic results.
5. Spammers operate by compromising tens or hundreds of thousands of end-user PCs, violating those users' privacy and sometimes steal sensitive personally identifiable information such as individuals’ and even corporate access to financial services at the same time they're using their systems to spam. Computer ‘phishing’ is no less a crime than bank robbery, home invasion, and mugging.

Cyber criminals consider cyber crime to be a virtually riskless offense; they're unlikely to be identified; if identified, they're unlikely to be investigated; if investigated, they're unlikely to be charged and prosecuted; if prosecuted, they're unlikely to be convicted; if convicted, they're unlikely to do jail time.

The courts need to make it clear that that's wrong in all respects. If you commit cyber crimes, you will be identified, investigated, charged, prosecuted, convicted and sentenced to serious time and we will seize your assets.

This will not happen so long as crime, which involves the Internet, is dismissed as "cybercrime" and either scoffed at, or used to justify ever-increasing cyberwarfare budgets

This isn't just email. This isn't a war. This isn't "cyber.” This is crime. It is time to call a cop, and expect a response.

 

by CAUCE Executives J.D. Falk & Neil Schwartzman

Who Are Domain Names For?

Last week, the Libyan government seized and disabled Violet Blue's "sex-positive" vb.ly URL shortener. I've discussed URL shorteners before, but what does Libya have to do with it?

Actually, that part's pretty simple. The .LY domain belongs to Libya, so their laws apply -- even if the registrant or their web site isn't physically in Libya. The company which manages registrations in .LY decided to permit registrations by companies or people outside of Libya, but they still own it.

Originally there were only a handful of "global" or "generic" top-level domains, known as gTLDs, available to anyone in any country: .COM, .NET, .ORG, and .EDU. .GOV and .MIL were effectively only for the United States. .INT, reserved for organizations created by international treaty, is rarely seen.

Each country has their own ccTLD, based on the ISO two-letter country codes. Some are fairly obvious to English speakers: .US for the United States, .CA for Canada, .UK for the United Kingdom, .AU for Australia. Some seem a bit more obscure, due to differences in language or conflicts with other names: .TD for Chad, .RS for Serbia, or .ZA for South Africa.

Each ccTLD authority sets their own rules for who is allowed to register one of their names. Island nations Tongo (.TO) and Tuvalu (.TV) have reportedly made some pretty good money by permitting non-local registrations. After splitting from Yugoslavia (.YU) and Serbia, Montenegro opened .ME in hopes of attracting English speakers -- and sold over 320,000 domains between 2008 and 2010. Colombia's .CO, which attracts typos of .COM, sold half a million in two months -- mostly to registrants in the United States.

But none of this addresses the real question: what do actual users care about?

In March the most popular search term on Google, Yahoo!, and Bing was "facebook". Other top searches across all three, according to Experian Hitwise, included youtube, myspace, craigslist, ebay, and gmail. Perhaps ironically, "google" was the second most popular search on Microsoft's Bing.

Does it matter whether Facebook is facebook.com, fb.me, facebook.ca, facebook.co.za, et cetera? Well, unfortunately, it kind of does. If a bad guy registered facebook.ql (which is just an example, there's no .QL ccTLD), then they could put up a site that mimics the real Facebook, and send phishing email which might have a better chance of fooling users than the usual nonsense domains. And, of course, there are the usual trademark issues. So, Facebook has had to register in all of these.

To put it another way: big brands are effectively required to register their trademark in every gTLD and ccTLD they can, because most users are completely unaware of gTLDs and ccTLDs. If the TLDs effectively separated different types of organizations, as was originally imagined, then this wouldn't be necessary.

There's also another type of user to consider. Violet Blue chose to register vb.ly because she wanted something short and easy to remember, and was following the trend set by bit.ly, jl.ly, et cetera. Unlike .ME or .TV the value wasn't that vb.ly has any particular meaning, but rather that it's short and appeared to be easy. URL shorteners are for the people who don't type "facebook" into google, and do want to share links to specific things. Of course, if web designers considered the length of URLs when designing their sites, this wouldn't be as much of an issue.

ICANN, the quasi-non-governmental organization which oversees these top-level domains, has introduced quite a few other gTLDs in recent years. Many of these are restricted in some fashion, which helps to reduce the land rush; for example, .MUSEUM is only for museums, though of course most museums already have domains under .ORG, .EDU, .GOV, or an appropriate ccTLD.

Only two of the newer gTLDs are unrestricted: .INFO, and (for most purposes), .BIZ. When was the last time you saw a company put their primary site in .BIZ or .INFO, rather than having it be a redirect to their site in .COM? Oh hey, it was Return Path -- and we switched a few years ago to returnpath.net, because most of our neighbors in .BIZ were spammers or phishers. .INFO has the same spam problem; some spam filtering software sees the mere presence of .BIZ or .INFO as increasing the likelihood that a message is spam.

Ignoring these concerns, ICANN has decided to open up the namespace further and permit pretty much anyone with $185,000 and a bunch of nameservers to register their own gTLD -- likely before next March. It's unclear if anyone actually wants this except the potential new gTLD registries, who stand to earn a lot of money over trademark concerns. For example, the .CO registry initially offered a "Specially Protected Marks" program, permitting companies to register their trademarks ahead of the general populace. .CO claims "100% Participation by Leading Brands", and any new unrestricted gTLDs can surely expect the same.

Even if a company creates a new gTLD for their own use, such as .IBM, they'll still need to keep ibm.com, lotus.com, et cetera -- everything they have now, plus the same trademarks in every other gTLD.

Once all that dust has settled, and the registries and ICANN have made their money, we'll still be left with an ever-greater threat of phishing or other brand hijacking. Most end users will still expect to find their friends by typing "facebook" into google, while a smaller number will still want shorter URLs.

If domain names are for end users -- if, indeed, the internet is for end users -- then why do we need more TLDs?

(This article was originally published on The Received: Blog, and has been reproduced here with permission from from Return Path.)

Omnibus Cybersecurity Bill May Not Go Where Original Authors Intended

Image via Wikipedia

In an interview with GovInfoSecurity, Sen. Thomas Carper said that the U.S. Senate is considering attaching cybersecurity legislation to a defense authorizations bill.  Though clearly a ploy to be able to say "we did something about those evil hackers" before the elections, CAUCE applauds the attempt.  There can be no doubt that the United States (and many other countries) sorely needs better laws to deal with these threats.

Further, Senate Majority Leader Harry Reid has asked that the cybersecurity bills currently in front of various committees be combined into one single, omnibus bill, which would presumably then be attached to the defense authorizations bill.  Here's where we start to get worried.

Each of the bills we've seen (and we surely haven't seen them all yet) have some good points, and some...let's just call them unintended consequences.  In every case it's obvious that the authors' intentions were good, but they needed some expert advice from people who understand the technical and legal realities of the internet today.

One such expert, a long-time CAUCE supporter who asked to remain anonymous, shares his review of one of those bills: S. 3742, the "Data Security and Breach Notification Act of 2010."  You can read the original and check its current status here.

Please note that this is not legal advice.  Our expert is not a lawyer, I'm not a lawyer, and CAUCE did not consult with any lawyers before publishing this article.

Our expert says it's going to be difficult to construct a single good omnibus cybersecurity bill. The bigger and more complicated it gets, the less likely it is that anyone will actually read the bill before voting on it — particularly when they're in a hurry to go home and win an election.

He highlights a few specific items which could be troublesome for just about anyone running a mail server, a web site, or other online services which collect or transit any information:

• Page 2, Section 2 (a)(2)(A): More or less everyone's going to need to have personally identifiable information (PII) security policies
• Page 3, Section 2 (a)(2)(B): ... and an information security officer
• Page 3, Section 2 (a)(2)(C): ... and a process for monitoring for PII breaches
• Page 3, Section 2 (a)(2)(D): ... and a process for mitigating PII vulnerabilities
• Page 3, Section 2 (a)(2)(E): ... and a process for securely deleting electronic records containing PII
• Page 4, Section 2 (a)(2)(F): ... and a process for securely destroying paper and other non-electronic records containing PII
• Page 4, Section 2 (b): If you're an "information broker" (which would include nearly anyone who collects information and shares it with anyone else), you have additional obligations, including needing to submit policies to the FTC, needing to provide consumer access to information, tracking access to information maintained by the broker, etc.
• Page 13, Section 3 (a)(1): Requires notification solely to US citizens and residents in the event of a breach. Of course, that presumes you know the nationality/immigration status of those whose PII data you hold (hmm, I don't think *anyone* I know does, except for HR departments with regard to their own employees). If I were a covered entity, I'd be strongly inclined to begin soliciting that information from everyone I get PII data from, although of course that may trigger a whole different set of issues, particularly in areas where immigration related issues are a hot button topic.
• Page 14, Section 3 (b)(2): Notification by a service provider triggers reporting requirements. This is going to make LOTS of friends for service providers, given the affirmative notification and credit protection obligations that customers accrue after being notified.
• Page 19, Section 3 (d)(2)(A): Alternative notification is available for incidents involving LESS than 1,000 individuals. This is goofy.
  Normally alternative notification is allowed as an option when the number of covered individuals is very LARGE not very small. For example, some state laws permit alternative notification in cases where costs of providing notice would exceed a quarter million dollars, the affected class of consumers to be notified exceeds 350,000, or the notifying party doesn't have sufficient contact information to provide notice.
  There's language on page 22 of the draft bill that may allow regulatory additions to expand when substitute notification is permissible, but the basics for when substitute notification should be permissible should be part of the core statute, not an after-the-fact, maybe-yes, maybe-no regulatory add on by the agency.
• Page 25, Section 3 (d)(2)(B): imposes compliance burdens on entities for a year before technical compliance guidance is available. Enforcement of the act should be held until the guidance envisioned by 3(d)(2)(B) is available, and realistically it will take probably an additional period after that for sites to deploy the recommended technology (new projects don't happen over night).
• Page 26, Section 3 (h): Potentially requires notification in polyglot languages. This can be a huge administrative PITA -- consider the "simple" case of the EU, where there are "only" 23 official languages (Bulgarian, Czech, Danish, Dutch, English, Estonian, Finnish, French, German, Greek, Hungarian, Irish, Italian, Latvian, Lithuanian, Maltese, Polish, Portugese, Romanian, Slovak, Slovene, Spanish and Swedish, plus (semi-official) Catalan, Galician, and Basque).
  This section could be potentially exceptionally burdensome if the FCC suddenly mandates that sites provide notification in multiple foreign languages (I could see an argument for requiring Spanish as well as English, but there are some communities in the United States where other languages are also very common).
• Page 28, Section 4 (b)(1): It seems unnecessarially combative to define all data security incidents as "unfair or deceptive acts or practices." Data security incidents are not typically something which a covered entity intentionally does, neither are such breaches typically "unfair" or "deceptive" in the same way that some TV or Internet huckster's "miracle" product or pyramid sales scheme might be.

The most persuasive argument in the other direction is probably that currently most states already have their own PII breach notification laws, and it can be a pain to try to stay in compliance with 46 different PII information security and breach notification statutes. So again, the intention is clearly good, but in practice...it needs some careful review.

So there are the results from one bill, examined by one expert.  He's one of the best minds in the cybersecurity community, yet he may still have missed something.  With legislation as important as this, smushing it all together and rushing to attach it to something unrelated is simply a bad idea.  This is a topic which requires careful thought, from multiple people who really do know what they're doing — and who can explain it to the Congressional staffers who will write the resulting bill, and then to the Senators and Representatives who will collectively make the decision.

Once that education has occurred, it should quickly become evident that while some of these bills do overlap, others do not.  Some will disagree.  Some simply contain bad ideas.  All of this has to be worked out.  Then, finally, it might make sense to combine them — not now, and not just because they all have the prefix "cyber" in the title somewhere.

 

Related articles by Zemanta

• Cybersecurity Tensions Between Public, Private Sector (informationweek.com)
• Former acting cybersecurity czar provides legislative summary of bills in 111th Congress (securityarchitecture.com)
• New Data Breach Legislation (thesecuritypub.com)
• Cybersecurity Regulations Pass House (informationweek.com)
• Federal Computer Week: Congress just doesn't see cybersecurity's sex appeal (boxofmeat.net)
• Omnibus bills subvert our legislative process (theglobeandmail.com)
• Ad trade group spent $250,000 lobbying in 2Q (seattletimes.nwsource.com)
• ID Thefts Go Unreported Despite Notification Laws (informationweek.com)

This Decade in Spam: 2009

In 2009, Sanford Wallace was sued under CAN-SPAM by Facebook. The BBC controlled a botnet. Canada introduced serious anti-spam legislation, which didn't make it through the legislative process. Alan Ralsky pled guilty and went to prison with his co-conspirators. ISP Pricewert was taken down by the FTC for hosting botnet controllers, MEGA-D takes a hit as a result. Fireye took down the remnants later in the year. Habitat UK spammed Twitter using Iranian election hash tags. James Gordon lost his case against Virtumundo. Herbal King spammers Lance and Shane Atkinson are fined under New Zealand, Australian and American anti-spam law. Vodafone was fined for spamming for Coca-cola. ASIS lost its CAN-SPAM case against AzoogleAds. The Anti-phishing Working Group said that phishing was up 600% over 2008

January 2009

Google was ranked the 'Third Worst Spam Provider' by Spamhaus.

Australian Communications and Media Authority (ACMA) fined Australian firm Optus $110,000 for mobile phone spamming. They had also successfully sued DC Marketing the previous year.

The decline of spam after the Atrivo and McColo take-downs was a temporary respite. Spam slammed back up 150% in the two months following their 'demise'

Messagelabs noted that financial scam spam lept in numbers early in the year.

Taiwan's National Communications Commission drafts 'Regulations of Unsolicited Commercial E-mails'. The draft includes private right of action and stipulated damages.

Soon-to-be-convicted spammer Lance Anderson has a cure for spam: "If you don't want to receive spam, don't connect to the internet, or don't have an email address." Later in the year, law enforcement from New Zealand, America, and Australia had a solution to spam Atkinson sent.

February 2009
Google's Gmail has a massive false positive problem for a few hours, filtering everything to bulk. Spam problem solved!

KnujOn names Xinnet.com, a Chinese registrar, linked to more than 3 million spam messages between June 2008 and January 2009 as the worst on the net.

The house of the state of Virginia approved changes to the anti-spam law to address the constitutionality issues.

Sanford Wallace, Adam Arzoomanian, and Scott Shaw face charges brought under CAN-SPAM by Facebook. Wallace and Walt Rines had been found guilty of spamming MySpace users the year previous, and fined $230,000,000.

March 2009
The U.S. Federal Bureau of Investigation applied for a search warrant to do forensic analysis of the computers seized from Josh Holly in late 2008. Holly had hacked the MySpace administrative control panel, and used celebrity email and MySpace accounts to spam, earning himself $100,000.

The Security and Exchange Commission settled with Jonathan Randall Curshen (the case was initiated 2003).

The U.S. Supreme Court declined to consider the Virginia Attorney General's petition for a writ of certiorari to review the decision of the Supreme Court of  Virginia deeming the anti-spam law unconstitutional.

Click, a BBC television show, rented a botnet. Some felt that the BBC broke the British Computer Misuse Act by doing so.

American Brendan Paul Battles now of Browns Bay, New Zealand and Image Marketing Ltd (co-owned by Battles, Tan Chor Thien and Walter Scheer) were linked to mobile phone spam.

Darrel T. Uselton and his uncle Jack E. Uselton settled pump & dump charges with the U.S. Securities and Exchange Commission, disgorging $2,800,000.

April 2009
U.S. Senators Olympia Snowe and Bill Nelson introduced the m-Spam Act to strengthen the FCC and FTC's powers to fight mobile phone spamming.

The Conservative Government of Canada introduced bill C-27 into the House of Commons.

Amir Ahmad Shah, 28, of St. Louis, Missouri, his brother, Osmaan Ahmad Shah, 25, of Columbia, Missouri; Liu Guang Ming, a citizen of China; and Paul Zucker, 55, of Wayne, New Jersey are charged by the U.S. Department of Justice under CAN-SPAM for scheme where they stole and then spammed 8,000,000 student email addresses at colleges and universities.

June 2009
Sanford Wallace faced jail-time for ignoring an injunction to stop spamming Facebook

ISP Pricewert was unplugged by the FTC after suspected intrusions into NASA, and being behind numerous spam campaigns. Botnets Pushdo and Mega-D take a hit, spam from them dropped off significantly.

Chinese mobile phone firms limited the number of text messages that can be sent from phones. A mobile number cannot send more than 200 messages per hour or 1,000 per day on weekdays, and on holidays, the limits are 500 messages per hour and 2,000 per day under new rules.

According to Gary Warner, director of research in computer forensics at the University of Alabama at Birmingham, Chinese domains accounted for 70% of all TLDs seen in spam in the first part of 2009. This is apparently due to the availability of bullet-proof hosting in China. eName and Xin Net Technology (previously noted by KnujOn) are named in his report.

Alan Ralsky joined the rest of his co-defendants and pled guilty to stock manipulation charges

British Furniture store Habitat UK intentionally misused Twitter hashtags related to the Iranian elections. They apologized.

July 2009
Microsoft filed suit against Hong Kong-based Funmobile and its US subsidiary Mobilefundster. They allegedly held phished sites sporting spam payloads.

A survey by MAAWG reveals that 30% of consumers polled admit to responding to spam email.

David S. Patton, 49, of Centreville, Virginia, pled guilty for creating a botnet as his part of the Alan Ralsky stock spam scheme.

Evidence showing the links between Canadian Pharmacy and the Storm botnet grew.

MXLogic was acquired by McAfee for $140,000,000.

August 2009
Yahoo! researchers arrived at the same conclusion as Bill Gates did years previous with Penny Black, but they called it 'CentMail' wherein people would be charged for email sent.

Twitter is taken offline by a DDoS. The attack was against one Twitter user, Cyxymu
http://www.theregister.co.uk/2009/08/10/twitter_hack_fallout/print.html

The Ninth US Circuit Court of Appeals upheld a lower court rulings that James S. Gordon Jr. lacked standing to sue Virtumundo Inc. under CAN-SPAM nor the Washington state anti-spam laws.

A spate of rogue Facebook apps looked to steal user login account information.

September 2009
Alton in Hampshire, United Kingdom, takes first place as the most-spammed city in Britain, from former 'winner' Alton, according to Symantec Messagelabs. Colin Wells of Dawlish, Devon, is Britain's 'most spammed man', receiving millions of spam yearly.

Hong Kong complained that it is under siege from botnets.

October 2009
Google said the level of spam they dealt with daily makes the Storm botnet look 'small'.

The Bredolab was released in an attempt to re-grow the Cutwail botnet.

Mobilegate Ltd and Winning Bid Pty Ltd., and Simon Anthony Owen, Tarek Andreas Salcedo and Glenn Christopher Maughan are found guilty of mobile phone text spamming in Australia. They are fined $15,000,000.

November 2009
Alan M. Ralsky, from West Bloomfield, Michigan., Ralsky's son-in-law Scott Bradley, also from West Bloomfield, Michigan,  John S. Bown, from Fresno, California, and How Wai John Hui, a resident of Hong Kong and Canada were sentenced to prison for their involvement in a stock fraud spam scheme.

Shane Atkinson was fined $71,870, Roland Smits was fined $35,915, and Lance Atkinson fined $71,870 in Australia for their part in the Herbal King spam ring.

FireEye took down the Mega-D botnet. 264,784 unique IP addresses were related to the botnet, each capable of sending 15,000 spam per hour

The Australian Communications and Media Authority (ACMA) accepted enforceable undertakings from three companies - Vodafone, New Dialogue and Big Mobile for mobile phone text spam on behalf of Coca-Cola. Vodafone was fined $110,000.

The Korea Communications Commission cut the total number of mobile phone texts each user could send per day to 500.

Spam containing shortened URLs spiked, trashing yet another useful service on the net.

Lance Atkinson is ordered to pay $15,200,000 under the FTC's CAN-SPAM suit against him.

Harvard Law School and Harvard Faculty of Arts and Sciences email is marked as spam by Google's Gmail.

The CAN-SPAM case against Epic Advertising and AzoogleAds filed by ISP ASIS failed, because ASIS could not prove economic damages.

The Anti-Phishing Working Group noted a 600% rise in phishing in 2009

December 2009
Cisco's annual security report noted that social networks were where criminals focused their attention in 2009

Messagelabs predicted the rise of self-healing botnets in 2010.

U.S. attorneys Julie Beck and Christopher Graveline, of the United States Attorney’s Office — Eastern District of Michigan, were honored for their prosecution of Alan Ralsky

ECPA, Canada's anti-spam bill C-27, died on the vine when the Canadian parliament was prorogated.

This Decade in Spam: 2007

Scott Richter made the news again in 2007, MySpace sued him for phishing and spamming their members. The U.S. Securities and Exchange Commission became active in shutting down pump & dump spamming organizations. Several major companies, including the Bank of America and Pfizer were found to be hosting zombie computers. Physician, heal thyself. New Zealand, Hong Kong and Singapore adopted anti-spam legislation. Penis pill pusher DM Contact Management settled their class-action lawsuit. Robert Soloway was arrested for spamming and a raft of other crimes. Mark Mumma lost his case against Cruise.com and the defendant is awarded $2,500,000 in damages. Jeremy Jaynes appealed his conviction. Canadian Xavier Ratelle was the first person charged under the U.S. Safe Web Act.

January 2007
Cisco bought IronPort (including SpamCop and SenderBase) for $830,000,000

The infamous 'hitman' spam circulated; a hitman threatens recipients will be killed unless they pay an extortion fee. Thus far, no-one has reportedly turned up dead.

Jeffrey Brett Goodin is found guilty of phishing AOL users under CAN-SPAM, faces 101 years in prison. Goodin was also convicted of 10 other counts, including wire fraud, misuse of the AOL trademark and attempted witness harassment.

The Storm virus was released, it infects 8% of all users within weeks.

MySpace sued Scott Richter for spamming and phishing under CAN-SPAM and California statutes.

Sophos found that in 2006, the United States at 34.2% of all sites containing malicious code, China hosted 31%.

South Korea arrested two un-named men for spamming and phishing

South Korea arrested a man identified only as 'Park' for spamming, he faces 3 years in prison and $31,000 in fines if convicted.

IBM warned of the emergence of the "exploits-as-a service" industry as cybercriminals organize into sophisticated malware manufacturing and distribution networks.

February 2007
OPTA won a spam case in The Netherlands, an unnamed man is fined $97,000.

Joshua Eveloff, 27, of Carter Lake, Iowa admits to spamming. He faces three years in prison and a maximum fine of $250,000 for the crime, under CAN-SPAM. His partner, Michael Twombly, of Cardiff also plead guilty.

The Singapore anti-spam law went to Parliament.

Verizon Wireless won $200,000 in damages from Specialized Programming and Marketer, and its owner Charles Henderson.

The New Zealand Unsolicited Electronic Messages Act was passed by legislature.

Jeffrey Horton of Colorado won a class action lawsuit against DM Contact Management Ltd., a British Columbia corporation, Leading Edge Marketing Inc., a British Columbia corporation, Advanced Botanicals, Ltd., a British Columbia Corporation, Leading Edge Marketing Inc., a Bahamas corporation Leading Edge Marketing Inc., a Cyprus company,  Leading Edge Marketing Inc., a dissolved Colorado corporation, Technhpak, Llc, a Colorado limited liability company, and Unipay Processing, Ltd., a Cyprus company and Geoffrey M. Mackay, Andrew A. Mackay, Douglas R. Mackay, Mark D. Scheidt, Matthew Clayton, and Warren S. Brander. The penis enlargement pills sold through DM Contact Management, VigRX, apparently do not work as advertised.

March 2007
Gordon Dick of Edinburgh Scotland won £750 in damages and £616.66 for legal costs against British firm Transcom in Edinburgh's Sheriff Court.

The Securities and Exchange Commission suspended trading for 35 companies engaged in pump & dump spam. As well, they froze the assets of phishers inflating stocks by way of breached user accounts at E-Trade, Charles Schwab, TD Ameritrade, Scottrade, Vanguard Brokerage Services, Fidelity Investments and Merrill Lynch

Support Intelligence found that major companies such as Bank of America, Toshiba, AIG, and Business Week are hosting zombie computers on their networks.

April 2007
The New Zealand Unsolicited Electronic Messages Act came into force.

Australia's Telstra BigPond blocks gmail servers due to spam
http://www.brisbanetimes.com.au/news/security/telstra-google-in-spam-spat/2007/04/10/1175971083629.html

Singapore anti-spam law passed the vote in Parliament.

The Securities and Exchange Commission suspended trading of Amerossi EC, Irwin Resources and Peopleline Telecom, 3 companies that trade on the Pink sheets, as part of a crackdown on suspected pump-and-dump trading schemes.

Project Honey Pot, a service of Unspam Technologies LLC filed a major lawsuit on behalf of their users against address harvesters.

May 2007
The Internet Engineering Task Force gave preliminary approval to DomainKeys Identified Mail (DKIM).

Hong Kong implemented The Unsolicited Electronic Messages Ordinance. The maximum penalty for spamming offenses is a fine up to 1 million HK dollars and imprisonment up to five years.

Google purchased anti-spam/anti-virus technology company GreenBorder Technologies Inc.

Robert Alan Soloway is arrested in Seattle and he and his company, Newport Internet Marketing charged with mail fraud, identity theft, fraud and money laundering,  He is facing up to 65 years in prison and a fine of $250,000.

MySpace settled with The Globe.com Inc. and won $5,500,000 in damages.

ClearMyMail said Talk Talk is the most spammed UK ISP.

Omega World Travel, and its subsidiary Cruise.com won the case filed against them by Mark Mumma and are awarded $2,500,000 in damages.

A class action suit was filed against TD Ameritrade Holding alleging company knew of a data breach for over a year.

June 2007
Spamhaus SURBL and URIBL were DDoSed

China launched an anti-spam website run by the Internet Society of China, iscbl.anti-spam.cn with black and whitelists of servers

Robert Soloway is denied bail
http://www.seattlepi.com/local/319682_spamking14.html

The U.S. District Court for the District of Arizona in Phoenix convicted Jeffrey A. Kilbride, 41, of Venice, California, and James R. Schaffer, 41, of Paradise Valley, Arizona, under CAN-SPAM.

Omega World Travel and Cruise.com see damages owed to them by Mark Mumma reduced to $330,000.

The Srizbi trojan was launched.

July 2007

A trojan called Trojan.Spammer.HotLan.A was released. The malware creates Hotmail and Yahoo! accounts used to send spam.

The FTC held The Spam Summit Workshop

Darrel Uselton and his uncle, Jack Uselton were charged by the U.S. Securities and Exchange Commission with fraud related to spammed pump & dump promotions. $4,200,000 is seized .

Law firm Azar & Associates' Barracuda appliance blocked e-mail from the United States District Court for the District of Colorado including a notification of a court date which the firm missed. They were ordered ordered to pay attorney fees and expenses incurred by the lawyers who showed up representing the other side of the case.

SpammerX published "Inside the Spam Cartel: Trade Secrets from the Dark Side".

Anti-spammer Patrick Peterson of Ironport was interviewed in Forbes.

Google acquired Postini.

August 2007

Nicholas Tombros of Venice California was sentenced to three years' probation and six months' home detention for spamming over open WIFI networks.

The biggest pump & dump spam run ever spiked volume by 445%.

September 2007
New Zealand's Unsolicited Electronic Messages (UEM) Act 2007 came into force.

Support Intelligence found Pfizer computers were compromised, and spamming illicit Viagra offers, for half a year.

Jeremy Jaynes appealed his conviction on the basis of free speech making the law unconstitutional.

Four months after a class-action lawsuit is filed over the incident, and apparently a year after they knew, TD Ameritrade admitted they were hacked, and had 6,000,000 email addresses stolen.

ISP Onetel's email service was unavailable for over a month due to spam attack on its 30,000 users.

October 2007
The U.S. Securities and Exchange Commission suspended trading in three stocks, Alliance Transcription Services, Prime Petroleum Group and T.W. Christian,  for being "susceptible" to pump & dump scams.

The FTC filed charges under CAN-SPAM against Bruce Parker and Lisa Kimsey dba Spear Systems, Inc., and Canadian Xavier Ratelle dba eHealthylife.com. The action is the first brought by the agency under the U.S. Safe Web Act.

Jeffrey A. Kilbride of Venice, California, and James R. Schaffer of Paradise Valley, Arizona were sentenced to 72 months and 63 months respectively in prison for spamming pornography, conspiracy, money laundering, fraud and transportation of obscene materials. They also forfeited $1,300,000.

A keylogger was spammed using fake FTC graphics and a sending address.

MP3 spams were the hot new thing, after PDFs and Microsoft Word files began being filtered.

November 2007
A restraining order was issued against Sili Neutraceuticals dba Kaycon Ltd. and Brian McDaid when they were charged by the FTC under CAN-SPAM

Todd Moeller of New Jersey was sentenced to 27 months in prison for his part of a spam scheme that he ran with Adam Vitale of New York, hitting 1,200,000 AOL users.

Washington state Judge Judith Eiler ruled that spam is "personal e-mail" exempt from anti-spam laws if it’s written in a style that suggests familiarity with the recipient.

Spam Arrest won their five-year trademark case against Hormel, and the right to use 'spam' in their name.

December 2007
Adteractive Inc. settled with the FTC, paying $650,000 for deceptive spam

Colorado considered tougher anti-spam laws.

Min Kim of Colorado was sentenced to 30 months in prison for violating the CAN-SPAM act.

A court determined that spam is not illegal in Israel.

The New Zealand Department of Internal Affairs carried out anti-spam raids in Christchurch, seizing 22 computers that were part of an international spamming operation.

http://www.nzherald.co.nz/email/news/article.cfm?c_id=188&objectid=10483539

This Decade in Spam: 2006

Spam grows 143% in 2006. Christopher 'Rizler' Smith threatens to kill a witness in his trial, Alan Ralsky partner Daniel Lin pleads guilty. Datran Media settles a lawsuit filed against them over what is called "the largest deliberate breach of Internet privacy discovered by U.S. authorities". Goodmail stuns California  senators, Blue Frog hops off into the sunset, pump & dump is discovered to increase stock prices. Sanford Wallace is fined for distributing spyware, AOL wants to dig up some turf. e360 Insight wins its case against The Spamhaus Project. Australia wins against Wayne Mansfield.

January 2006
Despite predictions, spam not dead. "We all maybe cringed a little bit when Bill (Gates) made that statement" said Ryan Hamlin, who heads anti-spam activities for Microsoft as general manager for Technology Care and Safety.

Postini claims between 2005 and 2006, the number of unsolicited e-mails increased 147 percent, and drew a map to prove it.

The Email Sender and Provider Coalition, American Advertising Federation, American Association of Advertising Agencies, Association of National Advertisers Inc., Electronic Frontier Foundation and the Center for Democracy & Technology file an amicus brief regarding the Utah Child Protection Registry Act

CIS Internet Services owner Robert Kramer III was awarded $11,200,000,000 in damages in his case against James McCalla of Florida, who is also barred from accessing the Internet for three years. For those keeping track, Kramer has a net worth of over 12 billion dollars. Strangely, he does not make it on the Forbes list.

Daniel J. Lin pleads guilty to 3 felony counts related to spamming for his part in the Alan Ralsky spam gang. He is fined $20,000, and handed a sentence of between 2 years and 57 months.

Hong Kong begins public consultations on the proposed opt-out Unsolicited Electronic Messages Bill

The Chinese Ministry of Information announced China will introduce anti-spam legislation in March, 2006.

Ironport's SenderBase adds URL tracking and Web reputation data filtering to the e-mail traffic monitoring network

Jeanson Ancheta pleads guilty U.S. District Court in Los Angeles to four felony charges for crimes that include infecting machines at two U.S. military sites with botnets. His plea agreement says he must serve four to six years in prison, forfeit a 1993 BMW and more than $58,000 in profit. He must also pay restitution of $19,000 US to the U.S. federal government for infecting the military computers.

Paul E. Burke, Wendy Burke, Seth T. Traub, Zhijian Chen, Manoj Kumar and Gary T. Preston are sued by the Washington state's attorney general for spamming and the dissemination of spyware on behalf of their company Secure Computer. This is the first case filed under state anti-spyware law.

A Maryland court determines that out-of-staters are liable to state anti-spam law. The case against Joseph M. Frevola and First Choice Internet Inc. moves forward.

Christopher William 'Rizler' Smith is found guilty under CAN-SPAM and ordered to pay $5,300,000 and $287,000 to AOL. His troubles are not over, as he is found to have attempted to have one of the prosecution witnesses killed, and is charged with that crime in March 2006.

February 2006
Outsourced 'Managed Service' style anti-spam filtering companies are the hot new thing MessageLabs, FrontBridge, Postini, BrightMail and MX Logic battle in the space.

Canadian Dale Begg-Smith is known as 'The Spam Man' in Australia. He remains uncharged for the activities.

Dutch police arrest a dozen Nigerians for sending 419 spam. The U.S. began extradition procedures for four of the principals.

AOL launches an $18 million lawsuit against 18 un-named phishers under the new Virginia law.

AOL announces it will begin charging legitimate businesses to send commercial e-mail to its users, by way of Goodmail Systems. The certified e-mail system would require advertisers to pay $2 to $3 per 1,000 messages. Yahoo! announces they too will be using Goodmail System's product for inbound commercial email.

Not everyone is in favour of the idea.

"It's taxation of the good guys with cash, and it does nothing to help the good guys who can't afford the cost or to deter the bad guys who spam anyway," says Matt Blumberg, CEO of Return Path, an e-mail services company.

"Baloney," says AOL's Nick Graham, scoffing at suggestions the e-mail system amounts to taxation. "That's competitive chatter and sour grapes."

March 2006
The Electronic Frontier Foundation launches DearAOL.com, a petition & website to convince AOL to kibosh the plan to use Goodmail Systems. AOL remains unconvinced, but agrees to let non-profit groups send email to them for free

Malware writers begin targeting developing nations because their computers are easy to infect.

Jennifer R. Clason of New Hampshire pled guilty to spam-related charges under CAN-SPAM in connection with a pornographic e-mail operation. Hers was the third-ever such conviction. Clason agreed to forfeit money obtained through the crimes and faced a maximum penalty of five years in prison for each of the offenses. The related trial of Jeffrey A. Kilbride and James R. Schaffer would take place in June 2006

China issued new spam regulations requiring a subject line tag, 'AD', for ISPs to register their IPs, and for them to retain logs for 60 days. It was noted that it was unclear what China considered to be illegal messages.

Microsoft calls for provisions for private right of action in Australia, under what the Australian Internet Industry Association the "toughest anti-spam legislation in the world".

Jumpstart Technologies LLC dba FreeFlixTix are found guilty under CAN-SPAM and fined $900,000 in a case filed by the FTC.

The New Zealand Communications Minister says international agreements are needed to effectively fight spam.

Datran Media agrees to a $1,100,000 settlement with New York state attorney general Eliot Spitzer in what is called "the largest deliberate breach of Internet privacy  discovered by U.S. authorities."

Datran explained their actions by noting "Datran never received financial data and never sent e-mails regarding discount price drugs and that although 6 million e-mails are involved, that doesn't represent 6 million people."

April, 2006
The FTC closes down third-party affiliate spammers Qing Kuang “Rick” Yang, and Peonie Pui Ting Chen, and wins fines of $2,400,000 against their companies Optin Global and Vision Media. They are also forced to disgorge $475,000 in spam-related profits.

A California Senate committee is stunned that Goodmail Systems Inc. is not designed to stop spam

At the second annual Email Authentication Summit Microsoft tried to drum up support for Sender ID. Gartner analyst Arabella Hallawell thinks that "DKIM has the most potential" among the email authentication schemes available.

Asia becomes the single largest source of spam according to Sophos.

Researchers Thorsten Holz and Rainer Böhme find that pump & dump stock spam work; the price of stock actually does increase, briefly.

May 2006
Blue Security's Blue Frog 'DDOS the spammers' service, created in July 2005, is allegedly threatened by a Russian spammer. BS then shut their doors saying they wish to avoid "an ever-escalating cyber war through our continued operations". The project goes open source, renamed Black Frog's Okopipi, and never heard from again.

The Australian Communications and Media Authority (ACMA) launched a downloadable spam button.

A day in the life of Matt Sergeant of Messagelabs (and CAUCE Board Member) published in the New York Times in a two part series.

The Kodak Imaging Network (formerly Ofoto) is fined an undisclosed amount under CAN-SPAM by the Federal Trade Commission.

Sanford Wallace is fined $4,089,500 for distributing spyware.

June 2006
Anti-spam vendor Vanquish and the Email Accountability Initiative come up with Bonded Sender, years after Ironport

Convicted under CAN-SPAM and fined by the Texas attorney general for $10,000,000 (and also by Microsoft), spammer Ryan Pitylak wants to become an anti-spammer.

Pitylak Security with no Alexa rank and last updated April 10, 2008, specializes in
Ryan Pitylak Viral Marketing
Ryan Pitylak Marketing Success
Ryan Pitylak Search Engine Optimization
and
Ryan Pitylak Demand Generation

French European MP Alain Lamassoure floats the idea of an email tax. The idea goes nowhere.

NetBop Technologies wins the right to use the word spam in the anti-spam product name 'bopspam', to which Hormel objected, on the basis of copyright. Hormel subsequently failed in an attempt to register Europe-wide trademarks asserting its right over the term "spam".

3 un-named men, forming the hacker group m00p, are arrested for releasing worms online. A 63 year old from England, a 28 year old from Scotland and a 19 year old from Finland. Discussion ensues as to the origin of the name, Seinfeld or Southpark.

Oh, noooo, I'm so sorry. It's the MOOPS. The correct answer is, 'the MOOPS'.

July 2006
The Australian Communications and Media Authority (ACMA) announces that an addendum to the Australian 2003 Spam Act, a code of practice for Internet and email service providers comes into force.

Major League Baseball sells sponsorship of their all-star game voting to Monster.com. Voters are signed up to Monster.

Porn spam gets 280 times more action than other types, according to CipherTrust

Image spam becomes a serious problem according to anti-spam filter vendors. Spammers without access to Photoshop use Microsoft Word, instead.

Hong Kong's draft anti-spam law has provision for prison terms of up to ten years for spammers.

August 2006
A spam claiming to hold the truth behind the JFK assassination makes the rounds. So does a Skype / sypware phishing spam.

AOL wants the right to do some landscaping at Davis Wolfgang Hawke's parents house. To satisfy their win of $12,800,000 in fines against Hawke, they want to go looking, with a bulldozer, for some gold and platinum bars he allegedly buried under their lawn.

China fines their first spammer, a company in Shenzhen, $714 under the new state law.

Mocbot, a spam proxy Trojan, begins to spread.

McAfee SiteAdvisor is deployed.

September 2006
Jeremy Jaynes' conviction and sentence of nine years under Virginia state law is upheld. The defense indicate they intend to appeal again.

Robert McAllister, CEO of Millennium National Events Inc. is charged with fraud. The defendant claims the prosecution is politically motivated, under orders from Karl Rove and George W. Bush, because he spammed anti-Bush emails. The claim is dismissed.

OPTA, the Dutch Independent Regulator of Post and Telecommunications, and ACMA, the Australian Communications and Media Authority cooperate in a bust of an Australian viagra spammer. The spammer apparently rented servers in The Netherlands to send the spam.

The Federal Trade Commission wins $400,000 in fines against Cleverlink Trading Ltd. and $151,000 against Zachary Kinion for violating CAN-SPAM.

Earthlink wins $11,000,000 under CAN-SPAM against KSTM.

e360 Insight wins against The Spamhaus Project who is ordered to pay $11,700,000 in damages. Spamhaus indicates they will continue to list e360 on the SBL, noting the Illinois court has no jurisdiction over the U.K.-based organization. e360 Insight requests the judge demand ICANN suspend The Spamhaus Project's domain spamhaus.org. The judge refuses to do so.

Botnets come of age, according to Pat Peterson of Ironport, who tracks spam runs coming from 100,000 hijacked home computers spread across 119 nations that land at 1,500 different payload sites.

Earthlink uncovers a phishing ring, Michael Dolan of North Miami Beach, Florida Charlie Blount Jr., of Branford, Connecticut, Keith Riedel of Winter Haven, Florida, Richard D'Andrea of West Haven, Connecticut, Thomas Taylor Jr. of West Haven, Connecticut and Daniel Mascia of West Haven, Connecticut are charged under the scheme.

October, 2006
Brian Michael McMullen, 22, of East Pittsburgh, Pennsylvania is sentenced to three years supervised release, five months home detention and ordered to pay restitution in the amount of $11,848.55 for violating CAN-SPAM.

The Federal Court of Australia fined Clarity1 $3,400,000 and its director Wayne Mansfield $760,000 for sending unsolicited e-mails in the first conviction under Australia's Spam Act of 2003.

November 2006
Spam levels reach new levels, between 89% and 97% of all email sent, up 143%  over the year previous. Ironport estimates 62,000,000,000 spam are sent daily and 85,000,000,000 are seen in one two-day period. The spike is attributed to 'durable botnets' facilitated by software like SpamThru.

In response, the OECD creates the StopSpamAlliance.org, along with the Asia-Pacific Economic Co-operation (APEC), the EU Contact Network for Spam enforcement Authorities (CNSA), the International Telecommunication Union (ITU), the London Action Plan for Spam Enforcement (LAP), and the Seoul-Melbourne MoU, and The European Commission called upon governments to be 'more active'. The ITU suggested even more international cooperation.

The FTC charged Yesmail Inc., doing business as @Once Corporation, with sending e-mail on behalf of its clients more than 10 business days after recipients had asked it to stop. Yesmail and the FTC settled the charges for $50,717.

December 2006
ORDB ceases operations as open relays are no longer being used to send spam.

Canada’s Voxbox World Telecom Inc. is seen in a pump & dump spam scam. Pink Sheets executives do nothing to address the issue.

Microsoft wins a summary judgment in the U.K. against Paul Martin McDonald and Bizads to prevent him from selling lists of Hotmail email addresses.

This Decade in Spam: 2005

2005 saw Scott Richter file bankruptcy to avoid paying fines, Alan Ralsky arrested, and CAN-SPAM evaluated for renovations. AOL gave away gold. Spammer gold.

January 2005
Earthlink wins their CAN-SPAM lawsuit against Damon DeCrescenzo and David Burstyn

Pump & Dump stock spam becomes very popular.

'97 per cent of unsolicited commercial email failed to comply with CAN-SPAM' - MX Logic CTO Scott Chasin, the law 'a miserable failure'

The Federal Trade Commission (FTC) issued final regulations for those who wish to comply with CAN-SPAM.

Sanford Wallace promised to send spam and spyware (only to people who visit his Web sites).

The Federal Trade Commission files first-ever suit under CAN-SPAM 'sexually explicit' provisions against Global Net Solutions, Open Space Enterprises, Southlake Group, WTFRC dba Reflected Networks and Global Net Ventures.

Sunbelt Software began to provide anti-spyware services to anti-spam service Cloudmark.

Texas files a CAN-SPAM lawsuit against Ryan Samuel Pitylak, Mark Stephen Trotter PayPerAction, Leadplex LLC and Leadplex

Jeffrey Lee Parson sentenced to 18 months prison for writing Blaster worm

870,000 mobile spamming cases reported to the Korea Information Security Agency (KISA). The spam affects 95.8 users in Korea.

Verizon blocks email from Europe and Asia due to high levels of spam originating from the regions.

Yahoo & Google work with Six Apart and WordPress to attenuate blog comment spam

Georgia Slam Spam E-Mail Act proposes to make spam a felony. Earthlink likes the idea.

February 2005
Microsoft wins $1,2000,000 judgment against Levon Gillespie.

Spamming software SendSafe begins to use ISP's outbound email servers to send spam.

The Center for Excellence in Service of the University of Maryland's Robert H. Smith School of Business and Rockbridge Associates says spam costs $21.58 billion in lost productivity, annually.

Former AOL engineer Jason Smathers pleads guilty to stealing information of 30,000,000 AOL users. The man he sold the data to, Sean Dunaway of Las Vegas, was yet to be charged.

Austria, Belgium, Cyprus, the Czech Republic, Denmark, France, Greece, Ireland, Italy, Lithuania, Malta, the Netherlands and Spain agree to work together to fight spam.

Microsoft and Pfizer file a CAN-SPAM lawsuit against the CanadianPharmacy and E-Pharmacy Direct.

Earthlink files a CAN-SPAM lawsuit against Christina Reese, Angela Nickerson, and YamboCS Inc.

Accused child kidnapper and rapist Ronald Scelson, aka the "Cajun Spammer," 'can't beat Postini filters', hands our business cards.

U.S. Attorney charges Anthony Greco of New York under CAN-SPAM with sending IM spam via MySpace.

The U.K. Office of Fair Trade announced a 48-hour crackdown on spam in partnership with the International Consumer Protection Enforcement Network and signatories to the anti-spam London Action Plan (LAP).

The Hong Kong Secretary for Commerce, Industry and Technology announced a new anti-spam initiative

The EU's 25 member states and 13 Asian partner countries agreed to boost legal tools to fight spam

March 2005
Jeremy Jaynes' sister, Jessica DeGroot's conviction for spamming over-turned

German mobile telephone operator Debitel fined 2,000,000 kroner for spamming competitor Danish mobile phone company Telmore.

The Japan E-mail Anti-abuse Group created.

Spam and phishing up in latter half of 2004, botnets down - Symantec

Scott Richter's Optinrealbig.com files for bankruptcy

IMDB deploys FairUCE, challenge-response issued to email with SPF failures.

April 2005
Microsoft files CAN-SPAM lawsuit against Scott Filary and Donald Townsend

Carsales.com.au loses first case filed under Australian anti-spam law, fined $6,600 AUS

Australia ends up back on the top 12 list of worldwide spam sources

The Federal Trade Commission's Deborah Platt Majoras thinks spam might be on the decline.

Jeremy Jaynes sentenced to nine years in prison for spamming. He remains free on a bond pending an appeal

The Federal Trade Commission files a CAN-SPAM lawsuit against Optin Global dba Vision Media Limited for spamming mortgage, car warranty and college degree offers.

Andrew Kantor, columnist on the CNN website, thinks spam will die out by itself.

Earthlink begins to require SMPT-AUTH

Spamhaus says U.K. anti-spam laws are useless

ISP Hypertouch files under CAN-SPAM against Kraft Foods Inc. for Gevalia coffee spam.

Hong Kong signs the Multilateral Memorandum of Understanding on Cooperation in Countering Spam with other Asia-Pacific signatories.

Return Path purchases Bonded Sender from Ironport. The deal comes just 10 months after Return Path's last acquisition, that of email list management provider NetCreations.

May 2005
AOL treats emergency e-mails as spam. No word on fate of Harvard admission emails.

UK ISP Telewest (aka Blueyonder) listed on SPEWS DNSBL for inordinate amounts of zombie computers. Telwest doesn't notice.

Massachusetts, helped by Microsoft, files a CAN-SPAM lawsuit against Leo Kuvayev, 2K Services Ltd., and ECash Pay Ltd. Also charged were Vladislav Khokholkov, Anna Orlova, Pavel Tkachuk, Michelle Marco, Dennis Nartikoev, and Pavel Yashin

Sober.q spams in support of ultra-right German political party

CAUCE gives CAN-SPAM a D- grade

18 months after CAN-SPAM comes into force, the Federal Trade Commission begins public consultation on improving the law.


The Federal Trade Commission and 35 government partners from more than 20 countries launch 'Operation Spam Zombies', suggesting ISPs close port 25, and sandbox zombie infected user computers.

The Federal Trade Commission files a CAN-SPAM lawsuit against Cleverlink Trading, Real World Media, Brian Muir, Jesse Goldberg and Caleb Wolf Wickman.

Developing countries suffer from spam disproportionately, according to the OECD

June 2005
The Canadian Task Force on Spam issues its final report noting the need for anti-spam laws in Canada.

HerbalKing Lance Atkinson and Jody Smith, Inet Ventures, Tango Pay, Click Fusion and TwoBucks Trading charged under CAN-SPAM

DomainKeys Identified Mail, borrowing elements from Yahoo's Domainkeys and Cisco's Internet Identified Mail system announced.

Borobt-Gen trojan announces Michael Jackson suicide.

State media in China announce Hong Kong will crack down on spam

Creaghan A. Harry agrees to turn over 10% of his ill-gotten gains to the Federal Trade Commission via $485,000 fine

Trend Micro buys Kelkea and MAPS. Unofficially known as the day the music is buried.

Hotmail releases its Smart Network Data Services

Wayne Mansfield charged under the Australian anti-spam act. He notes he made a staggering amount of money spamming.

Craig Spiezle, director of Microsoft's technology care and safety team, believes Hotmail should require Sender ID on all inbound email. The Internet disagrees "They will end up isolating and destroying their own mail services".

Joe Wagner & Hypertouch continue to rack up the CAN-SPAM cases, filing against Discover Financial Services, Link It Software, diploma mill Kennedy-Western University  and Stamps.com

Peter Moshou pleads guilty to a civil lawsuit filed by Earthlink. An article also notes that Nicholas Tombros was the first criminal conviction under the federal CAN-SPAM law. Moshou faces 3 years in prison and a fine of $250,000.

Microsoft Sender ID alliance a failure - Washington Post MX Logic says 'spammers the most likely participants in SPF and Sender ID deployment'

AOL, Yahoo! Microsoft and Earthlink discuss DKIM vs. Sender ID. Again.

The Chinese government joins the London Action Plan. Again.

Michigan and Utah Child Protection registry and 'do not email' laws come into effect.

July 2005
Christopher 'The Rizler' Smith arrested by the Federal Bureau of Investigations (FBI) for spamming; Burnsville Internet and Xpress Pharmacy Direct shut down.

Blue Security's Blue Frog software released, warns spammers to 'stop it'. if they don't Blue Frog launches a denial of service attack against them.

BangBros.com (fined $650,000), APC Entertainment (fined $220,000), MD Media (fined $238,743) Pure Marketing Solutions and Matrix Technology (fined $50,000) reach settlements with the Federal Trade Commission over their spamming activities

The U.S. Department of Justice indicates it is filing CAN-SPAM suits against TJ Web Productions Cyberheat and Impulse Media

Scott Richter is taken off the ROSKO list

422 new vulnerabilities were discovered in the second quarter of 2005 - SANS

Opt-in New Zealand legislation Unsolicited Electronic Messages Bill begins final deliberations in legislature.

The Virginia State anti-phishing law came into force

July 2005
Microsoft and Scott Richter settle their lawsuit for a full settlement of $7,000,000. Microsoft’s senior vice president and general counsel, Brad Smith notes “Because of this litigation, Mr. Richter has fundamentally changed his practices and forfeited ill-gotten gains. Microsoft looks forward to a permanent change in Mr. Richter’s practices.” Mr. Richter was subsequently sued by MySpace for spamming and phishing in 2008.

AOL raffles $20,000 in gold bars, a 2003 Hummer H2 and $75,000 in cash it seized from spammer Brad Bournival. He had purchased the email lists stolen by Jason Smathers, for $28,000. Smathers is sentenced to 15 months in prison. One million people enter the sweepstakes, 53-year-old welder Marc Daniels wins the prizes.

Florida considers criminal provisions for proposed anti-spam law.

Scott Levine and Snipermail.com charged with stealing data from Acxiom. Six employees plead guilty.

Three charged, one pleads guilty in first CAN-SPAM case on 'sexually explicit' tagging. Jennifer Clason, Jeffrey Kilbride and James Schaffer sent spam via The Netherlands.

Vardan Vardanovich Kushnir, a spammer targeting Russians, is found murdered in his Moscow apartment.

September 2005
Verizon Wireless files CAN-SPAM suit against Intelligent Alternatives of San Diego, California, and Resort Marketing Trends of Coral Springs, Florida.

Irish firm 4’s a Fortune becomes first win with Irish anti-spam law, fined 1,500 euro + 1,000 euro court costs. a Fortune is "Irelands first online casino-like cash game".

Spamhaus believes Yahoo! supports online scams.

The Infocomm Development Authority of Singapore (IDA) and the Attorney-General's Chambers release draft anti-spam legislation for public consultation.

Sender reputation is first mentioned in the popular press.

An Arizona court makes cell-phone spam a crime

October 2005
Mobile networks seen to be vulnerable to denial of service attack by spam

Anti-spyware bills abound in U.S. congress WhenU (a company that surreptitiously install software on user computers) CEO Avi Naider supports a federal law.

Leo Kuvayev's websites ordered shut down, fined $37,000,000 under CAN-SPAM. CAUCE notes 'CAN-SPAM has not had a visible effect on the amount of spam on the Internet'.

U.K. citizen Peter 'Weaselboy' Francis-Macrae arrested for spam, fraud, and threatening to kill police officers

Alan M. Ralsky and Scott Bradley arrested by the Federal Bureau of Investigation (FBI) for spamming

30% of UK firms found to 'ignore spam laws'

Anthony Greco sentenced for spamming MySpace users via IM. The sentence is under seal.

The Direct Marketing Association requires its members to adopt email authentication (DKIM or Sender ID). Either one. or both. Whatever.

Microsoft identifies 13 different spamming operations using botnets. Microsoft tests an infected zombie PC; it sends 18 million e-mail messages over 5 million different connections. In three weeks.

Dutch botnet herders controlling 1,500,000 computers arrested, not named.

Asia called the 'Spam Factory of the World' by Business Week magazine.

November, 2005
The Zlob trojan is released into the wild

Jared Cosgrave and Mohammed Haque charged with CAN-SPAM violations by the Federal Bureau of Investigations (FBI).

Dutch enforcement agency OPTA wins case against unidentified drug spammer, fine set at $97,000 for sending 9,000,000,000 spam eamils.

U.K. Office of Fair Trade warns UK company Dropshippers from selling on lists of 3 million bogus 'opt-in' email addresses to potential spammers on its website. They comply.

Pfizer launches anti-Viagra-spam radio campaign in Holland.

Peter 'Weaselboy' Francis-Macrae jailed for six years in U.K. for spam scams

U.K. residents David Levi and Guy Levi are sentenced to four years and 23 months in prison respectively for phishing eBay

Verizon Wireless files CAN-SPAM suit against Passport Holidays

December 2005
Pump & Dump spam complaints to the U.S. Securities and Exchange Commission double in 2005

Scott J. Filary and Donald E. Townsend issued an permanent injunction and fined $50,000 for spamming

Scottish government admits their anti-spam laws are weak Sean Connery makes no comment.

New Zealand anti-spam legislation nears adoption

The Federal Trade Commission (FTC) claims, but fails to prove, CAN-SPAM effectiveness. Anti-spammers skeptical of any positive claims.

The Australian Communications and Media Authority forces ISPs to attack spam; they must proactively scan traffic for open relays and botnets, networks of compromised PCs used for sending spam. In addition, spam filters must be offered and clearly advertised by each Australian ISP.

White Buffalo Ventures, dba LonghornSingles.com fails in bid to force the University of Texas to allow them to spam their users.

Billy W. Williams charged with spamming under CAN-SPAM.

Florida gubernatorial candidate Charlie Crist accused of spamming in support of his campaign. 'It's not spam, its free speech' his campaign manager claims.

China 'cracks down on cell-phone spam' by requiring prepaid cell-phone subscribers to register their devices using their real names.

New Zealand ISP Telstra's Clear service slowed to a crawl due to spam.