CAUCE

Changes to the CAUCE Board of Directors & New Member

Over the past months, there have been a few changes and it is fitting that we acknowledge them here

Directors Matt Sergeant and Mike 'der mouse' Parker have both resigned, moving on to new ventures outside of the anti-abuse world. We thank them both for their years of service and sage contributions to the CAUCE braintrust. They both now have CAUCE emeritus status.

So as to maintain a full compliment of directors, we are happy to announce the following additions

April lorenzen

Ms. Lorenzen is an anti-spam researcher, speaker and consultant. a Senior Technical Adviser to MAAWG, and CEO of Server Authority Inc.

Jeff Williams

Mr. Williams is a technology strategist specializing in security, privacy and former adjunct professor of risk management and telecommunications. With over twenty years in industry including twelve at Microsoft he has had numerous opportunities to make the internet a better place through the takedown of various botnets, partnership with law enforcement on a variety of matters, consultation with government bodies from numerous countries, and participation in various programs such as Microsoft's Project MARS and Microsoft Security Response Alliance. Jeff is also a regular speaker on a variety of security and privacy topics at industry events and an occasional guest lecturer for universities.

Sam Masiello

Mr. Masiello is the former General Manager, and Chief Security Officer of (CAUCE corporate member) Return Path Inc. He previously worked at McAfee, MX Logic, Inc, and has a BS, Computer Science from the State University of New York at Buffalo.

Welcome to all three of our newest board members!

As well, we would like take this opportunity to welcome Message Bus Inc. as the latest corporate member of CAUCE, joining Return Path, and MailChimp. Welcome, and thank-you all for your support.

Inbound Email Filtering Sued Over Privacy Issues, This Time in Canada

In a case that parallels many of the aspects of the three cases filed in July 2012 in California, against Google & Yahoo!,  retiree Wayne Plimmer of Sechelt, British Columbia filed a class action suit against Google on October 4, 2012.

Here is a copy of the complaint :  Download PlimmerV.Google

The suits alleges that Google has breached sections 1 and 3 of the British Columbia Privacy Act R.S.B.C. 1996 c. 373 and s.52 of the Federal Competition Act R.S.C. 1985 c. C-34

Some news coverage notes that the class has not yet been approved (anyone in British Columbia who has sent email to a Gmail account), and that should this lawsuit be successful, this may prohibit the use of anti-virus and anti-spam software on inbound mail. The suit also alleges that Google invaded users’ privacy, violated solicitor-client, physician-patient, pastor-penitent and journalist-source privilege, and infringed upon copyright.

CAUE President has blogged about the U.S. Federal and California cases here and here 

The BC Privacy Act reads:

Dutch Anti-spam Legal Action

OPTA, the anti-spam Regulator today announced a fine of 100,000 euroes was levied against Companeo SA for sending 15,000,000 spam messages in 2009

Here's a translation of the news release, from the original Dutch:

The OPTA, the Independent Post and Telecommunications Authority, has Companeo SA a fine of
100,000 dollars for sending spam to mostly business recipients. "Sending spam is forbidden
because it causes a lot of frustration and unnecessary costs. Trust in the Internet is
important, especially now that more and more people online are active. "Stresses Chris
Fonteijn, president of OPTA. Companeo sent from late 2009 to early 2011 nearly 15 million
commercial e-mails which was not authorized, or careless manner in which consent was
requested. Companeo stopped the offense, after examination by OPTA was informed of the
investigation.

No permission or careless OPTA is the case on the track thanks to complaints
www.spamklacht.nl . There are a total of 680 complaints about these mailings. The
complainants stated that they Companeo the newsletter and / or emails from
vraaguwofferte.com received, as she had not given here. What was going on? Through the
website of Companeo entrepreneurs can request a custom quote. This application enables
entrepreneurs to check whether they are for the newsletter Companeo to enroll and / or
offers of "Companeo partners' wishes to receive. This is twice the error Companeo detail.
First, the company added all e-mail addresses to its mailing list, whether consent had
been given or not. Secondly, the request for consent on behalf of 'Companeo partners' so
unclear that an entrepreneur when checking it could have no idea who it was held mail.
These mails were sent by vraaguwofferte.com making it for entrepreneurs at all clear was
that the message came from Companeo.

Companeo can still objection and appeal against the fine.

Knowing what is allowed if you electronic messages?
www.spamklacht.nl/ik-verzend-elektronische-berichten/

UK regulators fine text spammers over $400,000

According to a BBC report, the United Kingdom Information Commissioner's Office (ICO) will be levying large fines on mobil phone text spammers. In March the ICO started asking consumers to report unwanted calls, texts, and emails, and was deluged with over 30,000 complaints. After sifting through them, they identified bulk text spammers, and announced fines of over £250,000 (about $400,000) unless the spammers can show that they had the permission of the texts' recipients, which of course they can't.

Here in the US, text spam is illegal under the TCPA, the law that forbids junk faxes and other recipient-pays telephone messages, and a few court cases have confirmed it. The FTC has not made text spam a major emphasis, but given the amount ot text spam we're seeing, they need to, soon.

New MAAWG Award Named in honour of CAUCE Founder J.D. Falk

CAUCE is delighted to see our founding member honoured in such a manner, our sincere thanks go out to MAAWG and Return Path for this fitting gesture.

Seeking to throw a little light on those making the Internet a safer experience for all, the Messaging, Malware and Mobile Anti-Abuse Working Group is now accepting nominations for the first annual J.D. Falk Award, named after the dedicated industry advocate who was instrumental in the growth of M³AAWG and other technical organizations.  The award, developed in conjunction with his employer Return Path, Inc. and his family, celebrates J.D. Falk’s life by honoring a specific achievement that enhances the Internet experience, protects end-users, and embodies his spirit of volunteerism and community building.

Nominees can be individuals or teams in an academic or company environment who have developed a service, created a specification or security mechanism, generated notable research, or produced other work reducing online abuse and improving the Internet.  The award comes with an honorarium provided by Return Path and M³AAWG will sponsor the winning candidate's attendance at the upcoming 26^th M³AAWG General Meeting in Baltimore, Md., Oct. 23-25, where the award will be presented.  

“J.D. was a passionate leader and a creative technician who had an ardent sense of humor that came into play when he was facing down obstacles. He had a gift for bringing people together to accomplish difficult tasks. We believe it’s important to instill these qualities in the future of the Internet and are looking to recognize professionals who embody these values,” said Chris Roosenraad, M³AAWG co-chairman for messaging.

more ...

Nominations for the J.D. Falk Award can be made here

CRTC CASL Regulation Summary

[originally posted at Emailkarma. Written by CAUCE Director Matt Vernhout]

We have found what appears to be an official version of the Canadian Radio-Television and Telecommunications Commissions (CRTC) Canada's Anti-Spam Law CASL regulations on the Canadian Employment Pension Law website along with a brief overview of the regulations.

Here is a quick summary:

Information to be included in an email message has been clarified to included these key identifiers: CEM’s need to be the name by which the person sending the message conducts business, for third party messages you should use the name by which the third party carries on business, and include a statement indicating which person is sending the message and which person on whose behalf the message is being sent.

Contact and mailing address has also been clarified to be; the mailing address of the sender and either a telephone number providing access to an agent or voice messaging system, an email address or a web address of the person sending the message or the person on whose behalf the message is sent.

When it is not possible to include unsubscription information in the CEM you may included that information on a page on the World Wide Web that is readily accessible by the person to whom the message is sent at no cost to them by means of a link that is clearly and prominently set out in the message. This is a big deal for Mobile* messaging and Social Media messages as these platforms and character limitations do not always allow for all of the previously required information… I can’t ever see this being an issue for an email message though.* Mobile Keywords STOP will remain a requirement

All unsubscribe mechanisms referred to in paragraph 6(2)(c) of the Act must be set out clearly and prominently and must be able to be readily performed.

A request for consent has been clarified to include oral or written consent and must be sought separately for each channel (SMS, Email, etc…) of the Act and must include the key identifiers listed above (point 1) along with a a statement indicating that the person whose consent is sought can withdraw their consent at any time.

Computer programs that perform one or more of the functions listed in subsection 10 (5) of the Act [causing a computer system to operate contrary to reasonable expectations] must have a separate consent sought from any other information provided in a request for consent and the person seeking consent must obtain an acknowledgement in writing from the person from whom consent is being sought that they understand and agree that the program performs the specified functions.

What’s Next with CASL?
We are still waiting on the regulations from Industry Canada that will hopefully clarify a number of the outstanding issues and questions that they received during last years comment period. We are expecting to hear from them in the next couple of weeks (Maybe early April) when a new 30 day comment period is scheduled. After these comments are reviewed final regulations will be presented and an enforcement date will be set.

The big question is still outstanding – When is CASL coming into force?

Latest word on this will be at or near the end of Q3 2012 (around October), but the regulations from Industry Canada will clarify this.

Download the CRTC’s Regulations HERE [PDF]

CRTC responds to stakeholder concerns with final regulations under CASL

The Canadian Radio-television and Telecommunications Commission (CRTC) has finalised its regulations under Canada's Anti-Spam Legislation (CASL), resulting in a set of rules that are more balanced, reasonable, and in line with the objectives of the legislation. The new requirements are also more consistent with the requirements under the U.S. CAN-SPAM Act of 2003, with which many senders are already familiar.

CASL creates rules for sending commercial electronic messages (CEMs) and installing computer programs. It also establishes a general prohibition against the alteration of transmission data and is expected to come into force later in 2012. Industry Canada is also responsible for developing regulations, and should be posting another version of its regulations within the next month or so.

The CRTC originally posted draft regulations for comment in June of 2011, which generated a significant number of responses, many of which pointed to the potential challenges for anyone sending email or other electronic messages for business purposes. With these final regulations the CRTC [PDF] has addressed a number of issues raised by stakeholders:

Consent in writing - A request for consent is no longer required to be in writing; rather, consent can be requested orally. This does not give free reign for senders to assert that they have consent without evidence, however, as anyone claiming to have consent bears the burden of proving it under the legislation.

Information to be included in a request for consent/CEM - The CRTC has dialed back the quantity of information to be included when requesting consent and in a CEM. A sender is now required to provide:

the name of the person seeking consent or sending the CEM (or the person on whose behalf consent is sought or sent, if different); (The regulations specify that a person must be identified by the name by which the person carries on business, if different from the actual name of the person).

if the message is sent on behalf of another person, a statement indicating who is or will be sending and on whose behalf the message is or will be sent;

the mailing address and either a telephone number, an email address or web address of the person sending (or on whose behalf) the message is or will be sent;

when seeking consent, a sender must indicate that the individual can withdrawal consent at any time.

The draft regulations would have required a person sending a CEM to provide every electronic address that person uses, as well as a physical, mailing and web address. Furthermore, they would have required a CEM to provide all of that information for the person sending as well as every person on whose behalf the message is sent, which would have been particularly onerous where a CEM includes content for several advertisers, such as in a newsletter (now every person must be identified by name, but other identifying information is only required for one person). Finally, the CRTC has removed the requirement for  senders to indicate that a recipient could withdraw consent from any of the many forms of contact information provided to the recipient in a request for consent or CEM. Overall the changes to these provisions are very positive.

Unsubscribe mechanism - the CRTC regulations now simply state that the unsubscribe mechanism in a CEM "must be able to be readily performed". The draft regulations were more prescriptive, stating that the mechanism "must be able to be performed in no more than two clicks or another method of equivalent efficiency".

Now that the CRTC regulations have been finalized, businesses have much more information about how to design marketing campaigns that are CASL-compliant. In particular, these rules provide more of the necessary details to ensure that consent obtained now will be valid once CASL comes into force. The Industry Canada regulations may also be relevant in some circumstances; for example, where one person is seeking consent on behalf of an unknown third party.

- Shaun Brown

J.D. Falk - In Memoriam

Jesse David “J.D.” Falk - May 24, 1974 - November 16, 2011

It is with the heaviest of hearts that CAUCE must make note of the passing of one of our own. J.D. Falk was a founder of CAUCE, and one of the nicest people in the anti-spam community.

Besides being a board member of CAUCE U.S. since its inception in 1997, he went on to support the organization as a member of the CAUCE North America Executive. His tireless efforts helped to make CAUCE what it is today.

During his career, J.D. worked at Erols, Priori, Critical Path, MAPS, Yahoo!, Microsoft, and Return Path, but perhaps his most important contributions in fighting online abuse were to the Messaging Anti-abuse Working Group, wherein his tireless efforts organizing the MAAWG meetings were literally immeasurable.

J.D. was a prolific author, his writing published on CircleID, at his employer Return Path’s website, and in the RFC process at the Internet Engineering Task Force (IETF). His contributions went far towards making the Internet a better, safer place for us all.

J.D. was one of a kind,” said CAUCE President John Levine. “Everyone knew him, everyone trusted him, and everyone knew they could count on him to see the real issues.”

J.D. was so very well respected that a professional standards organization, the Internet Engineering Task Force, pulled out all the stops to honor him in his last days. His friends and colleagues Dave Crocker and Murray Kucherawy explain:

The IETF publishes technical specifications and related documents through a series that was started with the beginning of the Internet, called Request for Comments (RFC); the name reflects the Internet's origins as a research body more than 40 years ago.

JD had a document in the approval process (see notice below). J.D.'s document had already been approved by the IETF and it was in the last stages of document editing by the RFC staff.  A small group of us asked whether they could expedite the process, more quickly than the expected two months. The IETF staff recruited a technical editor at 1:30am, her time, in New York and she completed the work by the end of the day. J.D. was shown this final draft for his approval, hours before he passed away.

Although the reason was extraordinary, this sort of willingness to help has always been at the core of this small Internet community that JD had joined, and contributed to, throughout his professional life.

J.D. died before his time from cancer. His intelligence, gravitas, good humor and considered opinions were invaluable, CAUCE, and the Internet community, are the poorer for his passing.

CAUCE extends our most heartfelt of condolences to his family and his friends.

Please feel free to share your memories of J.D. Falk at http://jdfalkmemorial.org/

Please read these tributes as well:

Return Path

MAAWG

CircleID

A collection of J.D.'s technical writing can be found at Return Path's Received: Blog

 

From: "rfc-editor@rfc-editor.org" <rfc-editor@rfc-editor.org>

Subject: RFC 6449 on Complaint Feedback Loop Operational Recommendations

Date: 16 November, 2011 11:58:54 PM EST

To: "ietf-announce@ietf.org" <ietf-announce@ietf.org>, "rfc-dist@rfc-editor.org" <rfc-dist@rfc-editor.org>

Cc: "rfc-editor@rfc-editor.org" <rfc-editor@rfc-editor.org>

A new Request for Comments is now available in online RFC libraries. 

       RFC 6449

       Title:      Complaint Feedback Loop Operational Recommendations 

       Author:     J. Falk, Ed.

       Status:     Informational

       Stream:     IETF

       Date:       November 2011

       Mailbox:    ietf@cybernothing.org

       Pages:      31

       Characters: 75139

       Updates/Obsoletes/SeeAlso:   None

 

       I-D Tag:    draft-jdfalk-maawg-cfblbcp-03.txt

       URL:        http://www.rfc-editor.org/rfc/rfc6449.txt

 

Complaint Feedback Loops similar to those described herein have

existed for more than a decade, resulting in many de facto standards

and best practices.  This document is an attempt to codify, and thus

clarify, the ways that both providers and consumers of these feedback

mechanisms intend to use the feedback, describing some already common

industry practices.

 

This document is the result of cooperative efforts within the

Messaging Anti-Abuse Working Group, a trade organization separate

from the IETF.  The original MAAWG document upon which this document

is based was published in April, 2010.  This document does not

represent the consensus of the IETF; rather it is being published as

an Informational RFC to make it widely available to the Internet

community and simplify reference to this material from IETF work.

This document is not an Internet Standards Track specification; it is

published for informational purposes.

 

INFORMATIONAL: This memo provides information for the Internet community.

It does not specify an Internet standard of any kind. Distribution of

this memo is unlimited.

 

This announcement is sent to the IETF-Announce and rfc-dist lists.

To subscribe or unsubscribe, see

 http://www.ietf.org/mailman/listinfo/ietf-announce

 http://mailman.rfc-editor.org/mailman/listinfo/rfc-dist

 

For searching the RFC series, see http://www.rfc-editor.org/rfcsearch.html.

For downloading RFCs, see http://www.rfc-editor.org/rfc.html.

 

Requests for special distribution should be addressed to either the

author of the RFC in question, or to rfc-editor@rfc-editor.org.  Unless

specifically noted otherwise on the RFC itself, all RFCs are for

unlimited distribution.

 

The RFC Editor Team

Association Management Solutions, LLC

Five Countries are Considering Anti-spam Laws

The international press is alight with reports of various countries considering privacy and anti-spam legislation. It appears that many countries have arrived at the logical conclusion that after years of supposed 'self regulation'; some marketers must be brought to heel by way of regulation and law, to stop abusive practices.

Qatar called for comments on their draft Personal Information Privacy Protection Law. Inside Privacy had this to say:

This is a groundbreaking development as, should the law be enacted, it will make Qatar the only country in the Middle East to have nationally-applicable data protection legislation.

The proposed definition of 'personal information' extends to any information that can reasonably be linked to a specific individual, irrespective of whether that individual can be identified, thus covering location data. Views are sought on whether the law should include the principle of Privacy by Design by imposing an obligation to design and develop products, systems and services so that privacy protection is included from the outset. The idea of accountability has also been included.

The National reports that some there are encouraging the United Arab Emirates to consider data protection laws along the lines of the Qatari legislation.

South Africa is currently considering comments received regarding their proposed 'Protection of Personal Information Bill'. The Internet Service Providers` Association of South Africa (ISPA) was particularly concerned about an Opt-out registry possibly being run by the Direct Marketing Association of South Africa (DMASA):

... the legislature should retain the clauses that require marketers to get explicit 'opt-in' from consumers before sending them electronic marketing messages.

There was also an editorial published supporting Opt-in as the way to go:

Spam opt-out the way we want it

If there were to be a national opt-out registry to fight back against the tide of spam, what should it look like? How about we consumers set the ground rules?

... the very people that exist to further the aims of companies that fill your inbox with rubbish (the Direct Marketing Association of South Africa (DMASA)) want to be in charge of keeping your inbox clear.

Meanwhile in India, it is reported that the Government to put end to unsolicited telemarketing messages, calls

Telecom Minister Kapil Sibal informed the Rajya Sabha that the mechanism to end the misery of mobile users will take another six weeks to be put in place. The measure would follow the government's earlier failed attempt to stop pesky callers from harassing mobile phone users with voice SMSes.

Like in the previous mechanism, those who do not want to receive unsolicited messages could register their cell numbers with 1909 - the National Do-Not- Call (NDNC) registry created by the Telecom Regulatory Authority of India (Trai).

Lastly, in Pakistan, the telecommunications authority is warning marketers to cease & desist spamming, or they will invoke what is perhaps the best title for a law CAUCE has ever seen, the “Protection from Spam, Unsolicited fraudulent and obnoxious communication Regulations, 2009” The text of the regulation can be found here.

Facebook has stolen all the contents of mobile address books, including private telephone numbers

As you know, Facebook have a long, storied history, including several ongoing brushes with the Privacy Commissioner of Canada, and despite repeat warnings against abuse of end-user rights, they recently deployed facial recognition software with no notice given their 500,000,000 users.

Today, however was the straw that broke the camel's back. Unbeknowst to me, perhaps by way of their new 'Facebook messanger' [update: actually, by way of Facebook's iPhone app.] they have uploaded the address books of hundreds of millions of users' mobile phones.

I found the home, private, business and mobile telephone numbers of 700 friends, colleagues, co-workers, and associates (Facebook users or not) published on their site [update: on my account only - at least, for the moment, but nonetheless up on Facebook] - I never agreed to this, I never knew about this, and it was only by way of the Sophos blog post below that I discovered this.

To check to see if you have had the same unfortunate thing happened to you:

1. Log into Facebook
2. Click on Account (upper RH corner)
3. Click 'edit friends'
4. Click 'contacts' (LH side)

(There is the option to disable this feature. Turn OFF synching on your mobile phone, then go here)

update: CAUCE Director Matt Sergeant had this to say on his blog - he nails exactly what is wrong with this:

Addressing the latest Facebook privacy issue

(This is a non-work post, but Disclaimer: I work for Symantec and regularly talk publicly about security issues)

There’s been lots of talk today online about the latest Facebook privacy debacle whereby they have all your cell phone contacts listed on your “Contacts” page.

Facebook have been trying to quiet the storm, as people are posting to their status updates for people to disable this.

First, to combat some FUD: Facebook is not sharing this information from you with your friends. Your buddies aren’t going to be able to call up your Grandma.

But what Facebook have entirely ignored, and why this is again an issue, is the question of permission.

I have two phones. One is a work phone (BlackBerry), and one is my personal iPhone. The only phone the contacts I had listed on Facebook came from is my BlackBerry, which is good, because I have a lot of random old numbers in my iPhone (don’t ask!).

So what happened here? I believe that the latest BlackBerry Facebook app (which recently underwent a major upgrade) automatically set the preference to sync contacts with Facebook. Now it may very well have been in the multi-page user agreement that I accepted, but yes I admit, I don’t read those things. And those agreements don’t even appear on the iPhone version, because, and here’s the fundamental difference I guess: the iPhone version doesn’t transparently change your preferences.

Facebook needs to stop that. I don’t care if it’s useful, or if you’re not sharing it with anyone else. I don’t want you uploading my contacts to your servers without ASKING me first.

It’s that simple. And this is why there are laws against what they have done in various countries, and why this will probably result in yet another lawsuit against them.

Rant over.

CAUCE are stunned by this move, it is beyond the ken. We will be calling upon Facebook to remove this facility immediately (it should always bo opt-in by default, as should ALL end-user options) and failing that, filing complaints with the proper authorities.

See more: http://nakedsecurity.sophos.com/2011/08/11/has-facebook-got-your-mobile-number-now-your-friends-do-too

--
Neil Schwartzman
Executive Director
CAUCE : The Coalition Against Unsolicited Commercial Email