CAUCE

A Dangerous Buzz, and Opt-In Isn't Just for Email

Image by dr.jd via Flickr

Google is great at generating buzz, and they've done it again with their new social vitality tool, appropriately named Google Buzz.

Buzz takes all of your GMail contacts (and presumably other connections from elsewhere within the Googleplex), and makes them all your "friends" by default; it then shares your activity from Google Reader, YouTube, and other tools with all of them, and vice versa.  They can see who your friends are, and you can see who theirs are.  It's a quick & impressive way to make a whole new social network out of the original social networking tool: email.

Only one problem: all of those connections, and all of that public information, happens by default.  You do get to choose whether or not to activate Buzz, but apparently it's activated either way — and if you say no, you won't have access to the nearly-hidden privacy controls.

These may seem like small issues: Facebook already tells the world who you're friends with, and Twitter updates are public by default.  But with both of those, you choose to sign up and you know what you're getting (until it changes.)  Buzz is different: you signed up for GMail, and suddenly this other thing happened too.  Suddenly, things you thought were private are public.  It's tantamount to spyware.

This is all of particular concern to someone like the author of the Fugitivus blog, who writes anonymously about her life — including some truly disturbing experiences, being raised in an abusive family and then married to an abusive husband.  Everyone should have the right to make their own privacy choices; for her, privacy is absolutely required.  Her well-being, perhaps even her life depends on it.

When Google Buzz showed up, it revealed her activity to all of her most common correspondents — which includes her ex-husband.  Things she had thought she was only sharing with her boyfriend and her mother, that she thought she had control over, were now automatically shown to someone she has very good reason to trust no further than her inbox.  See the problem here?

We've talked for years about the "opt-in" paradigm for email: companies and organizations should not send you advertisements unless you've asked for them — even if they believe you'll be interested.  Similarly, companies and organizations should not be sharing your information with others — even if they believe you know the person — without asking first.

Shame on Google for not considering the choice aspect of privacy before launching Buzz.  You know better.

Related articles by Zemanta

• Fugitivus: Fuck you, Google (boxofmeat.net)
• Google: Buzz off! (accmanpro.com)
• Google Buzz: The Missing Features (readwriteweb.com)
• Google Buzz And Their Social Strategy (cloudave.com)
• Is Google Reader Still an RSS Reader? (staynalive.com)
• Google will Improve Buzz based on Users' Feedback (taragana.com)

Keeping Kids Safe on Facebook

Image by hoyasmeg via Flickr

Though some of the technologies and techniques differ, there's a lot of overlap between email safety and social network safety.  Laura Deisley, who speaks about technology with parent groups, has written an extremely complete list of things parents should do to keep their kids' Facebook accounts safe; the same concepts apply equally wel to other social networks & email accounts.

A Word of Warning about your Donation to Charity

Many of us have seen the heart-wrenching scenes from the world’s latest natural disaster, in Haiti, and want to help.

Unfortunately, there are some who would take advantage of the situation, and people’s charitable nature, and put fraudulent requests for money online. As Linda McGlasson over at the Bank Info Security blog said ‘there Is a special place in hell’ for people like this.

Let’s hope so, because the sad, awful truth of it is that Symantec is reporting this morning that they have already seen spam fraudulently claiming to be from the Red Cross, soliciting donations for Haitian Earthquake relief funds. There have been sporadic reports of fraudulent tweets on Twitter, and some Google search results have been skewed in an attempt to divert people to malware and phishing sites.

Do not use links to potentially fake charities from anywhere but the most trusted of reliable sources.

To be safe, check the list of charities at www.whitehouse.gov

If you are in Canada, the Canadian government is matching private donations – you can find more information here.

If you are in another country, check out your federal government’s or local newspapers’ websites to find out where best to send funds.

Lastly, and most importantly, don’t let these bad actors scare you off from doing the right thing. Please donate generously, if for no other reason than to prove the world is a better place than they make it out to be.

By the way, please feel free to repost or tweet this article.

Consumer Alert: Deep Inside a 'Work at Home' Scam: Mules Victimized by "Air Parcel Express"

Here at CAUCE, we don't often post articles unrelated to spam law, but this piece by RSA is remarkably well-written and relevant to all Internet users, particularly during these days of high unemployment. Scam job offers to 'work at home' have appeared on legitimate sites such as LinkedIn, Craiglist, and Monster.com, and even in the classified sections of newspapers. Before accepting such a position, or even engaging the scammers in a discussion please ask yourself 'would anyone really pay me several thousand dollars to receive high-priced goods, or cash their cheques, and if so WHY?' Such workers end up on the hook for receiving stolen goods, or bank fraud, the scammers leave the workers holding the bag. Do yourself a favour, and don't get involved in such scams. If you are wondering if it sounds too good to be true, it always is.

Deep Inside a Reshipping Scam: Mules Victimized by "Air Parcel Express"

by RSA FraudAction Research Lab on 11/12/2009
Since last fall the RSA FraudAction Research Lab has tracked several different reshipping scams engineered by online fraudsters to "Cash Out" merchandise purchased using stolen payment cards through the involvement of mules. We will profile one such scam in-depth — Air Parcel Express — that was discovered by RSA. First we will outline who is involved in a reshipping scam and how they generally operate.

The recipient view of marketing email

CAUCE Treasurer-Secretary Dennis Dayman posted this gem over at deliverability.com, essentially, his wife, a civilian as it were, has some things to say about marketing email.

Should I Stay or Should I Go?

by Neil Schwartzman

"If I stay there will be trouble; …If I go there will be double." — Joe Strummer (1952-2002)

"We can be heroes, just for one day." - David Bowie (1947- ) 

Working in the anti-spam and online malware fight can be depressing or at best invoke multiple personality disorder.

We all know things are bad on the net, but if you want a dose of stark reality, check out Brian Krebs' fantastic Security Fix blog on the Washington Post site. Written with both technical accuracy and readability for the rest of us, a rare thing indeed, Brian is the current raving-fav among the security set, due to his high profile, and willingness to call a spade a spade.

He has shone the spotlight of national media on some real embarrassments, situations like ICANN dragging their feet regarding the decertification of rogue registrar EstDomains (a service much-favoured by malware authors and spammers), (they are now offline), Atrivo, a California-based ISP which played a pivotal role in sustaining the Storm botnet, (they are now offline) and Krebs played a part in the latest victory for us good guys on the net, noting McColo was a host for botnet command-and-control technologies  (yes, they too are now offline!)

So why the ambivalence Neil? Good question! Speaking to an old friend who asked me what I was doing these days, I recently likened the fight against this relentless onslaught to having one's pinky in a dyke, and there are days when I don't even think we have a dyke! We've certainly seen dedicated anti-spam/anti-malware volunteers suffer from burn-out, and drop off, over the years, a loss to all of us as an Internet community.

I need a job, and just got some spiffy email about a new job site!

Posted on behalf of: Neil Schwartzman, Executive Director CAUCE

A friend of mine just wrote to me about a new service called NotchUp.com so I looked them up on DomainTools.

Now, why would a company obfuscate their domain registration? I can't think of a good reason why. That isn't to say that NotchUp.com is not a fine upstanding company, I don't know, but having correct and open information in your domain registration means you are taking responsibility for your online conduct.

Unemployed folks, and others looking to change jobs should be very careful when joining a job recruitment site; they can be real hornet's nest. For one, job applicants are giving out a tremendous amount of personal data that can be misused to the ends of personal identity theft. As well, many of them are not worth the bother, or can be out-and-out malicious.

Another friend was the victim of a drive-by virus-infected when someone ostensibly reached out to him about a VP-level job, one for which he was suitable (he's a sales guy, so it might not have been entirely targeted).

The CAUCE advice?

• Stick with the biggies - to name a few; Linkedin, Monster, Workopolis, Craigslist
• Check out new companies and new job sites from the comfort of your own browser!
• Run the domain through DomainTools
• Get yourself a copy of the great tool from McAfee Site Advisor, a plug-in that works for both Internet Explorer and Firefox, and check out their reviews.
• Use the Alexa Firefox plug-in to check out if the site has a reasonable amount of traffic.
• Use your favourite search engine on the name and the domain name of any potential job site or employer. Then search again and add the qualifier + spam. Or + scam
• Never respond to Unsolicited email
• If the job seems too good to be true, (especially if you are desperate!), stay away!

For example, LinkedIn currently has many 'work at home' jobs touted, money-laundering for 419 and phish-stolen money. Getting involved in those schemes helps sustain spamming, and you can be arrested. (LinkedIn are doing a fine job of deleting these as fast as they come in, but the bad guys slip through, nevertheless)

Good luck with your job search, don't let the bad guys swindle you!

Letter to the Editor: In Support of The Spamhaus Project

A letter to the editor sent to Ken Magill of Direct News / Magilla Marketing
* Reposted with Permission from Neil's Personal Blog.

Ken,

Thank-you for your April 1 column 'Anonymous Group Takes Aim at Spamhaus', it is no joke.

Consider for a moment what the circumstance for the email world would be, were the people behind Online Marketing Advocacy Group to be successful in putting The Spamhaus Project out of business.

Literally hundreds of millions of user inboxes would be left unprotected. Spam would flow, unabated, into them. How then, would users react? I imagine a goodly portion of them would simply give up on the medium. We have already seen evidence of users either migrating to social networking closed gardens or dumping email altogether, how much more tempting will these alternates be in such a world?

ISPs would scramble to put other measures into place, using DNSBLs far more draconian those of Spamhaus.

Legitimate marketers will be severely affected, with a far, far lessened ability to get their messages delivered, or actually seen, amidst the blizzard of spam.

Is a listing on Spamhaus onerous enough to sue the company out of existence? I imagine it must be for some of the highest degree of frustration to be listed at Spamhaus. However, in both my personal and professional life I have never experienced anything but professionalism and ease of use with their products. The clients I have encountered with Spamhaus listings who made the appropriate changes were quickly delisted, plain and simple as that.

I expect of the tens of thousands of legitimate marketers who are not listed at present, some may have had some unfortunate intersection with Spamhaus, and had to change their practices. At present, they are humming along happily. To them I ask - do you like getting your mail to the inbox of your subscribers? Then do not sit on your hands, and allow this pernicious, short-sighted initiative to move forward an inch without a challenge:

Contribute to Spamhaus in any way possible; they surely have a legal defense fund to fight against this spurious attack, pony up some money!

Strictly follow industry guidelines - the Messaging Anti-abuse Working Group has several available through their website (including a terrific new paper on email authentication, check it out - all these documents have been developed with the full participation of senders, receivers, CAUCE and Spamhaus associates.

Agitate in industry associations like the DMA and ESPC to very publicly voice and undertake initiatives against the actions of the cowardly Online Marketing Advocacy Group and indeed for The Spamhaus Project. This may cause some internal pain to these groups. It is my understanding that some of their members, in fact, very vocal members are the main supporters of this attack-dog group. Take a stance, divest yourselves of these sectors of the industry that do nobody any good, far least, the ever-loving recipient of email

Be forewarned, if you don't take an active stance now, today, and these vile back-room people are successful, you will doubtlessly wish you had done so. It will hurt your business, and in these business climes, I'd say that in and of itself is a very brave stance indeed. Good luck with that.

--
Neil Schwartzman
Executive Director
CAUCE: The Coalition Against Unsolicited Commercial Email

Ralsky indictment is good news for all email users

by J.D. Falk

I've always maintained that spam does not make one great, but Al Ralsky kept a relatively high profile for long enough that his unwelcome intrusions into our inboxes — and our friends' inboxes, and our parents' inboxes, and our children's inboxes — will be long remembered.

Today the entire email industry is cheering the arrest and indictment of Ralsky and his gang, which was reported in the Detroit Free Press this morning. It's obviously good news for anti-spammers, who have been clamoring for prosecutions of illegal spamming activity for more than a decade. But it's also wonderful news for the email marketing industry, which has been trying to show the world that they aren't spammers. Now, the marketers can point to Ralsky's illegal activities and state with one voice: "we do not do these awful things."

But I think the marketers have to ask themselves: is there anything Ralsky was doing which isn't illegal per se, but might still be considered spam-like in the eyes of your subscribers? Perhaps a subject line which is only slightly misleading — not enough to violate CAN-SPAM, but enough to violate the trust your subscribers have in your brand. Perhaps treating opt-in as a license to blast them over and over, until your message falls on deaf ears.

If a sender acts like a spammer, even if they aren't bad enough to get arrested, how different are they from Al Ralsky and his ilk?

And likewise, I think the anti-spammers have to consider whether following "big name" spammers is worth the effort. It seems certain that for every high-profile blowhard like Ralsky, there's another dozen who are just as prolific — but, like most other criminals, never seek attention.

This is a great triumph for all who want to preserve email as a viable communications medium. We congratulate the United States Department of Justice and the FBI for their impressive work, and the Spamhaus Project for keeping a close eye on Ralsky's activities for so long.

But this is not the end of spam; far from it.

This article was also published by Return Path.

CAUCE offers advice on Katrina relief donations

Did you get e-mail asking you to contribute to Katrina relief? Unfortunately, many such requests are fraudulent.

After every natural disaster in recent years, spammers have always sent fake appeals, preying on the good intentions of generous Americans. It happened after the tsunami, and it was sadly predictable that it would happen now.

FEMA, the Federal Emergency Management Agency has a web page listing reputable organizations accepting donations. We encourage you to check their list before donating to a charity that you're not already familiar with.