CAUCE

Commentary on the FTC Spam Summit

The following speech was prepared with the intention of using portions of it during the FTC Spam Summit, but CAUCE was not given the opportunity to participate due to time constraints.

My name is Neil Schwartzman. Beyond — as I noted yesterday — representing Return Path Inc. here at this conference, I have a second life, as it were, as the Executive Director of CAUCE in North America. CAUCE is the Coalition Against Unsolicited Commercial Email, a consumers' rights advocacy group.

I am here today to question. Yesterday we heard how the tenor of the discussion about spam became more mature. How, in the period of time that has elapsed since the last summit, things have developed as an industry.

That may be true, but I question if the discussion at hand here this week is truly a big tent effort. I see few anti-spammers here. I see only one blacklist operator, and no filtering service providers here. I see no consumer organizations here. Heck, I don't see but one spammer on the panels.

I didn't see anyone challenge him during his attempts to cast himself as a legitimate business man, no-one mentioned his attempts to bribe staff at at least one large receiving site to accept his mail, or his efforts to open a school for spammers. Where is former FTC Commissioner Orson Swindle and his "couple of public hangings" when you need him, and them?

Why does my government allow spam?

Governments are catching up with spam laws, but sadly many have not legislated this yet. Canada has no spam laws, even though the "Federal Anti-Spam Task Force" recommended this in 2004. Country specific laws can be found at Spamlaws.com

The United States has legislated email with CAN-SPAM (Controlling the Assault of Non-Solicited Pornography and Marketing Act) in 2003. This law require several elements of a commercial email message conform to a minimum set of standards. Here is a rundown of the law's main provisions:

• It bans false or misleading header information
• It prohibits deceptive subject lines
• It requires that your email give recipients an opt-out method, which must be processed within 10 days of receiving by the sender
• It requires that commercial email be identified as an advertisement and include the sender's valid physical postal address

Unsolicited bulk e-mail that complies with these rules is legal under CAN SPAM, even though such UBE is widely considered to be spam.

The Internet community is also working on several global initiatives to help stem the tide of unsolicited commercial email, CAUCE recently endorsed the Senders BCP published by MAAWG, written mostly by Email Service Providers with input from ISPs, Corporations and RBL providers.

Welcome to CAUCE North America

CAUCE North America Debuts - New anti-spam advocacy group combines CAUCE Canada and CAUCE US

Montreal and Los Angeles, June 06, 2007 -- Neil Schwartzman, chair of CAUCE Canada, and Scott Hazen Mueller, chair of CAUCE U.S., today announced the formation and launch of CAUCE North America to build upon the work of their previously separate organizations.

CAUCE North America is now the premiere anti-spam advocacy group, representing the interests of the millions of Internet users in North America. The combined group will work towards equitable solutions for the original threat posed by spam since the 20th century, and Spam 2.0, the 21st-century blended threat posed by the merging of spam, viruses, phishing and malware.

"When we launched the original CAUCE, back in 1997," said Scott Hazen Mueller, founder of CAUCE U.S. and now President of CAUCE North America, "spam was an isolated problem and it was seen by many as unimportant. Now, spam is part of a multi-pronged assault by various criminal organizations attacking the very basis of trust on the Internet. If this threat is not met soon, users will continue to migrate away from the Internet for their commercial needs."

press contact: press@cauce.org

Tel . +1 303 800 6345

Spam has changed, and so must CAUCE

We were shocked, not so very many years ago, when AOL reported that spam was 30% of their incoming mail. Now, some of the world's largest ISPs report that it's well beyond 80% -- in some cases higher -- and increasing.

Back then we knew who the spammers were, they stayed in one place and thought of themselves as "high volume" email marketers -- but now, the leaders of the email marketing industry know they must respect permission, and can't engage in the spammy behavior of their predecessors. We predicted that a private right of action in civil court would be sufficient to keep those same marketers in line, and now we know that's correct -- but today, much of the spam volume is sent by career criminals and malicious hackers who won't stop until they're all rounded up and put in jail.

CAUCE Accepting New Members

CAUCE North America wishes to announce the launch of a new support program, now featuring many levels of individual and organizational membership for those wishing to actively assist with our important work and goals.

CAUCE actively advocates on behalf of consumers to governments, legislators, law enforcement agencies and industry associations about matters related to the blended threat of spam, viruses and spyware.

Whether you are an individual or an organization of any sort, please consider a CAUCE membership.

What can I do about child pornography spam?

According to the US Customs Service: "There is no easy formula for discovering and identifying a consumer or purveyor of child pornography. However, if you have information about or suspect this type of illegal activity, contact the U.S. Customs Service as soon as possible. Call 1-800-BE-ALERT.

The U.S. Customs Service also works closely with the National Center for Missing and Exploited Children to combat the proliferation of this disturbing material. You can also report suspicious activity relating to child pornography to their "Tipline" at 1-800-843-5678. In addition, the Interpol website gives an email address of "children@interpol.int" as an address to report suspected child pornography. The address accepts mail but doesn't provide any feedback on what action will be taken. Given this uncertainty, reporting it via email isn't a bad thing to do, but we would suggest people in the US contact the US Customs service first.

Canaidan Residents should review Cybertip.ca for information and help.

How do you define "spam"?

The definition of "spam" is a tricky issue. The Wikipedia defines spam as "e-mail that is both unsolicited by the recipient and sent in substantively identical form to many recipients." Others believe "bulkiness" is irrelevant, it's merely a matter of whether the message was sent with the consent or knowledge of the recipient. Many other debates center around the content of the message and weather bulk is relevant to the commercial content of the message.

Due to the nature of Internet email technology, each email message, whether it is bulk or not, whether it is solicited or not, whether it is commercial or not, costs the recipient more than it costs the sender in terms of both money and resources. These are facts that make the definition of spam very tricky and lead to several differing view points on this topic.

As the Coalition Against Unsolicited Commercial Email, we believe the largest and most pressing problem is unsolicited commercial email (UCE). This decision is mostly one of political necessity: there is substantial concern raised by proposals that could affect non-commercial speech. While many of us believe there is a strong legal case to be made for treating non-commercial spam (such as political or religious spam) no differently, today's US Congress simply does not have the political will to go after those who cannot be shown to be subsidizing their commercial activities on the unwilling backs of others. This is not to say that unsolicited email of any content, sent once or in bulk, isn't a part of the spam issue as a whole. CAUCE has simply chosen to limit our efforts to UCE. Thus, CAUCE has chosen to cut off one slice of the spam problem and address it first, however this does not imply that other forms of email abuse will be ignored or avoided.

The United States Government divided email, in the CAN-SPAM act of 2003, into two classes; Commercial email and Transactional email. These are defined as something that a reasonable consumer would understand to be selling or marketing a product (ex: Up-sell or new product information) and something that is offering a transactional response (ex: billing receipt, support ticket)

CAUCE (US) and CAUCE Canada positions on WHOIS data

The following message was sent in response to ICANN's solicitation of public commentary regarding the concept of obfuscating WHOIS data:

CAUCE, the Coalition Against Unsolicited Commercial E-mail and CAUCE Canada are the leading North American grassroots anti-spam organizations. They are both members of many cross-industry groups including the London Action Plan and the Anti-Spyware Coalition . Both CAUCE and CAUCE Canada are accredited ICANN At Large Structures. Spam and related misbehavior such as phishing and spyware take a heavy toll on Internet users. Networks large and small devote an ever-increasing part of their resources to anti-spam measures merely to keep their e-mail usable. Phishing and other online fraud cause direct damage to the users who are tricked into responding, and cause all Internet users to be less confident in the Internet and less willing to use it.

WHOIS has always been a key tool for both networks and law enforcement to track and shut down spammers and phishers. Both private and government investigators use it every day to track spammers. Even forged data, which is regrettably common in WHOIS, still allows skilled investigators to link domains to habitual spammers by way of patterns found in the data. The vast majority of Internet users will never register a domain of their own, and are instead consumers of domains. We are primarily concerned with the interests of the non-registrant majority, but we recognize that some registrants do have privacy concerns, and believe that existing registrar anonymizing servers are adequate to protect them and do not put an unreasonable burden on registrants. A change to WHOIS that allows criminals a further opportunity to obfuscate their activities by cloaking all WHOIS data will lead to increased levels of privacy violations of by way of spam, viruses and spyware. Removing WHOIS data might provide marginally more privacy to the relatively small number of individuals who register domains, at a disproportionate cost to Internet users at large. We oppose such a change.

CAUCE Joins the Anti-Spyware Coalition

CAUCE recently joined the Anti-Spyware Coalition.

The ASC is a group of anti-spyware software companies, academics, and consumer groups such as CAUCE. It seeks to bring together a diverse array of perspective on the problem of controlling spyware and other potentially unwanted technologies. It has created a common set of software behavior that can be characteristic of spyware, and is also working on consumer tips.

CAUCE joins its neighbor CAUCE Canada, already an ASC member, to work in the areas where anti-spam and anti-spyware efforts overlap, particularly in laws against fraudulent computer activity. The problems of spam and spyware share the complicating factor that the same activity might be legitimate or not depending on whether the recipient has given permission. The identical mail from a mailing list could be legitimate to a recipient who'd asked for it but spam to a recipient who hadn't. Similarly, a program that remotely controls a user's web browser could be legitimate if used as a support tool with the user's consent, or spyware otherwise.

CAUCE looks forward to working with the ASC in areas of shared concern.

Kodak gets wrist slapped for spamming

Kodak settled a CAN SPAM suit with the FTC. Their Ofoto unit, which lets people upload digital photos and buy prints, sent two million commercial messages that didn't comply with the very mild requirements of CAN SPAM. In particular, they didn't include a notice that it was an ad, didn't include opt-out info, and didn't include Kodak's postal address. They paid the FTC $26,000, the revenue they got from the two million illegal messages. Kodak claims (not altogether inplausibly) that it was a technical screwup. But $26K for two million messages does seem like a rather low response rate, doesn't it?