CAUCE

J.D. Falk - In Memoriam

Jesse David “J.D.” Falk - May 24, 1974 - November 16, 2011

It is with the heaviest of hearts that CAUCE must make note of the passing of one of our own. J.D. Falk was a founder of CAUCE, and one of the nicest people in the anti-spam community.

Besides being a board member of CAUCE U.S. since its inception in 1997, he went on to support the organization as a member of the CAUCE North America Executive. His tireless efforts helped to make CAUCE what it is today.

During his career, J.D. worked at Erols, Priori, Critical Path, MAPS, Yahoo!, Microsoft, and Return Path, but perhaps his most important contributions in fighting online abuse were to the Messaging Anti-abuse Working Group, wherein his tireless efforts organizing the MAAWG meetings were literally immeasurable.

J.D. was a prolific author, his writing published on CircleID, at his employer Return Path’s website, and in the RFC process at the Internet Engineering Task Force (IETF). His contributions went far towards making the Internet a better, safer place for us all.

J.D. was one of a kind,” said CAUCE President John Levine. “Everyone knew him, everyone trusted him, and everyone knew they could count on him to see the real issues.”

J.D. was so very well respected that a professional standards organization, the Internet Engineering Task Force, pulled out all the stops to honor him in his last days. His friends and colleagues Dave Crocker and Murray Kucherawy explain:

The IETF publishes technical specifications and related documents through a series that was started with the beginning of the Internet, called Request for Comments (RFC); the name reflects the Internet's origins as a research body more than 40 years ago.

JD had a document in the approval process (see notice below). J.D.'s document had already been approved by the IETF and it was in the last stages of document editing by the RFC staff.  A small group of us asked whether they could expedite the process, more quickly than the expected two months. The IETF staff recruited a technical editor at 1:30am, her time, in New York and she completed the work by the end of the day. J.D. was shown this final draft for his approval, hours before he passed away.

Although the reason was extraordinary, this sort of willingness to help has always been at the core of this small Internet community that JD had joined, and contributed to, throughout his professional life.

J.D. died before his time from cancer. His intelligence, gravitas, good humor and considered opinions were invaluable, CAUCE, and the Internet community, are the poorer for his passing.

CAUCE extends our most heartfelt of condolences to his family and his friends.

Please feel free to share your memories of J.D. Falk at http://jdfalkmemorial.org/

Please read these tributes as well:

Return Path

MAAWG

CircleID

A collection of J.D.'s technical writing can be found at Return Path's Received: Blog

 

From: "rfc-editor@rfc-editor.org" <rfc-editor@rfc-editor.org>

Subject: RFC 6449 on Complaint Feedback Loop Operational Recommendations

Date: 16 November, 2011 11:58:54 PM EST

To: "ietf-announce@ietf.org" <ietf-announce@ietf.org>, "rfc-dist@rfc-editor.org" <rfc-dist@rfc-editor.org>

Cc: "rfc-editor@rfc-editor.org" <rfc-editor@rfc-editor.org>

A new Request for Comments is now available in online RFC libraries. 

       RFC 6449

       Title:      Complaint Feedback Loop Operational Recommendations 

       Author:     J. Falk, Ed.

       Status:     Informational

       Stream:     IETF

       Date:       November 2011

       Mailbox:    ietf@cybernothing.org

       Pages:      31

       Characters: 75139

       Updates/Obsoletes/SeeAlso:   None

 

       I-D Tag:    draft-jdfalk-maawg-cfblbcp-03.txt

       URL:        http://www.rfc-editor.org/rfc/rfc6449.txt

 

Complaint Feedback Loops similar to those described herein have

existed for more than a decade, resulting in many de facto standards

and best practices.  This document is an attempt to codify, and thus

clarify, the ways that both providers and consumers of these feedback

mechanisms intend to use the feedback, describing some already common

industry practices.

 

This document is the result of cooperative efforts within the

Messaging Anti-Abuse Working Group, a trade organization separate

from the IETF.  The original MAAWG document upon which this document

is based was published in April, 2010.  This document does not

represent the consensus of the IETF; rather it is being published as

an Informational RFC to make it widely available to the Internet

community and simplify reference to this material from IETF work.

This document is not an Internet Standards Track specification; it is

published for informational purposes.

 

INFORMATIONAL: This memo provides information for the Internet community.

It does not specify an Internet standard of any kind. Distribution of

this memo is unlimited.

 

This announcement is sent to the IETF-Announce and rfc-dist lists.

To subscribe or unsubscribe, see

 http://www.ietf.org/mailman/listinfo/ietf-announce

 http://mailman.rfc-editor.org/mailman/listinfo/rfc-dist

 

For searching the RFC series, see http://www.rfc-editor.org/rfcsearch.html.

For downloading RFCs, see http://www.rfc-editor.org/rfc.html.

 

Requests for special distribution should be addressed to either the

author of the RFC in question, or to rfc-editor@rfc-editor.org.  Unless

specifically noted otherwise on the RFC itself, all RFCs are for

unlimited distribution.

 

The RFC Editor Team

Association Management Solutions, LLC

Five Countries are Considering Anti-spam Laws

The international press is alight with reports of various countries considering privacy and anti-spam legislation. It appears that many countries have arrived at the logical conclusion that after years of supposed 'self regulation'; some marketers must be brought to heel by way of regulation and law, to stop abusive practices.

Qatar called for comments on their draft Personal Information Privacy Protection Law. Inside Privacy had this to say:

This is a groundbreaking development as, should the law be enacted, it will make Qatar the only country in the Middle East to have nationally-applicable data protection legislation.

The proposed definition of 'personal information' extends to any information that can reasonably be linked to a specific individual, irrespective of whether that individual can be identified, thus covering location data. Views are sought on whether the law should include the principle of Privacy by Design by imposing an obligation to design and develop products, systems and services so that privacy protection is included from the outset. The idea of accountability has also been included.

The National reports that some there are encouraging the United Arab Emirates to consider data protection laws along the lines of the Qatari legislation.

South Africa is currently considering comments received regarding their proposed 'Protection of Personal Information Bill'. The Internet Service Providers` Association of South Africa (ISPA) was particularly concerned about an Opt-out registry possibly being run by the Direct Marketing Association of South Africa (DMASA):

... the legislature should retain the clauses that require marketers to get explicit 'opt-in' from consumers before sending them electronic marketing messages.

There was also an editorial published supporting Opt-in as the way to go:

Spam opt-out the way we want it

If there were to be a national opt-out registry to fight back against the tide of spam, what should it look like? How about we consumers set the ground rules?

... the very people that exist to further the aims of companies that fill your inbox with rubbish (the Direct Marketing Association of South Africa (DMASA)) want to be in charge of keeping your inbox clear.

Meanwhile in India, it is reported that the Government to put end to unsolicited telemarketing messages, calls

Telecom Minister Kapil Sibal informed the Rajya Sabha that the mechanism to end the misery of mobile users will take another six weeks to be put in place. The measure would follow the government's earlier failed attempt to stop pesky callers from harassing mobile phone users with voice SMSes.

Like in the previous mechanism, those who do not want to receive unsolicited messages could register their cell numbers with 1909 - the National Do-Not- Call (NDNC) registry created by the Telecom Regulatory Authority of India (Trai).

Lastly, in Pakistan, the telecommunications authority is warning marketers to cease & desist spamming, or they will invoke what is perhaps the best title for a law CAUCE has ever seen, the “Protection from Spam, Unsolicited fraudulent and obnoxious communication Regulations, 2009” The text of the regulation can be found here.

Facebook has stolen all the contents of mobile address books, including private telephone numbers

As you know, Facebook have a long, storied history, including several ongoing brushes with the Privacy Commissioner of Canada, and despite repeat warnings against abuse of end-user rights, they recently deployed facial recognition software with no notice given their 500,000,000 users.

Today, however was the straw that broke the camel's back. Unbeknowst to me, perhaps by way of their new 'Facebook messanger' [update: actually, by way of Facebook's iPhone app.] they have uploaded the address books of hundreds of millions of users' mobile phones.

I found the home, private, business and mobile telephone numbers of 700 friends, colleagues, co-workers, and associates (Facebook users or not) published on their site [update: on my account only - at least, for the moment, but nonetheless up on Facebook] - I never agreed to this, I never knew about this, and it was only by way of the Sophos blog post below that I discovered this.

To check to see if you have had the same unfortunate thing happened to you:

1. Log into Facebook
2. Click on Account (upper RH corner)
3. Click 'edit friends'
4. Click 'contacts' (LH side)

(There is the option to disable this feature. Turn OFF synching on your mobile phone, then go here)

update: CAUCE Director Matt Sergeant had this to say on his blog - he nails exactly what is wrong with this:

Addressing the latest Facebook privacy issue

(This is a non-work post, but Disclaimer: I work for Symantec and regularly talk publicly about security issues)

There’s been lots of talk today online about the latest Facebook privacy debacle whereby they have all your cell phone contacts listed on your “Contacts” page.

Facebook have been trying to quiet the storm, as people are posting to their status updates for people to disable this.

First, to combat some FUD: Facebook is not sharing this information from you with your friends. Your buddies aren’t going to be able to call up your Grandma.

But what Facebook have entirely ignored, and why this is again an issue, is the question of permission.

I have two phones. One is a work phone (BlackBerry), and one is my personal iPhone. The only phone the contacts I had listed on Facebook came from is my BlackBerry, which is good, because I have a lot of random old numbers in my iPhone (don’t ask!).

So what happened here? I believe that the latest BlackBerry Facebook app (which recently underwent a major upgrade) automatically set the preference to sync contacts with Facebook. Now it may very well have been in the multi-page user agreement that I accepted, but yes I admit, I don’t read those things. And those agreements don’t even appear on the iPhone version, because, and here’s the fundamental difference I guess: the iPhone version doesn’t transparently change your preferences.

Facebook needs to stop that. I don’t care if it’s useful, or if you’re not sharing it with anyone else. I don’t want you uploading my contacts to your servers without ASKING me first.

It’s that simple. And this is why there are laws against what they have done in various countries, and why this will probably result in yet another lawsuit against them.

Rant over.

CAUCE are stunned by this move, it is beyond the ken. We will be calling upon Facebook to remove this facility immediately (it should always bo opt-in by default, as should ALL end-user options) and failing that, filing complaints with the proper authorities.

See more: http://nakedsecurity.sophos.com/2011/08/11/has-facebook-got-your-mobile-number-now-your-friends-do-too

--
Neil Schwartzman
Executive Director
CAUCE : The Coalition Against Unsolicited Commercial Email

Industry Canada Regulations for CASL

As part of the official process to launching Canada’s new Anti-spam legislation Industry Canada has released their definitions and regulations for C-28 (aka. CASL, FISA, ECPA).

The Highlights are as follows:

Personal Relationship: Where an individual has met with the person to whom the message is sent in a non-business context, and where there is evidence of non-commercial communication between the individuals within the previous two years.

Family Relationship: for the purposes of the Anti-spam Legislation to be in keeping with definitions in the Income Tax Act. It also specifies that it is intended to refer to persons descending from a common grandparent, including aunts, uncles, cousins, nieces, and nephews.

Express consent under the Anti-spam Legislation means that commercial communication may not take place unless the person or corporation in question first consents to be contacted.

Implied consent means that commercial communication may take place with persons or corporations under circumstances where it can be deemed that they might be interested, but the recipients of the communication must be able to “opt out” of such communication.

The second element of the Regulations states that consent to receive messages from a third party is only valid if the individual providing consent will have the ability to unsubscribe to the message, and by the same means be able to alert the original requester that their consent is withdrawn.

The proposed Regulations define “membership” as having applied for, met the formal requirements to belong to an organization, paid any fees required to belong to an organization, and having been accepted as a member in accordance with the membership requirements of the organization.

The proposed Regulations define “club,” “association” or “voluntary organization” as a non-profit organization that is organized and operated exclusively for social welfare, civic improvement, pleasure or recreation or for any other purpose than profit, if no part of the income of which was payable to, or otherwise available for the personal benefit of any proprietor, member or shareholder of that organization unless the proprietor, member or shareholder is an organization the primary purpose of which is the promotion of amateur athletics in Canada.

 

It is important to note that these regulations are in addition to the CRTC's regulations (Unsubscribe, Identification and Consent have been regulated by the CRTC) and the Office of the Privacy Commissioner’s regulations and are not a replacement to the others, which exist concurrently.

Comments are welcomed byIndustry Canada: “Interested persons may make representations concerning the proposed Regulations within 60 days after the date of publication of this notice.”

 

- Matt Vernhout, CAUCE (re-published with permission from Email Karma)

CRTC Publishes Regulations, another step towards CASL coming into Force

Happy Canada Day from the CRTC

As anticipated, the CRTC took a long-awaited step towards Canada's Anti-spam Law coming into force; regulations designed to help define the scope and impact of the law were published late afternoon, June 30. They are available in their full form here: http://www.crtc.gc.ca/eng/archive/2011/2011-400.htm

They are quite terse, coming in at less than 440 words. CAUCE will comment here in due course, but for your instant gratification, here they are:

The proposed regulations prescribe the form and certain information to be included in a CEM. They establish that a CEM must set out information that identifies the sender of the message and, if different, the person on whose behalf the message is sent, as well as, if applicable, the names of those persons’ businesses. The CEM is also to include information that would enable the recipient to readily contact such persons. Further, the proposed regulations prescribe that this information, as well as the unsubscribe mechanism, be set out clearly and prominently.

The proposed regulations also specify a particular form by which information relating to the sender of the message and the unsubscribe mechanism may be accessed, in circumstances where it is not practicable to include such information in a CEM, for instance, because of character limitations.

Section 6 of the Act prohibits the sending of a CEM unless there is express or implied consent from the recipient of that message. Section 7 of the Act prohibits, absent express consent, the alteration of transmission data in an electronic message which results in the message being delivered to a different destination. Section 8 of the Act prohibits the installation of a computer program unless express consent has been obtained. The Commission’s proposed regulations prescribe the form of a request for express consent for the purposes of subsections 10(1) and 10(3) of the Act. More specifically, the proposed regulations stipulate that any request for express consent must clearly identify the person seeking consent and, if different, the person on whose behalf consent is sought, and, if applicable, the names of those persons’ businesses. In addition, it is proposed that contact information be included for such persons, and further, that there be a requirement to include a statement which states that consent may be withdrawn using the contact information provided.

The focus of the final segment of the proposed regulations is the installation of computer programs in the course of a commercial activity, which, as noted above, is addressed in section 8 of the Act. The proposed provisions prescribe that additional information be provided when requesting express consent if a computer program that performs a function set out in subsection 10(5) of the Act is to be installed. In such circumstances, the proposed regulations prescribe the manner in which the computer program’s material elements must be brought to the attention of the person from whom consent is being sought, and further establish that the person seeking consent must obtain a written acknowledgement from the person from whom consent is sought that they understand and agree that the program performs the specified functions.

MAAWG Honors Internet Volunteer Neil Schwartzman With First MAAWG Mary Litynski Award

News Release

For Immediate Release        

 

MAAWG Honors Internet Volunteer Neil Schwartzman

With First MAAWG Mary Litynski Award

San Francisco, June 16, 2011 – Recognizing the value of one person’s effort to generate positive change in the messaging industry, the Messaging Anti-Abuse Working Group presented its first annual MAAWG Mary Litynski Award to Neil Schwartzman at its 22^nd general meeting on June 8 in San Francisco.  The award acknowledged Schwartzman’s extensive volunteer efforts working against spam for the last twenty years, and the presentation can be viewed on the MAAWG YouTube channel at http://www.youtube.com/MAAWG?feature=mhee

A messaging compliance consultant, Schwartzman has served on the Canadian Federal Task Force on Spam and is a founding member and currently executive director of CAUCE, the Coalition Against Unsolicited Commercial Email, an international all-volunteer consumer advocacy organization working to defend the interests of the average Internet user.  He is secretary of the MAAWG Public Policy Committee and involved in several of the association’s other projects, and is active in other industry organizations including the London Action Plan (LAP) and the Anti-Phishing Working Group (APWG).  Schwartzman also worked toward the passage of the new Canada Anti-Spam Law (CASL).

“Neil reminds us that backing down from the challenge of messaging abuse is not an option for those committed to maintaining an open and effective Internet.  He brings energy and expertise to our community, with a passion and concern that rises above his own personal interests,” MAAWG Chairman Michael O’Reirdan said.

According to Schwartzman, “Industry collaboration is the only way, to my mind, that we can effectively deal with spam. There is no silver bullet. A unified strategy involving cross-sector industrial cooperation, technologists and public policy advisors – providing a seat at the table for all stakeholders – is the proven way forward.”

The award was named for Mary Litynski, who worked tirelessly to serve MAAWG members since the organization’s founding in 2004 and who passed away in 2010 after a courageous battle with cancer.  The honor was initiated in her memory this year to recognize an unsung industry hero who also works behind the scenes to make the Internet a safer place for all.

About the Messaging Anti-Abuse Working Group (MAAWG)

The Messaging Anti-Abuse Working Group (MAAWG) is where the messaging industry comes together to work against spam, viruses, denial-of-service attacks and other online exploitation. MAAWG (www.maawg.org) represents more than one billion mailboxes from some of the largest network operators worldwide. It is the only organization addressing messaging abuse holistically by systematically engaging all aspects of the problem, including technology, industry collaboration and public policy. MAAWG leverages the depth and experience of its global membership to tackle abuse on existing networks and new emerging services. It also works to educate global policy makers on the technical and operational issues related to online abuse and messaging. Headquartered in San Francisco, Calif., MAAWG is an open forum driven by market needs and supported by major network operators and messaging providers.

#  #  #

 

Media Contact: Linda Marcus, APR, 714-974-6356, lmarcus@astra.cc, Astra Communications

MAAWG Board of Directors: AOL; AT&T (NYSE: T); Cloudmark, Inc.; Comcast (NASDAQ: CMCSA); Cox Communications; Facebook; France Telecom (NYSE and Euronext: FTE); Openwave Systems (NASDAQ: OPWV); PayPal; Return Path; Tata Communications (NYSE: TCL); Time Warner Cable; Verizon Communications; and Yahoo! Inc.

MAAWG Full Members: 1&1 Internet AG; Adaptive Mobile Security LTD; Apple Inc.; Cisco Systems, Inc.; Constant Contact (CTCT); Edatis; e-Dialog; Eloqua; Email Sender and Provider Coalition; Experian CheetahMail; Genius.com; Internet Initiative Japan, (IIJ NASDAQ: IIJI); McAfee Inc.; Message Systems; Scality; Spamhaus; Sprint; Symantec; Trend Micro, Inc.; and YouSendIt.

A complete member list is available at http://www.maawg.org/about/roster

CAUCE Director Neil Schwartzman Wins Prestigious MAAWG Award

CAUCE Executive Director Neil Schwartzman won the prestigious Mary Litynski award on June 08, 2011 for his contributions to Internet anti-abuse efforts, including the passage of Canada's Anti-Spam Law. Here is his acceptance speech.

This is not the first award I've received from the MAAWG community. A few years ago, at a meeting in Washington, D.C., I received an honorary doctorate when recognized me as Dr. Evil. At the past meeting, at Disney, you honored me with a t-shirt branding me as Grumpy, from the Seven Dwarves.

As much as I treasure those memories, this award is very special to me.

Mary Lytinski was a warm, helpful, friendly person. It is nice to see that MAAWG is applying these criteria when deciding a suitable winner of the award in her name.

Seeing Mary at the registration desk was our opening ritual three times a year, and her greeting -- no matter how busy -- told every attendee that this was going to be a good meeting. Mary's contribution to our community and our cause cannot be measured.

I can’t begin to express my gratitude for this award, named in honor of our old friend; I am profoundly humbled, particularly when we consider the roster of others in our community undeniably as deserving of recognition.

My contributions to the Internet community, like that of so many others, began as a volunteer. To some, that might be a puzzling thing, to do something without financial recompense. To others, most in this room, it is the most natural thing of all.

There are a number of reasons why I try to embody a spirit of volunteerism. For one, my mother volunteered her time throughout her life. She undoubtedly passed this aspect on to me.

When I got online in 1992, the net was largely non-commercial. There was no world wide web. It was all about text, and community spirit, and volunteered contributions. Even when employees of a commercial entity worked on standards or software, it was with humility and a sense of collaboration, of building the Internet together.

The commercialization of the net has brought with it some astounding, wonderful new technologies and contributions to our global society. I am able to write to my friend, one of the happiest people I’ve ever met, a peasant girl named Shandy, who lives in rural China, because she has a Hotmail account. A far-flung community was able to express our love and support for our friend and colleague J.D. Falk, by way of Facebook, and email, and AOL Instant Messaging. Perhaps most profoundly, an offshoot of Google, 23andme, allowed me to reconcile with my biological mother, sister and brother, this past weekend after 50 years.

These are the things that motivate me to voluntarily advocate for the anti-abuse community. Because along with all these commercial offerings, there is still a fundamental, precious human element, a drawing together of the global village that criminals, if we let them, would rend asunder. There is still real, honest human communication -- that abusers sully. This human element is the magic intrinsic to the Internet, and something that must be protected. It isn’t just about email systems being spammed, and websites under ddos. It is what they represent -- the people, the data, and the ability to communicate -- that we strive to protect.

The DNA of the Internet, the vast majority of underlying technologies and protocols, were dreamt up and realized by volunteers. Grassroots, volunteer anti-abuse efforts such as my organization, CAUCE, many of the DNSBLs, discussion groups -- all manner of efforts to stave off the wolves at the door, nearly all done on a voluntary basis or as a contribution to the community.

And then there’s MAAWG.

While most of us are paid to be here, involvement in MAAWG can take up a tremendous amount of time. It often encroaches into one’s personal life, or one’s ability to accomplish the balance of our paid work, in effect, MAAWG is very much run by people volunteering of their time, expertise and brilliance.

And so, I accept this award on behalf of all the volunteers past, present and future, my peers and my betters, with the hopes that our work is properly honouring the person for whom this award is named, our dear departed Mary Litynski.

Thank you.

Best Buy and Air Miles notify Alberta, Canada Privacy Commissioner of Epsilon Data Breach

The Office of Information and Privacy Commissioner for the province of Alberta issued a decision [PDF] on May 16, regarding the Epsilon breach that affected the customer lists of 150 different companies, including Best Buy and Air Miles. Both companies operate in Canada.

The Personal Information Protection Act, which went into force May 01, 2010, compels companies to notify their customers in the event of a breach. Both companies did so.

Best Buy and Air Miles proactively reported to the Commissioner that they had been notified by their service provider, Epsilon (a large US based third party marketing organization) that it had experienced a data breach in which 50 million or more email addresses were compromised and that its customers as well as customers of other organizations serviced by Epsilon had been affected. Best Buy and Air Miles had also proactively notified their affected members of the breach within a few days of learning about it.

Commissioner Work reviewed the incident reports by Best Buy and Air Miles and concluded that although the information at issue (name, email addresses and organization membership (in the Best Buy case) was relatively minor compared to other data breaches which involve the unauthorized access of financial or other sensitive information, the sheer magnitude of the breach and the evidence that the information will likely be used for malicious purposes indicated there was a real risk of significant harm to affected individuals. He noted in his decisions that Best Buy and Air Miles had already notified the affected customers in compliance with section 19.1 of the PIPA Regulation, and therefore did not require the organizations to notify again.

CAUCE congratulates both Best Buy and Air Miles, as well as Information and Privacy Commissioner of Alberta, Frank Work on their actions in this regard.

As always, our advice to consumers remains the same: If you received a notices from any company regarding the Epsilon breach, we suggest you change your email address immediately.

Osama bin Laden is Still Alive!

Actually, no, he isn't.

End-users should be extremely careful clicking on any link, from both know and unknow sources (including this one) offering to show you gruesome pictures, proof of him being alive and so on. Spammers have followed their precitable pattern of launching massive campaigns capitalizing on bin Laden's death by email and on social networking sites like Facebook to get you to click through, and potentially infect your computer in the process.

Be careful, don't be fooled.

 

The world's wealthiest countries the main source of spam?

It would certainly appear so, according to these charts, comparing listings at Spamhaus to GDP. CAUCE thanks furio ercolessi who thought to do the comparison.

update: Rob Szarka rightly points out that these are the largest economies, not the world's richest nations.

Country	Live Spam Issues At Spamhaus.org
1 United States	2,370
2 China	898
3 Russian Federation	559
4 United Kingdom	380
5 Japan	258
6 Brazil	254
7 Canada	242
8 France	222
9 Italy	216
10 Germany	214
Country	GDP in Billions of $
United States	$14,620,000
China	$5,745,000
Japan	$5,391,000
Germany	$3,306,000
France	$2,555,000
United Kingdom	$2,259,000
Italy	$2,037,000
Brazil	$2,024,000
Canada	$1,564,000
Russia	$1,477,000