CAUCE

33 Years of Spam? No, Not Really.

On May 3rd, 1978, a Digital Equipment Corporation (DEC) marketing representative named Gary Thuerk and a DEC engineer named Carl Gartley sent what many believe to be the first email spam. (The message was dated May 1st, but sent on May 3rd.) It advertised two events in California promoting the new DECsystem-20, the first DEC computer capable of connecting easily to the ARPAnet, predecessor to the internet. The message was addressed (by hand) to every ARPAnet user on the West Coast of the United States that they could find, but ran into an unexpected limit: the mail program would only accept 320 addresses. The rest of the addresses bled into the body of the message, and some recipients forwarded it on.

(Brad Templeton's mostly-outdated Essays on Junk E-mail includes a detailed history of the incident and reactions to it, based in part on a direct conversation with Thuerk himself.)

Scattered around the Internet today (and every May) you'll find various articles heralding the 33rd anniversary of spam, counting the years from Gary's message. They'll remark that spam has been with us a long time, maybe quote a few anti-spam vendor statistics, and say spam isn't going anywhere. But that's just bad research.

The ARPAnet and later the NSFnet were strictly non-commercial, both by contract and by social compact. Anyone who violated that got a stern talking-to, and could lose their access and get fired or expelled. So while there was indeed an occasional misstep, an occasional commercial message, they were very rare.

This changed in the mid-1990s, as the internet first became available to the general public. Commercial use was still hesitant, but increasing rapidly. Some of the early commercial users were entrepreneurs who are now considered geniuses; others were hucksters who are now in jail, or dead.

A common "get rich quick on the internet" scam was to sell books and kits for getting rich quickly on the internet. Often they were simply lists of ISPs by area code, some instructions paraphrased from The Internet for Dummies, and a few templates you could use to create your own web site. But there were also lists of email addresses and email blasting software — the unfortunate and unwelcome beginnings of both the email marketing industry and the ongoing malware epidemic.

Commercial use increased, and we have the internet we do today. Spam increased even faster. But that doesn't mean spam can't be controlled, and reduced. Every month there's another botnet taken down, another major bust by law enforcement — those used to happen maybe once a year, if we were lucky. There has never before in the history of the internet been so much focus on spam, malware, and other so-called "cybercrime" from so many different agencies, mostly (finally!) collaborating with each other. The internet won't return to the old, pre-commercial days, but it will get better.

And while it's true that the first bulk unsolicited commercial email was sent in 1978, there are stories of non-commercial mass messaging going back much further — such as the MIT user who transmitted, in 1971, the words "There is no way to peace. Peace is the way." Perhaps we should consider that the first Tweet?

Yes, People Still Care About Email Spam

Just over a month ago, we posted an article entitled "Do People Still Care About Email Spam Anymore?". Part of the reason why people might not care anymore, according to this article, is that email has become passé. With so many other new ways to communicate, why even bother with email?

Not only did a few readers take the time to post some compelling counter-arguments to our article, even muckraking marketing columnist Ken Magill has weighed in on the debate. Citing a few recent studies — including a finding by the Pew Internet & American Life Project that email is still the No. 1 online activity across all age groups of internet users — Magill goes so far as to advocate a pretty hefty dose of harassment for the next person who states in public that email is dead.

According to The Radicati Group, there are currently 1.4 billion email users. A study by Nielsen found that 25 minutes out of every hour spent on a mobile device is on email. And so on.

There are reasons why email is still so popular. It is easy to use, it is (relatively) private, and it is accepted across generations and for personal and business purposes alike. You don't need a special 'app' to use it, and neither do you have to enlist with an online "community" (yes, there are still people out there who don't want to be a part of Facebook!). While most of us in the online business world are keen to broadcast our thoughts to the world via Facebook, Twitter, and whatever, there are still many people who just want to have a good old fashioned one-on-one email conversation.

And so it's pretty clear: email still matters. And, because email matters, spammers still take advantage of it. And for that reason, people still care about old-fashioned email spam. They have to.

As one commenter noted, spam is still widely used by scam artists to get their dirty hands into our private lives, and, ultimately, our bank accounts. People are still getting ripped off by spammers - whether it be through malware, phishing, fake pharmaceuticals, or whatever — and, undoubtedly, these people still care.

Another comment pointed out that, even for those of us who think that spam isn't a problem because filters manage to keep most spam from our inboxes, the cure is occasionally worse than the disease. Regardless of how good spam filtering has become, false positives will always be a problem. For anyone who has ever lost out on an important business opportunity (or maybe even a hot date) because their email didn't make it to the intended recipient, they care about spam. If it weren't for spam, we wouldn't need spam filters, and we wouldn't have to worry about legitimate emails getting hijacked on their way to the inbox.

Parents are concerned about sexually explicit messages popping up (no pun intended) in their kids' inboxes. Legitimate marketers are concerned about having to compete with spammers for space in their customers' inboxes, and the ever-present risk that their messages might be labelled as spam too. And the Nigerian government is concerned about former diplomats and members of the royal family using spam to collude with total strangers to steal millions of dollars from the government's coffers (ok, just kidding).

When people stop using email, then spammers will stop sending spam through email. Then people will stop caring about email spam. Let me know when that happens.

Some readers may wonder why an organization that advocates against spam would even ask this question. We really just wanted to see what people would say. CAUCE still thinks email is important, and spam a very real problem. And apparently at least a few really smart people agree. Let's declare this debate closed - at least for the time being.

(This article was written by a different CAUCE supporter who wishes to remain anonymous.)

Do People Still Care About Email Spam Anymore?

This may seem like a strange question for an anti-spam organization to ask.

CAUCE obviously still cares about email spam, and always will, but does anyone else?

If you talked to your friends or relatives over the holidays and asked them about the amount of spam they get in their inboxes, most of them may tell you that they rarely see it (even basic spam filtering on free email accounts has gotten pretty good).

When you talk to some younger people about email spam, be prepared for them to laugh.

They'll tell you that when they need to communicate, they'll usually use some sort of instant messaging, or maybe send text messasges from their Blackberry or their iPhone. Email just isn't relevant to them any more. ("Sheesh! What will you ask about next? Faxes? Telegrams? Papyrus? Stone tablets? Get with the modern era! Who cares about stupid email?")

For all those sort of users, email is about as relevant as horse-drawn buggies. Email is archaic. They don't care about email, much less email spam.

Other users may tell you that they do care about unsolicited email, but if you probe a little, you'll find that they really only care about certain types of "spam." Everyone hates spam that might infect their computer with a virus or other malware, and many may find it creepy to get personalized phishing messages, but we empirically know that most spam doesn't contain malware or phishing-related content.

In fact, we even find ourselves wondering about email spammers themselves.

Do any smart spammers still care about email spamming? When's the last time you saw anything even relatively creative when it came to spam? I remember being impressed the first time I saw randomized image spam, and fast flux web hosting, but since then I haven't seen a whole lot in the way of spam-related developments that are very technically impressive. (I think this may be evidence that the smart spammers have already moved on to greener and more lucrative cyber crime fields.)

Image by Getty Images via @daylife

Sending email spam has acquired an increasingly last-decade (or last-century!) sort of feeling, sort of like being a person from the Eastern Bloc still proudly driving a rattle trap Trabant. The world's moved on, even if a few Communist-era fossils haven't.

True, there are some back-of-the-pack guys who are still sending cliché spam for illegal pharmaceuticals and quick-to-break knock-off watches or untrustworthy casinos.

I'm sure it's partially a matter of intertia. If sending email spam using someone else's seldom-updated and easily detected spamware is all you really know how to do, well, I suppose that's what you're going to keep doing, even if it doesn't pay nearly as well as it used to. You're trapped in a dead end job, just like a soon-to-be unemployed factory worker who never got retrained for the the modern era.

In fact, it must be sort of depressing to be a professional email spammer. As a professional email  spammer, you really only have two career tracks: mediocrity or infamy.

If you work really hard and end up being one of the rare persons who excels at email spamming, your success virtually guarantees that you'll be the focus of undesirable attention from law enforcement. They can't go after everyone, so they understandably like to use what resources they do have to target the rare "spam king" -- someone like you.

And then there's all the waiting. Law enforcement may not work fast, but boy oh boy, some of those guys are pretty dang dogged once they get on your trail. It may take them years and years to get all the paperwork lined up, but these are very patient guys. They will eventually get all the evidence they need, and then they will reach out and arrest you, sometimes just when you're getting ready to retire somewhere nice and warm.

As a spammer, you do have options. You could intentionally try to "stay small scale" and thus stay off law enforcement's radar, but if you do, is small scale email spamming even really worth it?

See what I mean when I ask, "Do people really even care about email spam anymore?"

 

(This article was contributed by a long-time CAUCE supporter who wishes to remain anonymous.)

Kidnapping, Theft and Rape Are Not "Cyber" Crimes

Kidnap. Rape. There are no lesser words that can be used to describe what happened to the daughter of an anti-spam investigator in Russia.

His daughter was recently released, according to Joseph Menn’s recent article on Boing Boing, after having been kidnapped from her home five years ago, fed drugs, and made to service men, as a warning to ward off further investigations.

The criminals behind these vicious acts were also responsible for large spamming organization associated with Russian Mob activity.

Note that we say "also."

When someone is mugged, harassed, kidnapped or raped on a sidewalk, we don't call it "sidewalk crime" and call for new laws to regulate sidewalks. It is crime, and those who commit crimes are subject to the full force of the law.

For too long, people have referred to spam in dismissive terms: just hit delete, some say, or let the filters take care of it. Others — most of us, in fact — refer to phishing, which is the first step in theft of real money from real people and institutions, as "cyber crime." It's time for that to stop.

Some of these crimes involve technology. So what? Criminals have used technology before.

Some of these crimes cross borders. So what? Crimes have crossed borders before.

Spam isn't illegal everywhere yet. So what? Spam 2.0 (spam, malware & spyware) is the leading edge of far worse activities, often things that have been illegal as long as we've had laws.

It is high time that governments and law enforcement stop thinking of computer crime as that perpetrated by teenagers in their parent’s basement. It is the Russian Mob and other organized criminals that are doing this.

While we are at it, we should mention ‘cyber-warfare’, something too often conflated with cyber-crime. Cyber-crime is not "cyber-warfare.” There may be state or terrorist agencies copying the tactics and methods of these criminals, but that does not mean that the criminals must be left alone until new cyber-warfare agencies have been created and funded.

As Purdue computer science professor ‘Spaf’ Spafford was recently quoted as saying in a note-worthy piece ‘Cyberwar Vs. Cybercrime’ on the GovInfo Security blog

"Why aren't we seeing the investment and prioritization being made in law enforcement, first? Why is all the publicity, funding and prioritization being given to the military - with efforts such as the build-up of the military cyber command - when so much of the clear and present threat is from the criminal element and not from other nation-states?"

Just so, Prof. Spafford!

As we have said repeatedly on this site, these are criminal gangs who have found an incredible loophole in the justice systems of the world: they can rob banks and people, with little chance of getting caught, let alone going to jail. This is not because they're doing things that aren't illegal; they've just found a new way to hide.

David Black, manager of the RCMP's cyber infrastructure protection section recently said to CAUCE Executive Director Neil Schwartzman “we don’t do spam”. OK, but why not? Spam is no longer, and hasn’t been for some time, about simply sending unwanted emails. Spam is now a delivery mechanism for malware, which in turn threatens infrastructure, and facilitates theft. We have seen precious few cases filed using existing Federal computer intrusions laws in Canada, and none, to our knowledge have been filed under the renovated anti-phishing law, S-4, passed in September 2009.

Governments and law enforcement agencies need to begin to treat online theft with the same seriousness as they do other physical crimes. It is time to bring this up to the diplomatic level, or seriously consider refusing packets from places that treat the Internet, and innocent victims, as their personal ATM.

CAUCE is made up of people who care about email qua email. We understand it, we love it. It is still the ‘killer app’. Furthermore, we understand why some folks in law enforcement or the judiciary might ask, "When there are people stealing millions or hurting people in the commission of violent crimes, why are you wasting our time with 'just' a spam case?” Here's why:

1. Most spam is sent by organized criminal gangs, just like other organized crime.
2. Those gangs intentionally operate trans-nationally, in an effort to frustrate investigation and prosecution.
3. Money laundering of the proceeds from spam is routine, and that money directly fuels official corruption and other social ills.
4. Some spammers are actually selling something. Their favorite product? Counterfeit pharmaceuticals. In many cases these may be scheduled controlled substances, sold in bulk, and available to minors; in other cases, critical medicines needed to properly treat cancer and other serious illnesses may be counterfeit placebos, with potentially tragic results.
5. Spammers operate by compromising tens or hundreds of thousands of end-user PCs, violating those users' privacy and sometimes steal sensitive personally identifiable information such as individuals’ and even corporate access to financial services at the same time they're using their systems to spam. Computer ‘phishing’ is no less a crime than bank robbery, home invasion, and mugging.

Cyber criminals consider cyber crime to be a virtually riskless offense; they're unlikely to be identified; if identified, they're unlikely to be investigated; if investigated, they're unlikely to be charged and prosecuted; if prosecuted, they're unlikely to be convicted; if convicted, they're unlikely to do jail time.

The courts need to make it clear that that's wrong in all respects. If you commit cyber crimes, you will be identified, investigated, charged, prosecuted, convicted and sentenced to serious time and we will seize your assets.

This will not happen so long as crime, which involves the Internet, is dismissed as "cybercrime" and either scoffed at, or used to justify ever-increasing cyberwarfare budgets

This isn't just email. This isn't a war. This isn't "cyber.” This is crime. It is time to call a cop, and expect a response.

 

by CAUCE Executives J.D. Falk & Neil Schwartzman

Who Are Domain Names For?

Last week, the Libyan government seized and disabled Violet Blue's "sex-positive" vb.ly URL shortener. I've discussed URL shorteners before, but what does Libya have to do with it?

Actually, that part's pretty simple. The .LY domain belongs to Libya, so their laws apply -- even if the registrant or their web site isn't physically in Libya. The company which manages registrations in .LY decided to permit registrations by companies or people outside of Libya, but they still own it.

Originally there were only a handful of "global" or "generic" top-level domains, known as gTLDs, available to anyone in any country: .COM, .NET, .ORG, and .EDU. .GOV and .MIL were effectively only for the United States. .INT, reserved for organizations created by international treaty, is rarely seen.

Each country has their own ccTLD, based on the ISO two-letter country codes. Some are fairly obvious to English speakers: .US for the United States, .CA for Canada, .UK for the United Kingdom, .AU for Australia. Some seem a bit more obscure, due to differences in language or conflicts with other names: .TD for Chad, .RS for Serbia, or .ZA for South Africa.

Each ccTLD authority sets their own rules for who is allowed to register one of their names. Island nations Tongo (.TO) and Tuvalu (.TV) have reportedly made some pretty good money by permitting non-local registrations. After splitting from Yugoslavia (.YU) and Serbia, Montenegro opened .ME in hopes of attracting English speakers -- and sold over 320,000 domains between 2008 and 2010. Colombia's .CO, which attracts typos of .COM, sold half a million in two months -- mostly to registrants in the United States.

But none of this addresses the real question: what do actual users care about?

In March the most popular search term on Google, Yahoo!, and Bing was "facebook". Other top searches across all three, according to Experian Hitwise, included youtube, myspace, craigslist, ebay, and gmail. Perhaps ironically, "google" was the second most popular search on Microsoft's Bing.

Does it matter whether Facebook is facebook.com, fb.me, facebook.ca, facebook.co.za, et cetera? Well, unfortunately, it kind of does. If a bad guy registered facebook.ql (which is just an example, there's no .QL ccTLD), then they could put up a site that mimics the real Facebook, and send phishing email which might have a better chance of fooling users than the usual nonsense domains. And, of course, there are the usual trademark issues. So, Facebook has had to register in all of these.

To put it another way: big brands are effectively required to register their trademark in every gTLD and ccTLD they can, because most users are completely unaware of gTLDs and ccTLDs. If the TLDs effectively separated different types of organizations, as was originally imagined, then this wouldn't be necessary.

There's also another type of user to consider. Violet Blue chose to register vb.ly because she wanted something short and easy to remember, and was following the trend set by bit.ly, jl.ly, et cetera. Unlike .ME or .TV the value wasn't that vb.ly has any particular meaning, but rather that it's short and appeared to be easy. URL shorteners are for the people who don't type "facebook" into google, and do want to share links to specific things. Of course, if web designers considered the length of URLs when designing their sites, this wouldn't be as much of an issue.

ICANN, the quasi-non-governmental organization which oversees these top-level domains, has introduced quite a few other gTLDs in recent years. Many of these are restricted in some fashion, which helps to reduce the land rush; for example, .MUSEUM is only for museums, though of course most museums already have domains under .ORG, .EDU, .GOV, or an appropriate ccTLD.

Only two of the newer gTLDs are unrestricted: .INFO, and (for most purposes), .BIZ. When was the last time you saw a company put their primary site in .BIZ or .INFO, rather than having it be a redirect to their site in .COM? Oh hey, it was Return Path -- and we switched a few years ago to returnpath.net, because most of our neighbors in .BIZ were spammers or phishers. .INFO has the same spam problem; some spam filtering software sees the mere presence of .BIZ or .INFO as increasing the likelihood that a message is spam.

Ignoring these concerns, ICANN has decided to open up the namespace further and permit pretty much anyone with $185,000 and a bunch of nameservers to register their own gTLD -- likely before next March. It's unclear if anyone actually wants this except the potential new gTLD registries, who stand to earn a lot of money over trademark concerns. For example, the .CO registry initially offered a "Specially Protected Marks" program, permitting companies to register their trademarks ahead of the general populace. .CO claims "100% Participation by Leading Brands", and any new unrestricted gTLDs can surely expect the same.

Even if a company creates a new gTLD for their own use, such as .IBM, they'll still need to keep ibm.com, lotus.com, et cetera -- everything they have now, plus the same trademarks in every other gTLD.

Once all that dust has settled, and the registries and ICANN have made their money, we'll still be left with an ever-greater threat of phishing or other brand hijacking. Most end users will still expect to find their friends by typing "facebook" into google, while a smaller number will still want shorter URLs.

If domain names are for end users -- if, indeed, the internet is for end users -- then why do we need more TLDs?

(This article was originally published on The Received: Blog, and has been reproduced here with permission from from Return Path.)

Facebook, Privacy, and the Loss of Trust

Image by Compound Eye via Flickr

Facebook sure is getting beaten up recently. There's even a crowd-funded initiative to replace it with something open, called Diaspora -- everyone on Facebook is talking about it.

Yet it wasn't even two full years ago that Facebook was the darling of the ditherati. For a while it seemed as if nearly everything Facebook did was hailed as the future of messaging, perhaps the future of the Internet — or maybe the Internet didn't matter anymore, except for Facebook. Even obvious scams got VC funding, so long as they were on Facebook. But with just a few missteps -- which they appear to believe were nothing more than misunderstandings -- everything's changed.

The first tipping point, it seems, was Facebook founder Mark Zuckerberg's statement that he doesn't believe in privacy, with the obvious connotation that therefore he doesn't have to concern himself with it. But as researcher danah boyd responded, privacy isn't just about whether or not you share stuff -- it's whether or not you have any control over what you share, and who you've shared it with.  And besides, it doesn't matter whether Zuckerberg believes in privacy.  Facebook's users still do.

The problem Facebook has created for themselves is not that nobody wants to share information about themselves; it's quite obvious that there's a lot of sharing going on. It's that with each new feature, Facebook changes the social dynamic. Before, Facebook users felt and believed that they were sharing with their friends, and with particular networks they'd chosen; it was a closed environment, with borders that were clearly defined and understood. And if a few advertisers got to peek in, well, that was the price of admission. But now, after many changes, much of that same information is entirely public -- unless each user individually goes through a set of complex steps to opt out.

It's akin to sending email to a private mailing list, only to have it forwarded to a reporter and published. Sure, it's always possible that that can happen, but we can either trust each other to abide by the social contract to not do such things, or we can't trust each other at all.

Facebook's staff may well have thought to themselves that if they asked users to opt in to having their data shared with a much broader audience, the users would decline -- and they were probably right. But by ignoring that insight and making it opt-out instead, they showed a severe lack of respect for their users. Without that respect, there can be no trust. Without that respect, your users will turn on you -- because they were never really "your" users to begin with.

Once trust is lost, what do you do? Can it ever be regained? Or will trustworthy behavior have to be forced upon them by regulators?

We at CAUCE have pondered this same question over the years in terms of companies who used to send spam, and have since learned not to. Some people will never forgive them, no matter what they do. Others won't see what the big deal is, because the spam never affected them personally. But most will fall somewhere in the middle, never quite trusting the company not to spam them again.

That middle area is the most Facebook can hope for at this point, and the way to gain it is to start viewing everything in terms of "what do users think is going on," rather than "what do we want users to think is going on?" More than anything else, they have to ask themselves: "are we being respectful towards our users?  Are we allowing them the choice and control they believe they already have?"

It sounds like they're already thinking in this direction, or at least they want us to think they are -- but that doesn't mean users' perceptions will change overnight. Facebook won't be forgiven that easily, especially if their PR tactic is essentially "oh, you just didn't understand what a wonderful thing we're doing." They'll have to patiently explain their thinking in an honest way, keeping corporate doublespeak to a minimum -- and stay consistently respectful for a very long time.

Even then, success may not be measured by a decrease in angry blog postings. It also won't be measured by a decrease in the number of people deleting their accounts. Trust is much more nebulous than that. If anything, it'll be measured by whether anyone's willing to try new features when given the opportunity to opt in -- and that, too, could take a long time.

If they stick with it, and they're open and transparent about the change, then they could continue to be the largest and most successful proprietary social network that has ever existed...at least until some other tipping point occurs.

Related articles by Zemanta

• Mark Zuckerberg may have wanted this kept private (trueslant.com)
• The best article ever about Facebook (fakesteve.net)
• Facebook Should Follow Its Own Principles (eff.org)
• Facebook's follies: A brief history (news.cnet.com)
• Taking permission (wordtothewise.com)

Maybe email IS dead -- part of it, anyway.

by J.D. Falk

I tend to chuckle at every new proclamation that email is dead. Google Wave won't kill it. Twitter and Facebook aren't killing it; they're using it. RSS didn't kill it. Instant messaging didn't kill it. "Push media" (remember that?) didn't kill it. AOL and Compuserve and Prodigy didn't kill it; they joined it. And before that, usenet and email lived happily side-by-side.

Over the years the Coalition Against Unsolicited Commercial Email (CAUCE), the world's oldest and largest email advocacy organization, has also predicted the death of email. Some day, we've said, we will reach a tipping point where spam finally makes email unusable for regular people. And for any people who doesn't have good spam filters, that's already happened. Avoiding email's death by spam has given rise to the spam filtering & security industry, and the equally powerful mailbox hosting industry. It has elevated open source projects like SpamAssassin from curiosities to necessities. I've lost count of the number of hardcore geeks who've finally given up on running their own severs, and moved their personal mail to Gmail.

Through these efforts, and these small personal concessions, email survives. But it's not the same, and I'm left wondering if a part of email has died.

Email's Not Dead, neither is Spam

by Neil Schwartzman

Over the past few years, we have seen a plethora of over-hyped articles in the popular press and blogosphere crowing wrong-headedly about how "email is dead". Social networks like Facebook and Twitter, new and as-yet unproven technologies are the supposed death-knell for our old reliable friend, e-mail.

I wrote about the rumours of email's death being exaggerated back in 2007 in response to such inanity.

Since then, we've seen such a cornucopia of silliness of the "Such & such is killing email" variety that Mark Brownlow compiled a bunch of articles, and their rebuttals at his excellent site emailisnotdead.com

Email ain't dead folks. Go look at your inbox. As the wags over at BoxOfMeat.com make note, they are becoming "tired of marketers calling their conferences and cliques "email whatever" as if marketing is the only thing email is for".

Just so! The vast majority of the email I receive daily, and I suspect the same for you, is from friends, email discussion lists, transactions from my bank, a few airlines and hotels, various online services I use, alerts about software updates, oh, and emails from social network services like Twitter, Facebook and LinkedIn reminding me to log in to see messaging that they keep in-house.

Facebook set up personalized domains some months ago for example facebook.com/spamfighter is me. What do you think the logical next step is? Rumour has it that Facebook will be doing email, sooner or later. MySpace already took the plunge. I promise you, Email is not dead because people want to write directly to one another, using their email accounts, in more than 140-character bursts.

Besides which, your Mom doesn't have a Twitter account. Your boss isn't going to relay an annual job assessment via Facebook. Your bank isn't sending you a statement to your MySpace page anytime soon, if ever. As if!

So what about spam? Is it dead? Some guy at Slate seems to think so (Surprise! We won the war on spam), and the Chicago Tribune slavishly gave him props (The spam plague is over, has anyone noticed?)

Really, these people should know better.

Their "fundamental proof" for the spam epidemic having run its course is that spam filters work. Well, duh. If they didn't, we would all be seeing about 90 for every one spam that gets into the inbox. That doesn't mean it is over, merely that we are not seeing the vast majority of the spam sent our way. The spam filtering-spam sending war is ever-escalating, and someone has to pay the piper for new technologies and filters. That someone is, you, dear reader, the end user of that wonderful technology, email.

The head of the Canadian Internet Service Providers Association said, some six years ago, that it costs each email user in Canada $5/month for filtering. That was well before things got really bad with great advances made with botnets and other spamming techniques. This is real money out of your pockets folks, and sure, you can opt for a freemail account. Freemail means the service doesn't cost you anything, but someone is paying for it, and that somebody are advertisers. Personally, I like an ad-free environment when I am peacefully reading an email from a friend or relative. I don't need yet another "targeted" message to add to the already intolerable clutter. I have been swooshed enough, thanks.

The "Spam is dead" crowd cites some legal initiatives, some successful, other not, as a failure of anything but technology to address the spam arms race. Of course, some spammers are going to win in court. That doesn't mean laws are ineffective. Just ask Adam "I owe Facebook $900,000,000" Guerbuez, Sanford "I owe Facebook $700,000,000" Wallace, Scott "I paid MySpace $6,000,000" Richter, and Alan "I face seven years in jail and a $1,000,000 fine" Ralsky.

These all sound like effective actions to me. Of course, a law isn't going to stop spam any more than it does murder. What laws serve to do is keep honest people honest, and allow society to take some punitive actions against those that flout our common mores.

Spam can and must be dealt with in a multi-pronged fashion — no single initiative is going to kill it off: User education, legal initiatives, spam filtering, the adoption of best common practices by legitimate mailers, cross-jurisdictional cooperation, all of the stuff that we agreed to in the ground-breaking Task Force on Spam, back in 2004.

Maybe this will have you scurrying to the supposedly safe confines of Facebook or Twitter? Then again, maybe you've noticed that the bad guys are spending an awful lot of time money and resources targeting these two platforms of late? If not, you should. A colleague of mine has had her twitter account hacked three times in as many weeks — and now, it turns out that Koobface, an infamous piece of Facebook malware, may have come to Twitter, too: Twitter spam worm stealing user logons.

Read more about this here: Facebook, MySpace, and crossdomain.xml or here: Massive Facebook And MySpace Flash Vulnerability Exposes User Data

Then, there are the fun games you can play on Facebook. Whoops, maybe not so much fun. Check out the Tech Crunch series about the CEO of the company behind Mafia Wars and Farmville, who laughs about his scamming innocent users like you out of the personal information, which he resells to marketers.

Former email spammer Scott Richter is now happily publishing Facebook apps from his new company, Lunatic Games at http://www.new.facebook.com/LunaticGames

As the old saying goes, fool me once, shame on you; fool me twice, shame on me. I think you’d have to be a lunatic to play one of those games. Did we mention that Scott’s other company is affiliates.com ? Now, what do you think he is doing with the information he gathers from game-playing Facebook users?

Spam ain't dead folks. It just got itself a Facebook account, and it tweets, too.

The (Possible) Future of International Spam Laws

by J.D. Falk

After more than a decade of fits and starts, fear and doubt, lies and lobbying, legislative attention towards spam now seems to arrive in regular waves.

Our friend Dennis Dayman reports on deliverability.com that a new law has taken effect in Israel, requiring (in short) opt-in — and so according to the International Herald Tribune, Israeli marketers were rushing to re-confirm questionable subscriptions before the deadline this past Monday. In Canada, Internet law expert Michael Geist lambasted his government for continuing to fail to pass any anti-spam legislation, four years after he and the National Task Force on Spam — which also included our own Neil Schwartzman — strongly urged them to take immediate action. And this week at the Internet Governance Forum in Hyderabad, I've heard representatives from more than a dozen governments from all over the world discussing not whether "cyber crime" legislation is necessary, but rather how it should be formulated to fit their local legal standards and culture.

Should I Stay or Should I Go?

by Neil Schwartzman

"If I stay there will be trouble; …If I go there will be double." — Joe Strummer (1952-2002)

"We can be heroes, just for one day." - David Bowie (1947- ) 

Working in the anti-spam and online malware fight can be depressing or at best invoke multiple personality disorder.

We all know things are bad on the net, but if you want a dose of stark reality, check out Brian Krebs' fantastic Security Fix blog on the Washington Post site. Written with both technical accuracy and readability for the rest of us, a rare thing indeed, Brian is the current raving-fav among the security set, due to his high profile, and willingness to call a spade a spade.

He has shone the spotlight of national media on some real embarrassments, situations like ICANN dragging their feet regarding the decertification of rogue registrar EstDomains (a service much-favoured by malware authors and spammers), (they are now offline), Atrivo, a California-based ISP which played a pivotal role in sustaining the Storm botnet, (they are now offline) and Krebs played a part in the latest victory for us good guys on the net, noting McColo was a host for botnet command-and-control technologies  (yes, they too are now offline!)

So why the ambivalence Neil? Good question! Speaking to an old friend who asked me what I was doing these days, I recently likened the fight against this relentless onslaught to having one's pinky in a dyke, and there are days when I don't even think we have a dyke! We've certainly seen dedicated anti-spam/anti-malware volunteers suffer from burn-out, and drop off, over the years, a loss to all of us as an Internet community.