CAUCE

What can I do about child pornography spam?

According to the US Customs Service: "There is no easy formula for discovering and identifying a consumer or purveyor of child pornography. However, if you have information about or suspect this type of illegal activity, contact the U.S. Customs Service as soon as possible. Call 1-800-BE-ALERT.

The U.S. Customs Service also works closely with the National Center for Missing and Exploited Children to combat the proliferation of this disturbing material. You can also report suspicious activity relating to child pornography to their "Tipline" at 1-800-843-5678. In addition, the Interpol website gives an email address of "children@interpol.int" as an address to report suspected child pornography. The address accepts mail but doesn't provide any feedback on what action will be taken. Given this uncertainty, reporting it via email isn't a bad thing to do, but we would suggest people in the US contact the US Customs service first.

Canaidan Residents should review Cybertip.ca for information and help.

How do you define "spam"?

The definition of "spam" is a tricky issue. The Wikipedia defines spam as "e-mail that is both unsolicited by the recipient and sent in substantively identical form to many recipients." Others believe "bulkiness" is irrelevant, it's merely a matter of whether the message was sent with the consent or knowledge of the recipient. Many other debates center around the content of the message and weather bulk is relevant to the commercial content of the message.

Due to the nature of Internet email technology, each email message, whether it is bulk or not, whether it is solicited or not, whether it is commercial or not, costs the recipient more than it costs the sender in terms of both money and resources. These are facts that make the definition of spam very tricky and lead to several differing view points on this topic.

As the Coalition Against Unsolicited Commercial Email, we believe the largest and most pressing problem is unsolicited commercial email (UCE). This decision is mostly one of political necessity: there is substantial concern raised by proposals that could affect non-commercial speech. While many of us believe there is a strong legal case to be made for treating non-commercial spam (such as political or religious spam) no differently, today's US Congress simply does not have the political will to go after those who cannot be shown to be subsidizing their commercial activities on the unwilling backs of others. This is not to say that unsolicited email of any content, sent once or in bulk, isn't a part of the spam issue as a whole. CAUCE has simply chosen to limit our efforts to UCE. Thus, CAUCE has chosen to cut off one slice of the spam problem and address it first, however this does not imply that other forms of email abuse will be ignored or avoided.

The United States Government divided email, in the CAN-SPAM act of 2003, into two classes; Commercial email and Transactional email. These are defined as something that a reasonable consumer would understand to be selling or marketing a product (ex: Up-sell or new product information) and something that is offering a transactional response (ex: billing receipt, support ticket)

CAUCE (US) and CAUCE Canada positions on WHOIS data

The following message was sent in response to ICANN's solicitation of public commentary regarding the concept of obfuscating WHOIS data:

CAUCE, the Coalition Against Unsolicited Commercial E-mail and CAUCE Canada are the leading North American grassroots anti-spam organizations. They are both members of many cross-industry groups including the London Action Plan and the Anti-Spyware Coalition . Both CAUCE and CAUCE Canada are accredited ICANN At Large Structures. Spam and related misbehavior such as phishing and spyware take a heavy toll on Internet users. Networks large and small devote an ever-increasing part of their resources to anti-spam measures merely to keep their e-mail usable. Phishing and other online fraud cause direct damage to the users who are tricked into responding, and cause all Internet users to be less confident in the Internet and less willing to use it.

WHOIS has always been a key tool for both networks and law enforcement to track and shut down spammers and phishers. Both private and government investigators use it every day to track spammers. Even forged data, which is regrettably common in WHOIS, still allows skilled investigators to link domains to habitual spammers by way of patterns found in the data. The vast majority of Internet users will never register a domain of their own, and are instead consumers of domains. We are primarily concerned with the interests of the non-registrant majority, but we recognize that some registrants do have privacy concerns, and believe that existing registrar anonymizing servers are adequate to protect them and do not put an unreasonable burden on registrants. A change to WHOIS that allows criminals a further opportunity to obfuscate their activities by cloaking all WHOIS data will lead to increased levels of privacy violations of by way of spam, viruses and spyware. Removing WHOIS data might provide marginally more privacy to the relatively small number of individuals who register domains, at a disproportionate cost to Internet users at large. We oppose such a change.

CAUCE Joins the Anti-Spyware Coalition

CAUCE recently joined the Anti-Spyware Coalition.

The ASC is a group of anti-spyware software companies, academics, and consumer groups such as CAUCE. It seeks to bring together a diverse array of perspective on the problem of controlling spyware and other potentially unwanted technologies. It has created a common set of software behavior that can be characteristic of spyware, and is also working on consumer tips.

CAUCE joins its neighbor CAUCE Canada, already an ASC member, to work in the areas where anti-spam and anti-spyware efforts overlap, particularly in laws against fraudulent computer activity. The problems of spam and spyware share the complicating factor that the same activity might be legitimate or not depending on whether the recipient has given permission. The identical mail from a mailing list could be legitimate to a recipient who'd asked for it but spam to a recipient who hadn't. Similarly, a program that remotely controls a user's web browser could be legitimate if used as a support tool with the user's consent, or spyware otherwise.

CAUCE looks forward to working with the ASC in areas of shared concern.

Kodak gets wrist slapped for spamming

Kodak settled a CAN SPAM suit with the FTC. Their Ofoto unit, which lets people upload digital photos and buy prints, sent two million commercial messages that didn't comply with the very mild requirements of CAN SPAM. In particular, they didn't include a notice that it was an ad, didn't include opt-out info, and didn't include Kodak's postal address. They paid the FTC $26,000, the revenue they got from the two million illegal messages. Kodak claims (not altogether inplausibly) that it was a technical screwup. But $26K for two million messages does seem like a rather low response rate, doesn't it?

FTC sort of says that CAN SPAM sort of works

The CAN SPAM act required that the Federal Trade Commission report back after a year, which they did, releasing the report almost as an afterthought with a press release about some international anti-spam enforcement at http://www.ftc.gov/opa/2005/12/buttonpushers.htm.

The goals of the CAN SPAM act were to make life better for large bulk mailers, and to make it somewhat easier to go after the crooks. (Note that stopping UBE or UCE isn't in that list.) It did both of those reasonably well, as the FTC documents. They then go on to say that one thing it didn't do was to give them the authority to work closely with other governments to deal with spammers active in multiple countries, and they suggest some legislation to do so.

We think it's fine to give the FTC better international enforcement powers, but it's no substitute for an actual anti-spam law. One of the CAUCE board members has further thoughts in his blog at http://weblog.johnlevine.com/Email/ftcreport.html.

CAUCE Joins the London Action Plan and the Anti-Spyware Coalition

CAUCE Canada, CAUCE U.S., and Asia-Pacific CAUCE (APCAUCE) have joined the London Action Plan (LAP). The LAP is a project started by government consumer protection agencies like the US Federal Trade Commission, the UK Office of Fair Trading, and the our governmental contingent includes both Industry Canada and the Competition Bureau. Many European and Asian governments participate as well. CAUCE looks forward to working with the various governments to help enforce the anti-spam laws that exist, to better understand how the laws do and don't work, and to learn how better laws might be written. CAUCE Chair Neil Schwartzman attended the meetings in London in October, 2005.

We've also joined the Anti-Spyware Coalition, a group of makers of anti-spyware software and public interest groups. The ASC is hoping to build consensus about definitions and best practices in the area of spyware and other unwanted technologies. The group is made up of representatives from the Center for Democracy & Technology, the Canadian Internet Policy and Public Interest Clinic, AOL, Microsoft, McAfee, Symantec and many others. While spyware isn't CAUCE's direct area of concern, the legal remedies overlap with those against spam, and the bits of the government that address spyware are the same ones that address spam. The ASC has had several private meetings to work on policy; Neil Schwartzman and John Levine attended the meetings held in Chicago and Berkeley, California in recent months. The ASC will be holding public events on February 9, 2006 in Washington D.C. and on May 16, 2006 in Ottawa.

New California Antispam Law

In late September, California enacted a new SB 97, a new version of the 2003 spam law that was overridden by CAN SPAM before it went into effect.

Both spam bills and the phishing bills were introducted by Sen. Kevin Murray, one of a handful of state legislators with an interest in online commerce. The new law basically reconstitutes what it can of the old law that isn't preempted. CAN SPAM says states can make fraudulent e-mail more illegal, so that's what it does.

If a commercial e-mail advertisement uses a third party domain name without permission, or has forged header information, or a misleading subject line, it's illegal in California. More interestingly, any of the recipient, the recipient ISP, or the Attorney General can sue for $1000 per message, up to a million dollars per incident.

Oklahoma man wins $10 million judgement against a spammer

On Thursday the 22nd, Robert Braver, an Oklahoma ISP owner who is a long time activist against both spam and junk faxes received a default judgement of over $10 million against high profile spammer Robert Soloway and his company Newport Internet Marketing. Soloway has frequently been cited as one of the ten largest spammers in the world.

Braver originally filed his case in state court, but Soloway moved the case to Federal court earlier this year. Soloway was initially represented by attorneys, but the attorneys withdrew from the case and since then, although Solway said he'd be representing himself, he hasn't responded in the case, although he has been actively sending comments about it to usenet and mailing lists.

CAUCE offers advice on Katrina relief donations

Did you get e-mail asking you to contribute to Katrina relief? Unfortunately, many such requests are fraudulent.

After every natural disaster in recent years, spammers have always sent fake appeals, preying on the good intentions of generous Americans. It happened after the tsunami, and it was sadly predictable that it would happen now.

FEMA, the Federal Emergency Management Agency has a web page listing reputable organizations accepting donations. We encourage you to check their list before donating to a charity that you're not already familiar with.