CAUCE

CRTC CASL Regulation Summary

[originally posted at Emailkarma. Written by CAUCE Director Matt Vernhout]

We have found what appears to be an official version of the Canadian Radio-Television and Telecommunications Commissions (CRTC) Canada's Anti-Spam Law CASL regulations on the Canadian Employment Pension Law website along with a brief overview of the regulations.

Here is a quick summary:

Information to be included in an email message has been clarified to included these key identifiers: CEM’s need to be the name by which the person sending the message conducts business, for third party messages you should use the name by which the third party carries on business, and include a statement indicating which person is sending the message and which person on whose behalf the message is being sent.

Contact and mailing address has also been clarified to be; the mailing address of the sender and either a telephone number providing access to an agent or voice messaging system, an email address or a web address of the person sending the message or the person on whose behalf the message is sent.

When it is not possible to include unsubscription information in the CEM you may included that information on a page on the World Wide Web that is readily accessible by the person to whom the message is sent at no cost to them by means of a link that is clearly and prominently set out in the message. This is a big deal for Mobile* messaging and Social Media messages as these platforms and character limitations do not always allow for all of the previously required information… I can’t ever see this being an issue for an email message though.* Mobile Keywords STOP will remain a requirement

All unsubscribe mechanisms referred to in paragraph 6(2)(c) of the Act must be set out clearly and prominently and must be able to be readily performed.

A request for consent has been clarified to include oral or written consent and must be sought separately for each channel (SMS, Email, etc…) of the Act and must include the key identifiers listed above (point 1) along with a a statement indicating that the person whose consent is sought can withdraw their consent at any time.

Computer programs that perform one or more of the functions listed in subsection 10 (5) of the Act [causing a computer system to operate contrary to reasonable expectations] must have a separate consent sought from any other information provided in a request for consent and the person seeking consent must obtain an acknowledgement in writing from the person from whom consent is being sought that they understand and agree that the program performs the specified functions.

What’s Next with CASL?
We are still waiting on the regulations from Industry Canada that will hopefully clarify a number of the outstanding issues and questions that they received during last years comment period. We are expecting to hear from them in the next couple of weeks (Maybe early April) when a new 30 day comment period is scheduled. After these comments are reviewed final regulations will be presented and an enforcement date will be set.

The big question is still outstanding – When is CASL coming into force?

Latest word on this will be at or near the end of Q3 2012 (around October), but the regulations from Industry Canada will clarify this.

Download the CRTC’s Regulations HERE [PDF]

CRTC responds to stakeholder concerns with final regulations under CASL

The Canadian Radio-television and Telecommunications Commission (CRTC) has finalised its regulations under Canada's Anti-Spam Legislation (CASL), resulting in a set of rules that are more balanced, reasonable, and in line with the objectives of the legislation. The new requirements are also more consistent with the requirements under the U.S. CAN-SPAM Act of 2003, with which many senders are already familiar.

CASL creates rules for sending commercial electronic messages (CEMs) and installing computer programs. It also establishes a general prohibition against the alteration of transmission data and is expected to come into force later in 2012. Industry Canada is also responsible for developing regulations, and should be posting another version of its regulations within the next month or so.

The CRTC originally posted draft regulations for comment in June of 2011, which generated a significant number of responses, many of which pointed to the potential challenges for anyone sending email or other electronic messages for business purposes. With these final regulations the CRTC [PDF] has addressed a number of issues raised by stakeholders:

Consent in writing - A request for consent is no longer required to be in writing; rather, consent can be requested orally. This does not give free reign for senders to assert that they have consent without evidence, however, as anyone claiming to have consent bears the burden of proving it under the legislation.

Information to be included in a request for consent/CEM - The CRTC has dialed back the quantity of information to be included when requesting consent and in a CEM. A sender is now required to provide:

the name of the person seeking consent or sending the CEM (or the person on whose behalf consent is sought or sent, if different); (The regulations specify that a person must be identified by the name by which the person carries on business, if different from the actual name of the person).

if the message is sent on behalf of another person, a statement indicating who is or will be sending and on whose behalf the message is or will be sent;

the mailing address and either a telephone number, an email address or web address of the person sending (or on whose behalf) the message is or will be sent;

when seeking consent, a sender must indicate that the individual can withdrawal consent at any time.

The draft regulations would have required a person sending a CEM to provide every electronic address that person uses, as well as a physical, mailing and web address. Furthermore, they would have required a CEM to provide all of that information for the person sending as well as every person on whose behalf the message is sent, which would have been particularly onerous where a CEM includes content for several advertisers, such as in a newsletter (now every person must be identified by name, but other identifying information is only required for one person). Finally, the CRTC has removed the requirement for  senders to indicate that a recipient could withdraw consent from any of the many forms of contact information provided to the recipient in a request for consent or CEM. Overall the changes to these provisions are very positive.

Unsubscribe mechanism - the CRTC regulations now simply state that the unsubscribe mechanism in a CEM "must be able to be readily performed". The draft regulations were more prescriptive, stating that the mechanism "must be able to be performed in no more than two clicks or another method of equivalent efficiency".

Now that the CRTC regulations have been finalized, businesses have much more information about how to design marketing campaigns that are CASL-compliant. In particular, these rules provide more of the necessary details to ensure that consent obtained now will be valid once CASL comes into force. The Industry Canada regulations may also be relevant in some circumstances; for example, where one person is seeking consent on behalf of an unknown third party.

- Shaun Brown

J.D. Falk - In Memoriam

Jesse David “J.D.” Falk - May 24, 1974 - November 16, 2011

It is with the heaviest of hearts that CAUCE must make note of the passing of one of our own. J.D. Falk was a founder of CAUCE, and one of the nicest people in the anti-spam community.

Besides being a board member of CAUCE U.S. since its inception in 1997, he went on to support the organization as a member of the CAUCE North America Executive. His tireless efforts helped to make CAUCE what it is today.

During his career, J.D. worked at Erols, Priori, Critical Path, MAPS, Yahoo!, Microsoft, and Return Path, but perhaps his most important contributions in fighting online abuse were to the Messaging Anti-abuse Working Group, wherein his tireless efforts organizing the MAAWG meetings were literally immeasurable.

J.D. was a prolific author, his writing published on CircleID, at his employer Return Path’s website, and in the RFC process at the Internet Engineering Task Force (IETF). His contributions went far towards making the Internet a better, safer place for us all.

J.D. was one of a kind,” said CAUCE President John Levine. “Everyone knew him, everyone trusted him, and everyone knew they could count on him to see the real issues.”

J.D. was so very well respected that a professional standards organization, the Internet Engineering Task Force, pulled out all the stops to honor him in his last days. His friends and colleagues Dave Crocker and Murray Kucherawy explain:

The IETF publishes technical specifications and related documents through a series that was started with the beginning of the Internet, called Request for Comments (RFC); the name reflects the Internet's origins as a research body more than 40 years ago.

JD had a document in the approval process (see notice below). J.D.'s document had already been approved by the IETF and it was in the last stages of document editing by the RFC staff.  A small group of us asked whether they could expedite the process, more quickly than the expected two months. The IETF staff recruited a technical editor at 1:30am, her time, in New York and she completed the work by the end of the day. J.D. was shown this final draft for his approval, hours before he passed away.

Although the reason was extraordinary, this sort of willingness to help has always been at the core of this small Internet community that JD had joined, and contributed to, throughout his professional life.

J.D. died before his time from cancer. His intelligence, gravitas, good humor and considered opinions were invaluable, CAUCE, and the Internet community, are the poorer for his passing.

CAUCE extends our most heartfelt of condolences to his family and his friends.

Please feel free to share your memories of J.D. Falk at http://jdfalkmemorial.org/

Please read these tributes as well:

Return Path

MAAWG

CircleID

A collection of J.D.'s technical writing can be found at Return Path's Received: Blog

 

From: "rfc-editor@rfc-editor.org" <rfc-editor@rfc-editor.org>

Subject: RFC 6449 on Complaint Feedback Loop Operational Recommendations

Date: 16 November, 2011 11:58:54 PM EST

To: "ietf-announce@ietf.org" <ietf-announce@ietf.org>, "rfc-dist@rfc-editor.org" <rfc-dist@rfc-editor.org>

Cc: "rfc-editor@rfc-editor.org" <rfc-editor@rfc-editor.org>

A new Request for Comments is now available in online RFC libraries. 

       RFC 6449

       Title:      Complaint Feedback Loop Operational Recommendations 

       Author:     J. Falk, Ed.

       Status:     Informational

       Stream:     IETF

       Date:       November 2011

       Mailbox:    ietf@cybernothing.org

       Pages:      31

       Characters: 75139

       Updates/Obsoletes/SeeAlso:   None

 

       I-D Tag:    draft-jdfalk-maawg-cfblbcp-03.txt

       URL:        http://www.rfc-editor.org/rfc/rfc6449.txt

 

Complaint Feedback Loops similar to those described herein have

existed for more than a decade, resulting in many de facto standards

and best practices.  This document is an attempt to codify, and thus

clarify, the ways that both providers and consumers of these feedback

mechanisms intend to use the feedback, describing some already common

industry practices.

 

This document is the result of cooperative efforts within the

Messaging Anti-Abuse Working Group, a trade organization separate

from the IETF.  The original MAAWG document upon which this document

is based was published in April, 2010.  This document does not

represent the consensus of the IETF; rather it is being published as

an Informational RFC to make it widely available to the Internet

community and simplify reference to this material from IETF work.

This document is not an Internet Standards Track specification; it is

published for informational purposes.

 

INFORMATIONAL: This memo provides information for the Internet community.

It does not specify an Internet standard of any kind. Distribution of

this memo is unlimited.

 

This announcement is sent to the IETF-Announce and rfc-dist lists.

To subscribe or unsubscribe, see

 http://www.ietf.org/mailman/listinfo/ietf-announce

 http://mailman.rfc-editor.org/mailman/listinfo/rfc-dist

 

For searching the RFC series, see http://www.rfc-editor.org/rfcsearch.html.

For downloading RFCs, see http://www.rfc-editor.org/rfc.html.

 

Requests for special distribution should be addressed to either the

author of the RFC in question, or to rfc-editor@rfc-editor.org.  Unless

specifically noted otherwise on the RFC itself, all RFCs are for

unlimited distribution.

 

The RFC Editor Team

Association Management Solutions, LLC

Five Countries are Considering Anti-spam Laws

The international press is alight with reports of various countries considering privacy and anti-spam legislation. It appears that many countries have arrived at the logical conclusion that after years of supposed 'self regulation'; some marketers must be brought to heel by way of regulation and law, to stop abusive practices.

Qatar called for comments on their draft Personal Information Privacy Protection Law. Inside Privacy had this to say:

This is a groundbreaking development as, should the law be enacted, it will make Qatar the only country in the Middle East to have nationally-applicable data protection legislation.

The proposed definition of 'personal information' extends to any information that can reasonably be linked to a specific individual, irrespective of whether that individual can be identified, thus covering location data. Views are sought on whether the law should include the principle of Privacy by Design by imposing an obligation to design and develop products, systems and services so that privacy protection is included from the outset. The idea of accountability has also been included.

The National reports that some there are encouraging the United Arab Emirates to consider data protection laws along the lines of the Qatari legislation.

South Africa is currently considering comments received regarding their proposed 'Protection of Personal Information Bill'. The Internet Service Providers` Association of South Africa (ISPA) was particularly concerned about an Opt-out registry possibly being run by the Direct Marketing Association of South Africa (DMASA):

... the legislature should retain the clauses that require marketers to get explicit 'opt-in' from consumers before sending them electronic marketing messages.

There was also an editorial published supporting Opt-in as the way to go:

Spam opt-out the way we want it

If there were to be a national opt-out registry to fight back against the tide of spam, what should it look like? How about we consumers set the ground rules?

... the very people that exist to further the aims of companies that fill your inbox with rubbish (the Direct Marketing Association of South Africa (DMASA)) want to be in charge of keeping your inbox clear.

Meanwhile in India, it is reported that the Government to put end to unsolicited telemarketing messages, calls

Telecom Minister Kapil Sibal informed the Rajya Sabha that the mechanism to end the misery of mobile users will take another six weeks to be put in place. The measure would follow the government's earlier failed attempt to stop pesky callers from harassing mobile phone users with voice SMSes.

Like in the previous mechanism, those who do not want to receive unsolicited messages could register their cell numbers with 1909 - the National Do-Not- Call (NDNC) registry created by the Telecom Regulatory Authority of India (Trai).

Lastly, in Pakistan, the telecommunications authority is warning marketers to cease & desist spamming, or they will invoke what is perhaps the best title for a law CAUCE has ever seen, the “Protection from Spam, Unsolicited fraudulent and obnoxious communication Regulations, 2009” The text of the regulation can be found here.

Facebook has stolen all the contents of mobile address books, including private telephone numbers

As you know, Facebook have a long, storied history, including several ongoing brushes with the Privacy Commissioner of Canada, and despite repeat warnings against abuse of end-user rights, they recently deployed facial recognition software with no notice given their 500,000,000 users.

Today, however was the straw that broke the camel's back. Unbeknowst to me, perhaps by way of their new 'Facebook messanger' [update: actually, by way of Facebook's iPhone app.] they have uploaded the address books of hundreds of millions of users' mobile phones.

I found the home, private, business and mobile telephone numbers of 700 friends, colleagues, co-workers, and associates (Facebook users or not) published on their site [update: on my account only - at least, for the moment, but nonetheless up on Facebook] - I never agreed to this, I never knew about this, and it was only by way of the Sophos blog post below that I discovered this.

To check to see if you have had the same unfortunate thing happened to you:

1. Log into Facebook
2. Click on Account (upper RH corner)
3. Click 'edit friends'
4. Click 'contacts' (LH side)

(There is the option to disable this feature. Turn OFF synching on your mobile phone, then go here)

update: CAUCE Director Matt Sergeant had this to say on his blog - he nails exactly what is wrong with this:

Addressing the latest Facebook privacy issue

(This is a non-work post, but Disclaimer: I work for Symantec and regularly talk publicly about security issues)

There’s been lots of talk today online about the latest Facebook privacy debacle whereby they have all your cell phone contacts listed on your “Contacts” page.

Facebook have been trying to quiet the storm, as people are posting to their status updates for people to disable this.

First, to combat some FUD: Facebook is not sharing this information from you with your friends. Your buddies aren’t going to be able to call up your Grandma.

But what Facebook have entirely ignored, and why this is again an issue, is the question of permission.

I have two phones. One is a work phone (BlackBerry), and one is my personal iPhone. The only phone the contacts I had listed on Facebook came from is my BlackBerry, which is good, because I have a lot of random old numbers in my iPhone (don’t ask!).

So what happened here? I believe that the latest BlackBerry Facebook app (which recently underwent a major upgrade) automatically set the preference to sync contacts with Facebook. Now it may very well have been in the multi-page user agreement that I accepted, but yes I admit, I don’t read those things. And those agreements don’t even appear on the iPhone version, because, and here’s the fundamental difference I guess: the iPhone version doesn’t transparently change your preferences.

Facebook needs to stop that. I don’t care if it’s useful, or if you’re not sharing it with anyone else. I don’t want you uploading my contacts to your servers without ASKING me first.

It’s that simple. And this is why there are laws against what they have done in various countries, and why this will probably result in yet another lawsuit against them.

Rant over.

CAUCE are stunned by this move, it is beyond the ken. We will be calling upon Facebook to remove this facility immediately (it should always bo opt-in by default, as should ALL end-user options) and failing that, filing complaints with the proper authorities.

See more: http://nakedsecurity.sophos.com/2011/08/11/has-facebook-got-your-mobile-number-now-your-friends-do-too

--
Neil Schwartzman
Executive Director
CAUCE : The Coalition Against Unsolicited Commercial Email

Industry Canada Regulations for CASL

As part of the official process to launching Canada’s new Anti-spam legislation Industry Canada has released their definitions and regulations for C-28 (aka. CASL, FISA, ECPA).

The Highlights are as follows:

Personal Relationship: Where an individual has met with the person to whom the message is sent in a non-business context, and where there is evidence of non-commercial communication between the individuals within the previous two years.

Family Relationship: for the purposes of the Anti-spam Legislation to be in keeping with definitions in the Income Tax Act. It also specifies that it is intended to refer to persons descending from a common grandparent, including aunts, uncles, cousins, nieces, and nephews.

Express consent under the Anti-spam Legislation means that commercial communication may not take place unless the person or corporation in question first consents to be contacted.

Implied consent means that commercial communication may take place with persons or corporations under circumstances where it can be deemed that they might be interested, but the recipients of the communication must be able to “opt out” of such communication.

The second element of the Regulations states that consent to receive messages from a third party is only valid if the individual providing consent will have the ability to unsubscribe to the message, and by the same means be able to alert the original requester that their consent is withdrawn.

The proposed Regulations define “membership” as having applied for, met the formal requirements to belong to an organization, paid any fees required to belong to an organization, and having been accepted as a member in accordance with the membership requirements of the organization.

The proposed Regulations define “club,” “association” or “voluntary organization” as a non-profit organization that is organized and operated exclusively for social welfare, civic improvement, pleasure or recreation or for any other purpose than profit, if no part of the income of which was payable to, or otherwise available for the personal benefit of any proprietor, member or shareholder of that organization unless the proprietor, member or shareholder is an organization the primary purpose of which is the promotion of amateur athletics in Canada.

 

It is important to note that these regulations are in addition to the CRTC's regulations (Unsubscribe, Identification and Consent have been regulated by the CRTC) and the Office of the Privacy Commissioner’s regulations and are not a replacement to the others, which exist concurrently.

Comments are welcomed byIndustry Canada: “Interested persons may make representations concerning the proposed Regulations within 60 days after the date of publication of this notice.”

 

- Matt Vernhout, CAUCE (re-published with permission from Email Karma)

CRTC Publishes Regulations, another step towards CASL coming into Force

Happy Canada Day from the CRTC

As anticipated, the CRTC took a long-awaited step towards Canada's Anti-spam Law coming into force; regulations designed to help define the scope and impact of the law were published late afternoon, June 30. They are available in their full form here: http://www.crtc.gc.ca/eng/archive/2011/2011-400.htm

They are quite terse, coming in at less than 440 words. CAUCE will comment here in due course, but for your instant gratification, here they are:

The proposed regulations prescribe the form and certain information to be included in a CEM. They establish that a CEM must set out information that identifies the sender of the message and, if different, the person on whose behalf the message is sent, as well as, if applicable, the names of those persons’ businesses. The CEM is also to include information that would enable the recipient to readily contact such persons. Further, the proposed regulations prescribe that this information, as well as the unsubscribe mechanism, be set out clearly and prominently.

The proposed regulations also specify a particular form by which information relating to the sender of the message and the unsubscribe mechanism may be accessed, in circumstances where it is not practicable to include such information in a CEM, for instance, because of character limitations.

Section 6 of the Act prohibits the sending of a CEM unless there is express or implied consent from the recipient of that message. Section 7 of the Act prohibits, absent express consent, the alteration of transmission data in an electronic message which results in the message being delivered to a different destination. Section 8 of the Act prohibits the installation of a computer program unless express consent has been obtained. The Commission’s proposed regulations prescribe the form of a request for express consent for the purposes of subsections 10(1) and 10(3) of the Act. More specifically, the proposed regulations stipulate that any request for express consent must clearly identify the person seeking consent and, if different, the person on whose behalf consent is sought, and, if applicable, the names of those persons’ businesses. In addition, it is proposed that contact information be included for such persons, and further, that there be a requirement to include a statement which states that consent may be withdrawn using the contact information provided.

The focus of the final segment of the proposed regulations is the installation of computer programs in the course of a commercial activity, which, as noted above, is addressed in section 8 of the Act. The proposed provisions prescribe that additional information be provided when requesting express consent if a computer program that performs a function set out in subsection 10(5) of the Act is to be installed. In such circumstances, the proposed regulations prescribe the manner in which the computer program’s material elements must be brought to the attention of the person from whom consent is being sought, and further establish that the person seeking consent must obtain a written acknowledgement from the person from whom consent is sought that they understand and agree that the program performs the specified functions.

MAAWG Honors Internet Volunteer Neil Schwartzman With First MAAWG Mary Litynski Award

News Release

For Immediate Release        

 

MAAWG Honors Internet Volunteer Neil Schwartzman

With First MAAWG Mary Litynski Award

San Francisco, June 16, 2011 – Recognizing the value of one person’s effort to generate positive change in the messaging industry, the Messaging Anti-Abuse Working Group presented its first annual MAAWG Mary Litynski Award to Neil Schwartzman at its 22^nd general meeting on June 8 in San Francisco.  The award acknowledged Schwartzman’s extensive volunteer efforts working against spam for the last twenty years, and the presentation can be viewed on the MAAWG YouTube channel at http://www.youtube.com/MAAWG?feature=mhee

A messaging compliance consultant, Schwartzman has served on the Canadian Federal Task Force on Spam and is a founding member and currently executive director of CAUCE, the Coalition Against Unsolicited Commercial Email, an international all-volunteer consumer advocacy organization working to defend the interests of the average Internet user.  He is secretary of the MAAWG Public Policy Committee and involved in several of the association’s other projects, and is active in other industry organizations including the London Action Plan (LAP) and the Anti-Phishing Working Group (APWG).  Schwartzman also worked toward the passage of the new Canada Anti-Spam Law (CASL).

“Neil reminds us that backing down from the challenge of messaging abuse is not an option for those committed to maintaining an open and effective Internet.  He brings energy and expertise to our community, with a passion and concern that rises above his own personal interests,” MAAWG Chairman Michael O’Reirdan said.

According to Schwartzman, “Industry collaboration is the only way, to my mind, that we can effectively deal with spam. There is no silver bullet. A unified strategy involving cross-sector industrial cooperation, technologists and public policy advisors – providing a seat at the table for all stakeholders – is the proven way forward.”

The award was named for Mary Litynski, who worked tirelessly to serve MAAWG members since the organization’s founding in 2004 and who passed away in 2010 after a courageous battle with cancer.  The honor was initiated in her memory this year to recognize an unsung industry hero who also works behind the scenes to make the Internet a safer place for all.

About the Messaging Anti-Abuse Working Group (MAAWG)

The Messaging Anti-Abuse Working Group (MAAWG) is where the messaging industry comes together to work against spam, viruses, denial-of-service attacks and other online exploitation. MAAWG (www.maawg.org) represents more than one billion mailboxes from some of the largest network operators worldwide. It is the only organization addressing messaging abuse holistically by systematically engaging all aspects of the problem, including technology, industry collaboration and public policy. MAAWG leverages the depth and experience of its global membership to tackle abuse on existing networks and new emerging services. It also works to educate global policy makers on the technical and operational issues related to online abuse and messaging. Headquartered in San Francisco, Calif., MAAWG is an open forum driven by market needs and supported by major network operators and messaging providers.

#  #  #

 

Media Contact: Linda Marcus, APR, 714-974-6356, lmarcus@astra.cc, Astra Communications

MAAWG Board of Directors: AOL; AT&T (NYSE: T); Cloudmark, Inc.; Comcast (NASDAQ: CMCSA); Cox Communications; Facebook; France Telecom (NYSE and Euronext: FTE); Openwave Systems (NASDAQ: OPWV); PayPal; Return Path; Tata Communications (NYSE: TCL); Time Warner Cable; Verizon Communications; and Yahoo! Inc.

MAAWG Full Members: 1&1 Internet AG; Adaptive Mobile Security LTD; Apple Inc.; Cisco Systems, Inc.; Constant Contact (CTCT); Edatis; e-Dialog; Eloqua; Email Sender and Provider Coalition; Experian CheetahMail; Genius.com; Internet Initiative Japan, (IIJ NASDAQ: IIJI); McAfee Inc.; Message Systems; Scality; Spamhaus; Sprint; Symantec; Trend Micro, Inc.; and YouSendIt.

A complete member list is available at http://www.maawg.org/about/roster

CAUCE Director Neil Schwartzman Wins Prestigious MAAWG Award

CAUCE Executive Director Neil Schwartzman won the prestigious Mary Litynski award on June 08, 2011 for his contributions to Internet anti-abuse efforts, including the passage of Canada's Anti-Spam Law. Here is his acceptance speech.

This is not the first award I've received from the MAAWG community. A few years ago, at a meeting in Washington, D.C., I received an honorary doctorate when recognized me as Dr. Evil. At the past meeting, at Disney, you honored me with a t-shirt branding me as Grumpy, from the Seven Dwarves.

As much as I treasure those memories, this award is very special to me.

Mary Lytinski was a warm, helpful, friendly person. It is nice to see that MAAWG is applying these criteria when deciding a suitable winner of the award in her name.

Seeing Mary at the registration desk was our opening ritual three times a year, and her greeting -- no matter how busy -- told every attendee that this was going to be a good meeting. Mary's contribution to our community and our cause cannot be measured.

I can’t begin to express my gratitude for this award, named in honor of our old friend; I am profoundly humbled, particularly when we consider the roster of others in our community undeniably as deserving of recognition.

My contributions to the Internet community, like that of so many others, began as a volunteer. To some, that might be a puzzling thing, to do something without financial recompense. To others, most in this room, it is the most natural thing of all.

There are a number of reasons why I try to embody a spirit of volunteerism. For one, my mother volunteered her time throughout her life. She undoubtedly passed this aspect on to me.

When I got online in 1992, the net was largely non-commercial. There was no world wide web. It was all about text, and community spirit, and volunteered contributions. Even when employees of a commercial entity worked on standards or software, it was with humility and a sense of collaboration, of building the Internet together.

The commercialization of the net has brought with it some astounding, wonderful new technologies and contributions to our global society. I am able to write to my friend, one of the happiest people I’ve ever met, a peasant girl named Shandy, who lives in rural China, because she has a Hotmail account. A far-flung community was able to express our love and support for our friend and colleague J.D. Falk, by way of Facebook, and email, and AOL Instant Messaging. Perhaps most profoundly, an offshoot of Google, 23andme, allowed me to reconcile with my biological mother, sister and brother, this past weekend after 50 years.

These are the things that motivate me to voluntarily advocate for the anti-abuse community. Because along with all these commercial offerings, there is still a fundamental, precious human element, a drawing together of the global village that criminals, if we let them, would rend asunder. There is still real, honest human communication -- that abusers sully. This human element is the magic intrinsic to the Internet, and something that must be protected. It isn’t just about email systems being spammed, and websites under ddos. It is what they represent -- the people, the data, and the ability to communicate -- that we strive to protect.

The DNA of the Internet, the vast majority of underlying technologies and protocols, were dreamt up and realized by volunteers. Grassroots, volunteer anti-abuse efforts such as my organization, CAUCE, many of the DNSBLs, discussion groups -- all manner of efforts to stave off the wolves at the door, nearly all done on a voluntary basis or as a contribution to the community.

And then there’s MAAWG.

While most of us are paid to be here, involvement in MAAWG can take up a tremendous amount of time. It often encroaches into one’s personal life, or one’s ability to accomplish the balance of our paid work, in effect, MAAWG is very much run by people volunteering of their time, expertise and brilliance.

And so, I accept this award on behalf of all the volunteers past, present and future, my peers and my betters, with the hopes that our work is properly honouring the person for whom this award is named, our dear departed Mary Litynski.

Thank you.

Best Buy and Air Miles notify Alberta, Canada Privacy Commissioner of Epsilon Data Breach

The Office of Information and Privacy Commissioner for the province of Alberta issued a decision [PDF] on May 16, regarding the Epsilon breach that affected the customer lists of 150 different companies, including Best Buy and Air Miles. Both companies operate in Canada.

The Personal Information Protection Act, which went into force May 01, 2010, compels companies to notify their customers in the event of a breach. Both companies did so.

Best Buy and Air Miles proactively reported to the Commissioner that they had been notified by their service provider, Epsilon (a large US based third party marketing organization) that it had experienced a data breach in which 50 million or more email addresses were compromised and that its customers as well as customers of other organizations serviced by Epsilon had been affected. Best Buy and Air Miles had also proactively notified their affected members of the breach within a few days of learning about it.

Commissioner Work reviewed the incident reports by Best Buy and Air Miles and concluded that although the information at issue (name, email addresses and organization membership (in the Best Buy case) was relatively minor compared to other data breaches which involve the unauthorized access of financial or other sensitive information, the sheer magnitude of the breach and the evidence that the information will likely be used for malicious purposes indicated there was a real risk of significant harm to affected individuals. He noted in his decisions that Best Buy and Air Miles had already notified the affected customers in compliance with section 19.1 of the PIPA Regulation, and therefore did not require the organizations to notify again.

CAUCE congratulates both Best Buy and Air Miles, as well as Information and Privacy Commissioner of Alberta, Frank Work on their actions in this regard.

As always, our advice to consumers remains the same: If you received a notices from any company regarding the Epsilon breach, we suggest you change your email address immediately.