CAUCE

FBI and Romanian police break two phishing rings

In a press release today, the FBI said that in cooperation with the Romanian Prosecutor General they'd arrested 38 people who'd been running phishing rings. According to the FBI, the people arrested had sent out millions of phishing spam messages which tricked recipients into providing personal financial details.

Romania has for many years been a major source of criminal spam, and it is encouraging to hear that the Romanian authorities are cracking down on it.

CAUCE joins in anti-spyware amicus brief

In a friend-of-the-court brief filed today, CAUCE joins the Center for Democracy and Technology to argue that anti-spyware vendors should be protected by the liability protections afforded other filtering companies under the Communications Decency Act. CAUCE joined a broad spectrum of Internet and technology industry groups, public interest organizations, civil liberties groups and individual companies that are all committed to the proposition that users should be empowered to control their own Internet experiences. The brief urges the court to protect anti-spyware vendors from liability in cases brought to intimidate anti-spyware vendors into ignoring spyware.

Amicus Brief [PDF].

Colorado has a new spam law

CAUCE director John Levine notes:
The governor of Colorado recently signed a new anti-spam law into effect. Since CAN SPAM draws a tight line around what states can do, this law is mostly interesting for the way that it pushes as firmly against that line as it can.

Read the rest of his comments on his blog.

If it spams like a duck...

by J.D. Falk

"Plaintiff e360Insight, LLC is a marketer. It refers to itself as an Internet marketing company. Some, perhaps even a majority of people in this country, would call it a spammer. e360 sends e-mail solicitations and advertisements, for a fee, to millions of e-mail users. More than a few of those users are subscribers to Comcast, an Internet service provider. Many e-mail users do not want to see (or delete unread) the messages sent by e360. Even if every user wanted these e-mails, Comcast might well have its network overloaded by the mailings."

-- Judge James B. Zagel, e360Insight, LLC vs. Comcast Corporation,
Memorandum Opinion and Order filed April 10, 2008

We've been wondering what e360 hoped to gain with their recent lawsuits against Spamhaus and others. If they were trying to clarify the right of ISPs to protect their users from spam, then they've certainly done a good job -- especially in this particular case.

If it wasn't clear before, Judge Zagel's explanation should satisfy even the most pedantic of filtering opponents:

1. ISPs acting in good faith to protect their customers are not liable for blocking messages that some spammer claims are not spam
2. "...compliance with CAN-SPAM...does not evict the right of the provider to make its own good faith judgement to block mailings."
3. an ISP rejecting messages, during the SMTP session, that a spammer knowingly sent to them, does not constitute a "denial of service" attack against the spammer
4. saying "hey, you let those other spams through, why not me?" is just dumb (that's my interpretation, of course; the judge used more polite language)

It's statement #2 above -- the one about CAN-SPAM -- which will have the most direct and immediate effect on companies who try to walk the edge between spam and legitimacy. Complying with CAN-SPAM is the bare minimum required by law; as the courts have stated before any sender has to do a lot more to get their mail delivered into other peoples' inboxes.

Unfortunately, this case won't affect most spam. The near-unbelievable volume of messages sent every day are sent by individuals who don't even pretend to comply with any law, and who know that if they ever tried to file suit against Spamhaus or Comcast or anyone else they'd be laughed out of court -- and most likely arrested.

Even so, CAUCE thanks e360, Comcast, and Judge Zagel for providing us with a good laugh and a small ray of hope in the fight against spam.

Stay tuned for the results of Comcast's counter-suit against e360.

CAUCE in the News

John Levine is quoted in this recient article in the Seattle Post-Intelligencer, discussing recient spikes in fake drug spam being sent from hijacked computers.  

Read the full story here: Two major spam cases end up in Seattle.

Megaspammer Robert Soloway pleads guilty

Large scale spammer Robert Soloway, whose criminal trial was scheduled to start next week, pled guilty to most of the criminal charges against him

CAUCE board member John Levine comments on the case in his blog.

Ralsky indictment is good news for all email users

by J.D. Falk

I've always maintained that spam does not make one great, but Al Ralsky kept a relatively high profile for long enough that his unwelcome intrusions into our inboxes — and our friends' inboxes, and our parents' inboxes, and our children's inboxes — will be long remembered.

Today the entire email industry is cheering the arrest and indictment of Ralsky and his gang, which was reported in the Detroit Free Press this morning. It's obviously good news for anti-spammers, who have been clamoring for prosecutions of illegal spamming activity for more than a decade. But it's also wonderful news for the email marketing industry, which has been trying to show the world that they aren't spammers. Now, the marketers can point to Ralsky's illegal activities and state with one voice: "we do not do these awful things."

But I think the marketers have to ask themselves: is there anything Ralsky was doing which isn't illegal per se, but might still be considered spam-like in the eyes of your subscribers? Perhaps a subject line which is only slightly misleading — not enough to violate CAN-SPAM, but enough to violate the trust your subscribers have in your brand. Perhaps treating opt-in as a license to blast them over and over, until your message falls on deaf ears.

If a sender acts like a spammer, even if they aren't bad enough to get arrested, how different are they from Al Ralsky and his ilk?

And likewise, I think the anti-spammers have to consider whether following "big name" spammers is worth the effort. It seems certain that for every high-profile blowhard like Ralsky, there's another dozen who are just as prolific — but, like most other criminals, never seek attention.

This is a great triumph for all who want to preserve email as a viable communications medium. We congratulate the United States Department of Justice and the FBI for their impressive work, and the Spamhaus Project for keeping a close eye on Ralsky's activities for so long.

But this is not the end of spam; far from it.

This article was also published by Return Path.

Spamhaus makes progress in court

Spamhaus, the well-known anti-spam organization has been in court, sued by Chicago area bulk mailer E360. A year ago E360 got a default judgement against Spamhaus for $11 million, which Spamhaus later appealed. The appeals court has ruled, and it looks promising for Spamhaus.

CAUCE board member John Levine comments on the latest decision.

Famous spammer Sanford Wallace is sued yet again

Sanford Wallace, a famous spammer from the 1990s is back, in a legal tangle with MySpace, for sending a whole lot of spam to MySpace users.

CAUCE board member John Levine writes about it in his blog.

Spam: You've Come a Long Way, Baby

CAUCE board member Ray Everett Church writes at internetnews.com:

According to the majority of the testimony at this month's "Spam Summit," held by the U.S. Federal Trade Commission (FTC), the state of the fight against spam is pretty much the same as it has been for the last several years.

The two days of presentations can largely be boiled down to the following bullets:

• Spam volumes continue to increase, being driven by the growth of "botnets" — networks of hijacked computers run by hackers and rented out to spammers.

• Spam is one of many high-tech tools being used by organized crime, international terrorist organizations, and can be expected to play a major role in future conflicts between nations.

• Anti-spam technologies are improving, but deployment of sophisticated technologies such as cryptographic-based email authentication is sorely lacking.

Oh, and the spam wars are a lot less exciting than they used to be. Case in point: unlike last time, there were no fist-fights at this year's shindig. ...

Read the rest at Internetnews.com