CAUCE

FBI Agent Thomas X. Grasso Receives First J.D. Falk Award

News Release

For Immediate Release        

FBI Agent Thomas X. Grasso Receives First J.D. Falk Award
for Establishing DNS Changer Working Group and Protecting End-Users

Baltimore, Maryland, Oct. 25, 2012 – Convincing competitors, disparate business entities and researchers to collaborate – many donating their services and resources – to protect millions of end-users worldwide is no small feat. Yet FBI Supervisory Special Agent Thomas X. Grasso did just that by quietly working behind the scenes to create the DNS Changer Working Group that saved an inestimable number of end-users from losing access to the Web over the last two years.  Recognizing his leadership, Grasso received the inaugural J.D. Falk award on Tuesday at the Messaging, Malware and Mobile Anti-Abuse Working Group 26^th General Meeting in Baltimore.

 

The first-annual J.D. Falk Award

“Tom embodies the kind of personal sense of responsibility and accountability that built the Internet and is vital to its future growth.  First, he had the foresight to understand the problem and to realize that something could be done to prevent it.  Then it took an enormous commitment of his time and energy to muster the resources and bring dissimilar entities together to accomplish an objective that turned out to be a critical issue for many end-users,” said M³AAWG Co-Chairman Chris Roosenraad.

 

Grasso created the ad hoc committee based on the relationships and goodwill he had developed over his 12 years working with the Internet industry.  He persuaded large corporations to commit time and funds to notify infected customers, and convinced anti-virus vendors, Internet Service Providers and the security research community to cooperate in the project.  DCWG members include Georgia Tech, Internet Systems Consortium, Mandiant, National Cyber-Forensics and Training Alliance, Neustar, Spamhaus, Team Cymru, Trend Micro and others.

In November 2011, the FBI’s Operation Ghost Click led to the arrest of six Estonians allegedly behind the distribution of the DNS Changer malware and thought to be operating the illicit Rove Digital advertising network. The malware hijacked Internet searches and re-routed Web browsers of infected computers to fraudulent sites on Rove Digital’s network by altering the DNS settings the computers use to locate websites. Once the rogue servers were turned off, the malware-infected computers that had their settings redirected to them would not have been able to reach the Web.  

The DNS Changer Working Group was Grasso’s idea to encourage end-user remediation of the malware and to respond to the massive challenge of potentially millions of users losing access to the Web. The group helped monitor the DNS servers that were now legally operated by the Internet Systems Consortium (ISC) under a court order, and as a result, the infected users received a useful message to clean up their machines instead of suddenly dropping off the Internet. 

“The FBI recognizes the invaluable assistance the private sector and academia provided through the DNS Changer Working Group,” said Joseph M. Demarest, assistant director of the FBI’s Cyber Division.

CAUCE founding member J.D. Falk, an active member of M³AAWG and many other industry organizations, was passionate about safeguarding the Internet, end-user security and the impact of cooperative endeavors. The award named after him recognizes individuals for specific achievements that enhance the Internet experience, protect end-users, and embody his spirit of volunteerism and community building. It is administered by M³AAWG with the support of Falk’s employer Return Path Inc. and the Falk family.

MAAWG Honors Internet Volunteer Neil Schwartzman With First MAAWG Mary Litynski Award

News Release

For Immediate Release        

 

MAAWG Honors Internet Volunteer Neil Schwartzman

With First MAAWG Mary Litynski Award

San Francisco, June 16, 2011 – Recognizing the value of one person’s effort to generate positive change in the messaging industry, the Messaging Anti-Abuse Working Group presented its first annual MAAWG Mary Litynski Award to Neil Schwartzman at its 22^nd general meeting on June 8 in San Francisco.  The award acknowledged Schwartzman’s extensive volunteer efforts working against spam for the last twenty years, and the presentation can be viewed on the MAAWG YouTube channel at http://www.youtube.com/MAAWG?feature=mhee

A messaging compliance consultant, Schwartzman has served on the Canadian Federal Task Force on Spam and is a founding member and currently executive director of CAUCE, the Coalition Against Unsolicited Commercial Email, an international all-volunteer consumer advocacy organization working to defend the interests of the average Internet user.  He is secretary of the MAAWG Public Policy Committee and involved in several of the association’s other projects, and is active in other industry organizations including the London Action Plan (LAP) and the Anti-Phishing Working Group (APWG).  Schwartzman also worked toward the passage of the new Canada Anti-Spam Law (CASL).

“Neil reminds us that backing down from the challenge of messaging abuse is not an option for those committed to maintaining an open and effective Internet.  He brings energy and expertise to our community, with a passion and concern that rises above his own personal interests,” MAAWG Chairman Michael O’Reirdan said.

According to Schwartzman, “Industry collaboration is the only way, to my mind, that we can effectively deal with spam. There is no silver bullet. A unified strategy involving cross-sector industrial cooperation, technologists and public policy advisors – providing a seat at the table for all stakeholders – is the proven way forward.”

The award was named for Mary Litynski, who worked tirelessly to serve MAAWG members since the organization’s founding in 2004 and who passed away in 2010 after a courageous battle with cancer.  The honor was initiated in her memory this year to recognize an unsung industry hero who also works behind the scenes to make the Internet a safer place for all.

About the Messaging Anti-Abuse Working Group (MAAWG)

The Messaging Anti-Abuse Working Group (MAAWG) is where the messaging industry comes together to work against spam, viruses, denial-of-service attacks and other online exploitation. MAAWG (www.maawg.org) represents more than one billion mailboxes from some of the largest network operators worldwide. It is the only organization addressing messaging abuse holistically by systematically engaging all aspects of the problem, including technology, industry collaboration and public policy. MAAWG leverages the depth and experience of its global membership to tackle abuse on existing networks and new emerging services. It also works to educate global policy makers on the technical and operational issues related to online abuse and messaging. Headquartered in San Francisco, Calif., MAAWG is an open forum driven by market needs and supported by major network operators and messaging providers.

#  #  #

 

Media Contact: Linda Marcus, APR, 714-974-6356, lmarcus@astra.cc, Astra Communications

MAAWG Board of Directors: AOL; AT&T (NYSE: T); Cloudmark, Inc.; Comcast (NASDAQ: CMCSA); Cox Communications; Facebook; France Telecom (NYSE and Euronext: FTE); Openwave Systems (NASDAQ: OPWV); PayPal; Return Path; Tata Communications (NYSE: TCL); Time Warner Cable; Verizon Communications; and Yahoo! Inc.

MAAWG Full Members: 1&1 Internet AG; Adaptive Mobile Security LTD; Apple Inc.; Cisco Systems, Inc.; Constant Contact (CTCT); Edatis; e-Dialog; Eloqua; Email Sender and Provider Coalition; Experian CheetahMail; Genius.com; Internet Initiative Japan, (IIJ NASDAQ: IIJI); McAfee Inc.; Message Systems; Scality; Spamhaus; Sprint; Symantec; Trend Micro, Inc.; and YouSendIt.

A complete member list is available at http://www.maawg.org/about/roster

CAUCE Director Neil Schwartzman Wins Prestigious MAAWG Award

CAUCE Executive Director Neil Schwartzman won the prestigious Mary Litynski award on June 08, 2011 for his contributions to Internet anti-abuse efforts, including the passage of Canada's Anti-Spam Law. Here is his acceptance speech.

This is not the first award I've received from the MAAWG community. A few years ago, at a meeting in Washington, D.C., I received an honorary doctorate when recognized me as Dr. Evil. At the past meeting, at Disney, you honored me with a t-shirt branding me as Grumpy, from the Seven Dwarves.

As much as I treasure those memories, this award is very special to me.

Mary Lytinski was a warm, helpful, friendly person. It is nice to see that MAAWG is applying these criteria when deciding a suitable winner of the award in her name.

Seeing Mary at the registration desk was our opening ritual three times a year, and her greeting -- no matter how busy -- told every attendee that this was going to be a good meeting. Mary's contribution to our community and our cause cannot be measured.

I can’t begin to express my gratitude for this award, named in honor of our old friend; I am profoundly humbled, particularly when we consider the roster of others in our community undeniably as deserving of recognition.

My contributions to the Internet community, like that of so many others, began as a volunteer. To some, that might be a puzzling thing, to do something without financial recompense. To others, most in this room, it is the most natural thing of all.

There are a number of reasons why I try to embody a spirit of volunteerism. For one, my mother volunteered her time throughout her life. She undoubtedly passed this aspect on to me.

When I got online in 1992, the net was largely non-commercial. There was no world wide web. It was all about text, and community spirit, and volunteered contributions. Even when employees of a commercial entity worked on standards or software, it was with humility and a sense of collaboration, of building the Internet together.

The commercialization of the net has brought with it some astounding, wonderful new technologies and contributions to our global society. I am able to write to my friend, one of the happiest people I’ve ever met, a peasant girl named Shandy, who lives in rural China, because she has a Hotmail account. A far-flung community was able to express our love and support for our friend and colleague J.D. Falk, by way of Facebook, and email, and AOL Instant Messaging. Perhaps most profoundly, an offshoot of Google, 23andme, allowed me to reconcile with my biological mother, sister and brother, this past weekend after 50 years.

These are the things that motivate me to voluntarily advocate for the anti-abuse community. Because along with all these commercial offerings, there is still a fundamental, precious human element, a drawing together of the global village that criminals, if we let them, would rend asunder. There is still real, honest human communication -- that abusers sully. This human element is the magic intrinsic to the Internet, and something that must be protected. It isn’t just about email systems being spammed, and websites under ddos. It is what they represent -- the people, the data, and the ability to communicate -- that we strive to protect.

The DNA of the Internet, the vast majority of underlying technologies and protocols, were dreamt up and realized by volunteers. Grassroots, volunteer anti-abuse efforts such as my organization, CAUCE, many of the DNSBLs, discussion groups -- all manner of efforts to stave off the wolves at the door, nearly all done on a voluntary basis or as a contribution to the community.

And then there’s MAAWG.

While most of us are paid to be here, involvement in MAAWG can take up a tremendous amount of time. It often encroaches into one’s personal life, or one’s ability to accomplish the balance of our paid work, in effect, MAAWG is very much run by people volunteering of their time, expertise and brilliance.

And so, I accept this award on behalf of all the volunteers past, present and future, my peers and my betters, with the hopes that our work is properly honouring the person for whom this award is named, our dear departed Mary Litynski.

Thank you.

Submission to ICANN WHOIS Team review

 

CAUCE North America
PO Box 727
Trumansburg NY 14886
E-Mail: secretary@cauce.org

13. Apr. 2011

ICANN
by electronic mail

We appreciate the chance to comment on the ICANN WHOIS Review Team Plan as announced at http://www.icann.org/en/announcements/announcement-04mar11-en.htm

CAUCE NA, as an all-volunteer Internet end-user advocacy organization established in 1998 has moved beyond its original narrow mission of encouraging the creation and  adoption of anti-spam laws to a broader stance of defending the interests of individual Internet users.  CAUCE NA is led by a combined Board with a cumulative century of experience in the field of Internet advocacy and technology.

Based on that experience, including experience directly engaging with ICANN in a variety of capacities, we would like to offer the following comments on your proposed whois policy review activities.

1. Whois Is A Critical Anti-Abuse Resource

Combatting Internet abuse without access to whois data would, in most cases, be difficult if not impossible. To paraphrase a common cliché, IP addresses and domains don't attack Internet assets, people attack Internet assets. We cannot pierce the veil and map IP addresses and domain names to those people without routine access to the crucial information whois data contains.

If whois were to cease to be routinely available, targets of serious Internet abuse will have no alternative but to employ lengthy legal process to compel disclosure of resource assignment and allocation information. This process is cumbersome, time-consuming and expensive, and benefits no one except the attorneys who will be involved in pressing or defending these actions, and the miscreants who will enjoy weeks, months, sometimes even years of anonymity in which to continue to conduct their abuse with impunity. This abuse happens at internet speed; a slow response is effectively no response at all.

2. Whois Needs To Be A True Production Service Offering

Currently whois is offered on something of a "hobbyist" basis, particularly in TLDs that use the “thin” whois model. At one provider it will use one format, while at other times and at other providers, it will use another. This lack of consistent formatting, along with restrictive access policies, makes whois access something that's only suitable for small scale interactive "craft" access rather than being a production-ready and robust service that's appropriate for the volume of domains and other resources involved in today's domain name ecosystem.

If Internet abusers can script the creation of domains at arbitrary scale, but security teams and anti-abuse researchers are limited to some small number of manual whois queries per day, the abusers can obviously simply out-automate and out-scale us. This enforced handicap represents bad public policy.

Other technical ways that whois data access can and should be improved include:

• Whois data should be available via authenticated channels (or in a standardized bulk format) so that legitimate uses aren't thwarted by restrictive rate limits. (Authenticated access can and should be logged and audited to ensure that abuse is not occuring)

• Whois data should be structured in a consistent, standard format amenable to machine parsing. We believe that the tag:value form used by thick whois servers meets this requirement, so long as they continue to use a restricted and consistent tag vocabulary, and the definitions of each tag are available to the public — perhaps as an IETF RFC.

• Whois data should be aggregated and distributed from a central location using the “thick” model, rather than being distributed across hundreds or thousands of providers on a distributed "thin" model. This ensures both consistency and availability.

3. Whois Is a Community Resource

While law enforcement officers play a critical role in mitigating online crime, they are too few in number and too poorly funded to mitigate all online abuse. Much online abuse is handled by other entities, ranging from non-sworn government administrative agencies (such as the Federal Trade Commission here in the United States), to non-governmental organizations such as CAUCE NA or Spamhaus, to agents of aggrieved private parties seeking to protect their company's assets (including facilities, trademarks and intellectual property being used online in illegal ways).

If whois access were narrowly restricted to sworn law enforcement officers only, the "thin blue line" of law enforcement, important though it may be, will not be sufficient to maintain the status quo. The security and stability of the Internet will be negatively impacted, with an associated loss of public trust and transparency.

That said, we would not object if sworn law enforcement officers or civil investigators were offered expanded access to whois data, such as a routine ability to view an unfiltered version of whois data that is not encumbered by obfuscating private or proxy registration mechanisms — provided such access is authenticated, logged and audited to protect against arbitrary abuse and misuse.

4. Whois Data Must Be Meaningful

We have seen examples of whois data services that are present in name, but effectively of no value. For example, consider the data for chase-online-banking.com:

Domain: chase-online-banking.com
Registrar: Eurodns S.A.

Registrant:
Company:
Name: I P Freely
Address: 123 blowme lane
City: tacoma
Country: UNITED STATES
Postal Code: 98409

 

Administrative Contact:
Company:
Name: I P Freely
Address: 123 blowme lane
City: tacoma
Country: UNITED STATES
Postal Code: 98409
Phone: +012589636541
Fax:
Email: maiybs@gma.com

Technical Contact:
Company:
Name: I P Freely
Address: 123 blowme lane
City: tacoma
Country: UNITED STATES
Postal Code: 98409
Phone: +012589636541
Fax:
Email: maiybs@gma.com

Original Creation Date: 2011-04-04
Expiration Date: 2012-04-03

Status:
clientTransferProhibited

This entire WHOIS entry is transparently fraudulent. There is no “blowme lane” in Tacoma WA, no North American phone number starts with 01, and even if the zero were corrected as a typo, there is no 258 area code. The e-mail address is invalid, and even the simplest attempt to send a confirmation message would have revealed that mail to it is rejected.

If we see abuse involving that domain, which we have, there is no way to find an appropriate security or abuse contact.

It is nominally whois data, but it provides no information whatsoever about who or what that domain actually is. This shows what whois can devolve to, if we as a community allow it to degrade without objection.

We acknowledge that whois data, like any data, can potentially be abused. Not all whois data is equally at risk, however. For instance, we do not believe that an entity engaged in Internet commerce should have the same right to anonymity online that a political or religious dissident might require, and in fact, the customers of the Internet have a compelling right to know with whom they're doing business. We therefore urge ICANN to eliminate whois anonymity as an option for corporations and other non-natural persons controlling Internet resources.

5. Improvements To WDPRS and Whois Accuracy

When missing or inaccurate whois information is detected, users have the option of reporting that inaccuracy via the Whois Data Problem Reporting System (http://wdprs.internic.net/).

Unfortunately that system is operationally cumbersome, requiring domain-by-domain reporting via a web form, followed by email confirmations, even in cases where hundreds or thousands of domains share the same inaccuracies and the same registrar.

We understand that ICANN has a bulk WDPRS submission facility currently used by only a small number of high-volume reporters. That service should be made available, with suitable registration or other safeguards to deter abuse, to any entity submitting multiple WDPRS reports.

We also believe that the information WDPRS receives is not being appropriately leveraged to identify and address ongoing abuse. While WDPRS complaints may result in the correction of individual erroneous whois records, ICANN does not use that data to identify systematic problems, including potentially rogue ("bulletproof") registrars who make no effort at maintaining accurate whois data whatsoever — and may even treat whois inaccuracy and other violations of ICANN's rules as a competitive advantage.

Moreover, why is ICANN not sharing the substance of the community WDPRS reports it receives with community stakeholders? If there was more transparency about the reports received, consumer confidence in whois data accuracy would improve and we could even imagine a "PhishTank"-like model where community members could help to verify the reports that have been made via WDPRS.

We also believe that the costs associated with correcting erroneous whois data, particularly in the case of grossly and obviously inaccurate whois data, should be passed along to the registrar that has allowed that data to be accepted. Even the simplest of automated screening would easily allow many bogus point of contact data elements to be flagged at the time of domain registration; other types of online businesses have been doing this for years. Currently some registrars do not care if they accept bogus whois point of contact data, but if there were financial consequences to large amounts of invalid WHOIS, that could change.

Registrars that exhibit a clear and ongoing pattern of routinely accepting or failing to correct obviously bogus whois information should be subject to notice and breach proceedings under the registration agreement.

6. Adequacy of the "Key Definitions"

The Review Team also asked for feedback on the adequacy of the definitions it proposed at http://www.icann.org/en/announcements/announcement-04mar11-en.htm

In our opinion, the following adjustments would strengthen those definitions.

As written, definition 4.1 (Law Enforcement) does not distinguish between sworn law enforcement officers with criminal law enforcement powers (such as sworn federal law enforcement officers, sworn state police officers, sworn county sheriffs, and sworn municipal police officers here in the United States), and other entities incidentally included in an overly broad definition, including judges, lawyers, prosecutors, private security officers, administrative investigators and even parking enforcement officers (so-called "meter maids") whose responsibilities include "maintenance, co-ordination, or enforcement of laws, multi-national treaty or government-imposed legal obligations."

We believe "law enforcement officers" should be defined more narrowly to be only those individuals who have:

1. been sworn or commissioned as a law enforcement officer by a government agency of competent authority;
2. who are charged with upholding the general criminal laws of  an applicable jurisdiction, including having power of arrest;
3. typically have received specialized peace officer training (e.g., here in the United States such courses are typically offered by the Federal Law Enforcement Training Center ("FLETEC") or a similar program offered by one of the individual states, such as as Oregon's Department of PublicSafety Standards and Training Academy ("the DPSST Academy");
4. and who normally receive tangible official signs of their role such as a police uniform or official credentials (a badge and/or ID card).

In adjusting this definition, we do not mean to imply that ICANN should exclude non-sworn government officials from the scope of its work -- even though those government officials are non-sworn, they play an important role in enforcing applicable law via civil processes. They simply require a different label (such as "civil enforcement officer" or "administrative enforcement agent").

For example, here in the United States, while FTC investigators are not sworn law enforcement officers, they play an important role in compelling fair business practices using the civil enforcement powers at their disposal. They're just "investigators" and not "law enforcement officers" within the customary meaning of that term of art.

We also believe that ICANN should explicitly consider whether "law enforcement" includes those who may be members of national intelligence services, or a country or multinational organization's military services, recognizing that in some countries (such as the United States), there may be as many as seventeen agencies and organizations involved in collecting and processing national security-related intelligence information (see http://www.intelligence.gov/about-the-intelligence-community/ ).

Definition 4.2 (Applicable Laws) appears to concentrate primarily on laws related to "the collection, use, access, and disclosure of personally identifiable information." That focus would be appropriate if whois policy issues turned solely on matters related to registrant privacy.

CAUCE NA believes that any whois study must recognize the applicability of all criminal and civil laws on whois policy, and the impact of whois policy on those laws in turn.

Such laws would include, but not be limited to:

• laws against child exploitation and online "child pornography"

• laws making it illegal to attempt to obtain financial information without authorization by means of deceit or artifice ("phishing")

• laws forbidding the creation and distribution of viruses and other malicious computer software

• laws prohibiting the online sale and distribution of narcotics and other controlled drugs

• laws forbidding the advertising and delivery of copyright and trademark infringing products such as "knock-off" watches and pirated software, music and movies

• laws forbidding fraudulent schemes such as advance fee fraud schemes, penny stock "pump-and-dump" scams, products making baseless promises of weight loss or body enhancement

• laws regulating the collection of email addresses and distribution of bulk commercial email

Only when personal privacy rights are weighed against the full set of criminal and civil laws designed to protect a jurisdiction's citizens, can we achieve an appropriate balance between protecting privacy and protecting citizen's property and persons from all applicable risks.

In many cases the protection of property and persons from malicious actors is best served by access to whois information, rather than by withholding that information from interested parties.

Thus, that balancing process requires a more inclusive definition of "applicable laws" in CAUCE's opinion.

Defintion 4.3 ("Producers and Maintainers of WHOIS DATA") comingles a variety of parties and roles in ways that fail to adequately recognize important differences in perspectives and interests. For example, 4.3.A, "Producers" is defined as "The individuals or organizations supplying contact data for inclusion into WHOIS data." While that's seemingly a simple entity -- typically the person registering a domain -- in reality, things are less clear.

For example, whois data producers may include:

• the true or ultimate registrant

• a proxy registrant acting on behalf of the true or ultimate registrant

• a registrar or hosting company, perhaps listed as a default "technical" point of contact for all domains they register on behalf of the true or ultimate registrant

• a registration services provider acting on behalf of a registrar as an independent contractor or as the registrar's agent

These roles may change over time as well. For example, an engineer who may have initially registered a domain on behalf of an employer may change roles or change employers, yet still be carried on a registration as the point of contact for that domain, simply because the relevant data has never been verified and updated.

We might attempt to clarify all this by referring to an "initial producer" of whois data, or a "primary producer" of whois data, or a whois data "producer of record," depending on our emphasis, but any of those titles are only an approximation given the actual underlying practice.

We are also confused by the definition of "Data Controllers," particularly the trailing sentence fragment: "May or may not be directly involved in these functions." While that tautologically covers all possible cases, and in fact all persons, it does little to illuminate what's intended in this case, and is so overly inclusive as to render the definition of "Data Controllers" effectively meaningless.

More substantively, the sundry roles lumped into the "definition" of "Data Controllers" should be explicitly teased apart unless there is some compelling reason to throw them all into the same vague stew. Those who may work in the IETF to define the whois protocol (thus defining what data may be collected), have little to do with those who may work in ICANN to "govern" how that data may be used, or the judges who may "require its release." Don't lump them all together.

7. Determining The Extent to Which Whois Policy Is Effective, and Meets the "Legitimate Needs of Law Enforcement," and Assessing The Extent to Which "Consumer Trust" Is Being Promoted

Finally, we are not persuaded that the articulated program of work will substantively meet the defined purposes of:

• assessing the extent to which WHOIS Policy is effective,

• meeting the legitimate needs of law enforcement, and

• promoting consumer trust.

If you have a grand program of work, but it doesn't meet those goals, you're wasting your time.

If ICANN wants to know these things, we recommend that it collect hard data on these topics using generally accepted technical market research and statistical methods. Simply asking for comments from the "usual suspects" (particularly when scant feedback is often provided) will not give a true understanding of what's happening in the real world.

Given the technical nature of the questions involved, ICANN should formally poll experts knowledgeable in the areas involved, as well as law enforcement agencies with officers who specialize in cyber crime, and organizations that represent consumer interests. This engagement needs to be proactive on ICANN's part, and not merely represent a willingness to listen to comments that may happen to trickle in from particularly motivated respondents who happen to comment.

Thank you for the opportunity to comment on this work, and we stand ready to address any points about which you may have questions or need further information.

Sincerely,

CAUCE North America

Facts & Tips for Consumers about the Epsilon Breach

Epsilon Interactive, who sends commercial email on behalf of hundreds of companies, admitted to a security breach that they detected some time in March. Epsilon and its parent company, Alliance Data, have posted two press releases about the breach.

• Epsilon Notifies Clients of Unauthorized Entry into Email System – April 01, 2011
• Alliance Data Provides Statement Surrounding Unauthorized Entry Incident at Epsilon Subsidiary - April 06, 2011

How many companies’ customers' email addresses were lost?

Epsilon has not revealed any statistics beyond ‘2% of our clients’, of which they reportedly have 2,500.

Journalists covering the story have collected notifications sent by about 70 companies, including many financial institutions. The names of these companies have been published at:

• Bank Info Security
• Krebs on Security

What information was lost?

Epsilon has stated that the names and email addresses of their clients' customers were taken. Presumably the attackers were also able to access the names of each client.

What does this mean for consumers?

If you received a notification from one of Epsilon's clients, the thieves know your name and email address.  Depending on which company had your information, the thieves may also be know the hotels you may stay at, which credit cards you may use, or where you buy stuff online. If your email address shows up on several of these lists, the criminals can draw together a pretty accurate profile of who you are, and what you typically do, and can guess your income level. Ironically, that is what companies like Epsilon do with the data, too.

Do the criminals have any more information about me?

While it's common for the contents of an email message to include more personal information than your name and email address, as far as we know, this information was not stolen. Often times, different data is stored in different places, and the thieves may have not been able to access the contents of previously sent messages. There is a pretty good explanation of the way these marketing databases generally work here

My address was lost in the Epsilon breach; CAUCE says the only way protect myself against phishing is to change my address. Isn't that is a rather extreme approach?

Sadly, it may not be extreme enough.  The Anti-Phishing Work Group reports that there are about 360,000 unique phishing sites, annually [2010].

Anti-virus software catches new malware about 20% of the time, leaving computer end-users exposed to a tremendous amount of viruses, keyloggers, and spyware, and other bad things. Anti-spam software does a pretty good job, getting well upwards of 90% of all spam, but some trickles through. We know that phishing attempts were successful at companies, ESPs, who were on high alert for the attempts.

While some phishing attempts are obvious, almost silly, others can be extremely difficult for end-users to recognize. Our friends at Word to the Wise took apart a legitimate email from an Epsilon client-company, and even email experts had a hard time determining if the email was real. See their article ‘Real. Or. Phish?’.

If your email was lost by a client company of Epsilon, we stand by our suggestion that changing your address is the best way to avoid receiving and having to deal with the phishing emails and other spam that will inevitably come from this data theft. Even if you don't want to abandon your current address entirely, this would be a good time to set up a new address and move your important communications there.

I unsubscribed from a customer list at Epsilon, and still received a notification from them. Isn’t this illegal?

It is arguably illegal under some laws, but it makes good sense that they did mail you. It doesn’t mean you weren’t unsubscribed. Here’s how it works: When you unsubscribe from an emailer’s list, they put your address into what they call a ‘suppression list’. The criminals presumably stole these too. The companies did the right thing by alerting you to the fact that your address was stolen.

How can I unsubscribe from everything at Epsilon?

Epsilon maintains a list of places where you can unsubscribe from a variety of their clients' newsletters.

We do not know if this will ensure that another of their clients will not upload your address to Epsilon in the future, and of course there are many other ESPs out there.

 Are the authorities involved? Can I sue someone?

Epsilon is reportedly working with the Secret Service, presumably because information related to bank and credit card clients was lost. Previously, some of the companies who were targets or victims of the previous series of breaches (which, again, may not be connected to the Epsilon incident) have been working with law enforcement.

The Australian Communications and Media Authority and Australian Privacy Commissioner are aware of the attack, having been alerted to it by Dell Australia, whose data was stolen. The breach may prompt an investigation by the UK Information Commissioner's Office, Connecticut Attorney General George Jepsen and Consumer Protection Commissioner William Rubenstein are investigating, and have written a letter to Attorney General of the United States asking him to investigate. Leaders of the House Energy and Commerce panel in the United States have written to the CEO of Alliance Data, Epsilon’s parent company, asking for more details on how many customers were affected and how the breach occurred.

You could try to sue someone: the company holding your data, or Epsilon, or both. There may be class action lawsuits coming out of this, as well as lawsuits by Epsilon’s client companies. If you do file with a class-action, you should not expect a large financial settlement, as these are generally quite small.

CAUCE suggests that if you live in a relevant jurisdiction, you can file a complaint with the local authorities about the breach:

• Australia (Australian Communications and Media Authority)
• Australia (Privacy Commissioner) 
• Canada (Office of the Privacy Commissioner of Canada)
• United States (Federal Trade Commission)
• United Kingdom (Information Commissioner's Office)

 If you have incurred a financial loss as a result of any phishing attack, or see suspicious activity on your bank account, contact your financial institution to alert them and report your credit card stolen immediately. Then, call your local and federal police forces to file a complaint (the bank will not do this for you).

BACKGROUNDER

How was the hack accomplished?

Epsilon has not released details about the mechanics of the breach. If it is similar to the hacking attempts targeted at ESPs last year, the hackers may have used social engineering and spear-phishing techniques, leading to an employee mistakenly typing their username and password into a web page controlled by the hacker.  However, at this time, we do not know what happened or whether there's any connection to the previous attacks.

Has Epsilon been hacked before?

Maybe. Epsilon has not publicly admitted to any previous attack, but their customer Walgreens has indicated that this is the second time they have lost data by way of Epsilon.

“After the incident last year, Walgreens requested that Epsilon put a number additional security measures in place. Apparently, that expectation was not fully met.” – Walgreen spokesperson, via databreaches.net

Is the Epsilon breach part of the previous series of attacks on the ESP industry?

These attacks appear to have begun as early as November 2009, the first victim being a company called aWeber.

Typically, the criminals would hack into an ESP by sending an employee an email that infected them with keylogger spyware, take over one of their client accounts, and send spam for fake Adobe or Skype software. More than a dozen different ESPs, including Epsilon, were targets or victims of these attacks in 2010.

It is impossible to say if this is the same as what happened to Epsilon more recently. Adobe or Skype spam was seen during previous breaches. This did not happen with the current breach with Walgreen or any other Epsilon customer.

This could have been the same group, using the same point of attack. It could have been a copycat using the same tactics, or an entirely different approach. We do not know, and there are too many variables for anyone to say they know definitively — though if Epsilon were to share what they know with the security community, it's likely that we could understand quite a bit more.

Did Epsilon have lax security?

We do not know what changes they made after their first breach, so it is impossible to say.

Were there things they could have done to improve security?

Obviously — they were hacked, after all. Epsilon will presumably address whatever let the hackers get into their systems this time, but any security professional will tell you that security is never perfect. What appears secure today may be exploited tomorrow.

There are many steps ESPs can take to much improve their security related to client lists and outbound email – we have listed them here

I heard that someone warned ESPs about breaches in November.

They did. Return Path provides services to ESPs, blogged about their own breach, and those at ESPs in November 2010. In fact, the ESP industry was becoming aware of this series of breaches all the way through 2010, as they were happening.

Security isn’t 100%? Why?

Software, and the way it interacts with various web applications is very complicated. Many sites do not, or cannot update all components that go into a web application, because to do so may break functionality on the site, or they are negligent. Home computers are pretty much the same. Microsoft, for example, issued 67 updates this past ‘Patch Tuesday’. Have you updated your computer?

Who is the real victim here?

You are. Epsilon suffered the initial attack. Their clients suffer as well, losing consumer trust. There may also be marketing or advertising agencies involved. But as far as CAUCE is concerned, the people who stand to suffer the most are the regular Internet users who trusted that the major brands whose products they enjoy would keep their email addresses and other personal information safe and secure. If these companies do not take immediate, public actions to prove that they deserve our trust, then they do not deserve our business.

Letter to Prime Minister Harper in Support of Bill C-27, the Electronic Commerce Protection Act

[ Sign the CAUCE online petition to support Canada's antispam bill C-27
http://www.ipetitions.com/petition/SupportC27/ ]

To: Stephen Harper HarpeS@parl.gc.ca

Cc: Party Leaders
Minister of Industry
Chair & Members, Standing Committee on Industry, Science & Technology


Dear Prime Minister Harper,

These past few weeks have seen a tremendous amount of press coverage with regard to Bill C-27 currently in from of the Standing Committee on Industry, Science & Technology.

We have seen parties previously supporting an opt-in régime in Canada, and publicly supporting the bill in the press and to the committee change their stance.

The Coalition Against Unsolicited Commercial Email, with 50,000 members has not: We encourage you and the committee to stand fast in this regard. An opt-out regime is what is made legal in America, by way of the CANSPAM act, and the United States is by far the main source of spam on the Internet today.

Backgrounder on opposition to the bill

CAUCE North America Announces Renewed Corporate Sponsorship By Return Path Inc

CAUCE North America Inc.--The Coalition Against Unsolicited Commercial Email (http://CAUCE.org)--Today announced at The Messaging Anti-Abuse Working Group meeting (MAAWG) that it has received additional financial support from Return Path Inc. 

Welcome to CAUCE North America

CAUCE North America Debuts - New anti-spam advocacy group combines CAUCE Canada and CAUCE US

Montreal and Los Angeles, June 06, 2007 -- Neil Schwartzman, chair of CAUCE Canada, and Scott Hazen Mueller, chair of CAUCE U.S., today announced the formation and launch of CAUCE North America to build upon the work of their previously separate organizations.

CAUCE North America is now the premiere anti-spam advocacy group, representing the interests of the millions of Internet users in North America. The combined group will work towards equitable solutions for the original threat posed by spam since the 20th century, and Spam 2.0, the 21st-century blended threat posed by the merging of spam, viruses, phishing and malware.

"When we launched the original CAUCE, back in 1997," said Scott Hazen Mueller, founder of CAUCE U.S. and now President of CAUCE North America, "spam was an isolated problem and it was seen by many as unimportant. Now, spam is part of a multi-pronged assault by various criminal organizations attacking the very basis of trust on the Internet. If this threat is not met soon, users will continue to migrate away from the Internet for their commercial needs."

press contact: press@cauce.org

Tel . +1 303 800 6345

CAUCE Statement on CAN SPAM Act

The Coalition Against Unsolicited Commercial E-Mail (CAUCE) is disappointed by the enactment of a weak anti-spam law.

This legislation fails the most fundamental test of any anti-spam law, in that it neglects to actually tell any marketers not to spam. Instead, it gives each marketer in the United States one free shot at each consumer's e-mail inbox, and will force companies to continue to deploy costly and disruptive anti-spam technologies to block advertising messages from reaching their employees on company time and using company resources.

It also fails to learn from the experiences of the states and other countries that have tried "opt-out" legal frameworks, where marketers must be asked to stop, to no avail. In fact, the law will preempt an opt-in law set to go into effect in California on January 1, 2004, which was passed after an state opt-out law similar to the new federal law was found to be a failure.

In addition, the law's weak provisions are further crippled by limiting enforcement to overworked regulatory and law enforcement agencies, rather than giving consumers legal tools with which to protect their own inboxes.

CAUCE is also disappointed that both the House and Senate versions of this law were passed without any public hearings, instead being written and passed solely through back-room compromises and with the input of the marketing industry and Internet Service Provider lobbies, but with scant regard for the interests of America's consumers and business Internet users.

"This law does not stop a single spam from being sent. It only makes that spam slightly more truthful. It also gives a federal stamp of approval for every legitimate marketer in the U.S. to start using unsolicited e-mail as a marketing tool. Congress has listened to the marketers and not to consumers, and we have no faith that this law will significantly reduce the amount of spam that American Internet users recieve." — Scott Hazen Mueller, CAUCE Chairman

Joint Open Letter on Spam Legislation

Senator Orrin G. Hatch, Chairman
Senator Patrick J. Leahy, Ranking Member
Senate Judiciary Committee

Senator John McCain, Chairman
Senator Fritz Hollings, Ranking Member
Senate Commerce, Science & Transportation Committee

Rep. F. James Sensenbrenner, Chairman
Rep. John Conyers, Jr., Ranking Member
House Judiciary Committee

Rep. W.J. "Billy" Tauzin, Chairman
Rep. John D. Dingell, Ranking Member
House Energy & Commerce Committee

Dear Sirs:

We are writing you to express our concerns regarding several pieces of anti-spam legislation that have been introduced or are currently being prepared for introduction. As anti-spam and consumer advocacy organizations that have worked on the spam problem for several years, we have closely analyzed many of today's current anti-spam laws, in the United States and abroad, and we would like to offer our opinion on what we have become convinced are the only legislative measures that will make any meaningful difference in the lives of consumers. At present, none of the legislative proposals currently being considered in Congress contain the measures we recommend; rather, they repeat many of the legislative mistakes that have exacerbated the unsolicited commercial email problem, permitting it to grow to the epidemic proportions it has reached today.

First and most importantly, to have any meaningful effect on the growing volume of unsolicited email, any law should prohibit the sending of unsolicited bulk commercial email. Any law that defines acceptable criteria for sending unsolicited bulk commercial email will amount to little more than establishing the conditions for a federal license to spam. The vast majority of online marketing organizations have active and robust permission-based marketing programs that generate significant profits using "opt-in" business models. By establishing an "opt-out" legal regime, Congress would undercut those businesses who respect consumer preferences and give legal protection to those who do not.

An opt-in criterion, requiring the affirmative prior consent of the addressee, is essential to reduce the rising tide of spam, while an opt-out law gives safe harbor to ever-growing floods of unsolicited bulk commercial email. Opt-out places the burden on consumers to remove themselves from potentially tens of thousands of mailing lists that they never wanted to be on in the first place. Because most consumers do not wish to interact with the senders of unsolicited bulk commercial email, few consumers will have the time or inclination to comply with hundreds or thousands of different variations of opt-out procedures.

We also note that opt-out has proven disastrous in South Korea, where the legislature is now scrambling to enact opt-in legislation. Furthermore, opt-in is the law in the European Union and soon to be law in several other countries. Therefore any company operating on a global basis will not be placed under a unique or undue burden by treating American consumers in a consistent fashion. Ultimately, the opt-out approach supported by some direct marketers places their own business convenience over the best interests of American consumers. If Congress accepts their approach, it will condemn consumers to lives with more unsolicited email, not less.

Second, individuals who receive spam should have a private right of action allowing them to recover liquidated damages for violations of the law. It is important that Federal agencies, state Attorneys General and ISPs should also be able to sue spammers, but as it was made clear by Washington's Attorney General at the Federal Trade Commission's Spam Forum (April 30 - May 2, 2003), the only way you will see meaningful enforcement of anti-spam laws is to give the individual victim the right to sue. Federal agencies and state Attorneys General have made it quite clear that they do not have the resources needed to enforce new anti-spam laws. If it is the intent of Congress that any anti-spam law actually be enforced, Congress has two choices: appropriate massive amounts of new funding to all of the responsible law enforcement agencies, or empower consumers to bring their own actions.

The individual private right of action created against junk faxers in the Telephone Consumer Protection Act of 1991 (TCPA) has worked well to keep junk faxes at a tolerable level without any added expense to law enforcement, and without creating the much-hyped "flood of unwarranted litigation" that critics erroneously cite. The TCPA does this by creating an action at the lowest court in a state, typically a small claims court. If floods of litigation are feared, there are ways to create a private right of action for individuals that sharply limit that potential. But a failure to create an individual private right of action will ensure extremely limited enforcement, much as we see today with existing state laws.

Third, a federal law should not preempt stronger state law, particularly if the federal law fails to meet the two criteria above. As with all consumer protection, federal law should set a floor, not a ceiling, and should give victims the ability to bring their actions in any court that provides a competent and convenient forum. By preempting state laws with an ineffective federal law, and by giving federal courts sole jurisdiction to hear cases, Congress would strip away what little protection consumers already have under the handful of strong state anti-spam laws.

All the proposed bills we have seen fail on these three fundamental counts. At the Federal Trade Commission Spam Forum, a substantial majority of the expert participants very clearly articulated that to be effective, spam legislation needed to be opt-in and contain a private right of action.¹ (The only dissenting opinions came from spammers and the Direct Marketing Association.) Recent proposals not only ignore this consensus and side with the spammers, they include exemptions that seem to have been designed to make life easier for spammers.

For example, the draft bill being circulated among committee staff at Energy and Commerce and the Judiciary Committee makes an opt-out choice only effective for three years and would permit a company to send unsolicited email for any product in their portfolio, while forcing consumers to opt-out each time they receive an unwanted mailing. We ask you to envision how this process will play out in a real-world situation, wherein the estimated 23 million small businesses in America could send email to consumers, requiring an individual to opt-out every three years. By creating such a potential, it is a gross misnomer to label a bill containing such provisions as "anti-spam" legislation; the burdens shifted onto consumers by such a bill are more properly described as "anti-consumer" or "pro-spam."

In the last several years, many of the ideas embodied in the current "anti-spam" legislative proposals have been demonstrated to be ineffective and in some cases likely to exacerbate the spam problem. We urge you to not simply reintroduce discredited approaches, but to move past them and look to solutions that have a real chance of making a difference. In the coming days, we will be contacting your staffs with recommendations for addressing the specific concerns we have with the current proposals, and will suggest ways of getting to a simple and fair bill that gives individual consumers, businesses both small and large, educational institutions, charitable organizations, and government itself, the means to defend themselves.

Sincerely,

Jason Catlett, President, Junkbusters Corp.
Jean Ann Fox, Director of Consumer Protection, Consumer Federation of America
Beth Givens, Director, Privacy Rights Clearing House
Susan Grant, Vice President for Public Policy, National Consumers League
Ken McEldowney, Executive Director, Consumer Action
Scott Hazen Mueller, Chairman, Coalition Against Unsolicited Commercial Email
Gary Ruskin, Executive Director, Commercial Alert
The Officers and Board of Directors of the SpamCon Foundation

¹ There were many other lessons learned at the Federal Trade Commission Spam Forum that have not been reflected in any of the current proposals. For example, many participants provided evidence that opt-out "anti-spam" laws have resulted in greater and greater volumes of unsolicited email. Many panelists stated that even criminal penalties for certain deceptive spamming practices will not substantially reduce the volume of spam if unlimited quantities of non-deceptive spam are given safe harbor under law. Similarly, advances in spamming technology have made irrelevant provisions against "harvesting" of email addresses; many such email lists have already been compiled, and spammers are now moving on to "dictionary attacks" which dispense with lists altogether and simply use systematic guesswork.