Actually, no, he isn't.
End-users should be extremely careful clicking on any link, from both know and unknow sources (including this one) offering to show you gruesome pictures, proof of him being alive and so on. Spammers have followed their precitable pattern of launching massive campaigns capitalizing on bin Laden's death by email and on social networking sites like Facebook to get you to click through, and potentially infect your computer in the process.
Be careful, don't be fooled.
Posted by Neil Schwartzman on 07 May 2011 in Warnings, World | Permalink | Comments (0)
Reblog (0) | | Digg This | Save to del.icio.us |
It would certainly appear so, according to these charts, comparing listings at Spamhaus to GDP. CAUCE thanks furio ercolessi who thought to do the comparison.
update: Rob Szarka rightly points out that these are the largest economies, not the world's richest nations.
| Country | Live Spam Issues At Spamhaus.org |
| 1 United States | 2,370 |
| 2 China | 898 |
| 3 Russian Federation | 559 |
| 4 United Kingdom | 380 |
| 5 Japan | 258 |
| 6 Brazil | 254 |
| 7 Canada | 242 |
| 8 France | 222 |
| 9 Italy | 216 |
| 10 Germany | 214 |
| Country | GDP in Billions of $ |
| United States | $14,620,000 |
| China | $5,745,000 |
| Japan | $5,391,000 |
| Germany | $3,306,000 |
| France | $2,555,000 |
| United Kingdom | $2,259,000 |
| Italy | $2,037,000 |
| Brazil | $2,024,000 |
| Canada | $1,564,000 |
| Russia | $1,477,000 |
Posted by Neil Schwartzman on 01 May 2011 in World | Permalink | Comments (0) | TrackBack (0)
Reblog (0) | | Digg This | Save to del.icio.us |
There's not too much to say about this, except it is Thursday, so it must be Emailviion's turn in the barrel, they are leaking Adobe spam. No word yet as to whose list this is.
a spample can be found here
CAUCE President John Levine blogs about Emailvision's response to his alerting them to the breach.
Posted by Neil Schwartzman on 21 April 2011 in Warnings, World | Permalink | Comments (0) | TrackBack (0)
Reblog (0) | | Digg This | Save to del.icio.us |
Diapers.com is the latest in a long series of ESP breaches by way of optivo.de. Optivo were alerted to this breach on April 14.
UPDATE: While Responsys is the current ESP of record for Diapers.com according to their website (and have been since 11/2009, according to company officials); this may indicate the tagged address was taken from Responsys, another ESP (some companies use more than one ESP), their previous ESP Silverpop, or from diapers.com directly.
Thanks to REDACTED for the report.
Delivered-To: REDACTED
Received: by 10.229.107.19 with SMTP id z19cs52292qco;
Tue, 12 Apr 2011 21:47:45 -0700 (PDT)
Received: by 10.204.74.167 with SMTP id u39mr326019bkj.144.1302670065088;
Tue, 12 Apr 2011 21:47:45 -0700 (PDT)
Return-Path: <return@demo.srv2.de>
Received: from mail17-54.srv2.de (mail17-54.srv2.de [193.169.180.54])
by mx.google.com with ESMTP id c1si470386bky.10.2011.04.12.21.47.44;
Tue, 12 Apr 2011 21:47:45 -0700 (PDT)
Received-SPF: pass (google.com: domain of return@demo.srv2.de designates 193.169.180.54 as permitted sender) client-ip=193.169.180.54;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of return@demo.srv2.de designates 193.169.180.54 as permitted sender) smtp.mail=return@demo.srv2.de; dkim=pass header.i=Adobe@demo.srv2.de
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=mailing; d=demo.srv2.de;
h=Message-ID:Date:From:Reply-To:To:Subject:MIME-Version:Content-Type:Content-Transfer-Encoding; i=Adobe@demo.srv2.de;
bh=Ob9u6TxtQqwyE0MTiwnn5kGewhc=;
b=YXkzQAJ1/oHetfZxTPgwT35YL3se7xFVZitbg/bQwO5O4gqMSsU89Q3Wo5oJVSRy2P9mH0M+wm62
2G75INYa+RsiLp9qQ2rtCUyXYQ24v7CEEs1ggg06Pj5giRymB1uS+ySNfuDTkh2eYifyKg7F9lx/
dlKHvahHPVa5U6m6+wY=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=mailing; d=demo.srv2.de;
b=deGmdf/mVGx8f7o9EcPDZl4uaoxzLXPDR9jc2ILr9g9IgkAY1urF8dnGE9ydx7hrXiMckon1o7NI
mJdGspev4TuPwWvY1jNldcUX93xrqYAcMGr4v4VM4rGGvXmxPFM7VTaJjnjMy9++N6n8BvC/zQuO
BngpUpwys6rmeOEyu68=;
Received: by mail17-54.srv2.de id hkklf20farcr for <REDACTED>; Wed, 13 Apr 2011 06:47:43 +0200 (envelope-from <return@demo.srv2.de>)
Message-ID: <re-pOaX3BUQnds72BhAcj4J1wrgwTrlqCM5OetY-EHI4W55-1UZ8D6Y-UUQ14MG@demo.srv2.de>
Date: Wed, 13 Apr 2011 06:47:43 +0200 (CEST)
From: Adobe Systerm Incorporated <Adobe@demo.srv2.de>
Reply-To: re-EHI4W55-1UZ8D6Y-13HAPU9@demo.srv2.de
To: REDACTED
Subject: =?ISO-8859-1?Q?Adobe_Acrobat_Reader_10x_:_all_?= =?ISO-8859-1?Q?new,_all_powerful_!_Upgrade_Now=3F?=
MIME-Version: 1.0
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-ulpe: re-pOaX3BUQnds72BhAcj4J1wrgwTrlqCM5OetY-EHI4W55-1UZ8D6Y-UUQ14MG@demo.srv2.de
GETTING MORE DONE AT WORK NOW COMES IN A CONVENIENT BOX
See how Adobe Acrobat Reader is a step above anything you've experienced before, so you can be even more productive.
Upgrade Adobe Acrobat Reader
Just how much faster can you work with Adobe Acrobat PDF Reader
software? Fast enough to stay on top of last-minute changes, connect
with key decision makers, and share updates with co-workers.
You'll discover how easy it is to reuse content by exporting PDF files
to Microsoft Word or Excel formats. And how quickly you can automate
multi-step tasks with new, guided Actions. No wonder PC Magazine
says, "There's a lot to like in Acrobat X PDF Reader."
Download Now To Try Us Out
Copyright 2011 Adobe Systems Incorporated. All rights reserved.
Adobe Systems Incorporated
343 Preston Street
Ottawa, ON K1S 1N4
Canada
*************
Delivered-To: REDACTED
Received: by 10.229.107.19 with SMTP id z19cs53998qco;
Tue, 12 Apr 2011 22:29:46 -0700 (PDT)
Received: by 10.223.27.14 with SMTP id g14mr73129fac.129.1302672585540;
Tue, 12 Apr 2011 22:29:45 -0700 (PDT)
Return-Path: <return@demo.srv2.de>
Received: from mail17-45.srv2.de
(mail17-45.srv2.de
[193.169.180.45])
by mx.google.com with ESMTP id l25si86220fah.191.2011.04.12.22.29.45;
Tue, 12 Apr 2011 22:29:45 -0700 (PDT)
Received-SPF: pass (google.com: domain of return@demo.srv2.de designates 193.169.180.45 as permitted sender) client-ip=193.169.180.45;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of return@demo.srv2.de designates 193.169.180.45 as permitted sender) smtp.mail=return@demo.srv2.de; dkim=pass header.i=Skype@demo.srv2.de
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=mailing; d=demo.srv2.de
;
h=Message-ID:Date:From:Reply-To:To:Subject:MIME-Version:Content-Type:Content-Transfer-Encoding; i=Skype@demo.srv2.de;
bh=lF+2G6Rq1lrcc66z2TQZb33J6eQ=;
b=GadElK40VNPm/e12VYpQLZai3O/5IRkfLTDOu6tYSuTaFGs27w76Azhu3SIgU5H4ixgP8O5BeN34
9qn/8S1djO0khRgjeyISbKWddAOzOFYIsgBO6HIFgeqhfPBXlSd4030HF5WHTiIhuHEUr1aNhv9L
UpL8c6x64PGnrvNU5Ow=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=mailing; d=demo.srv2.de
;
b=eEKJOR6eX0npHpBOmJPiHfkopOggjkq13StcWwuWK7LoNebJha4z8OXbFCKN2TxFKh/HaF5wlppd
zyzYzoevuAgWJPNmpabtyOk6om7JJn1/moYlEERevNE2IA917NV2R9kDFEB7nfmcopy28XA5FSEr
Bb1dZ6jQEr/hvgud7mQ=;
Received: by mail17-45.srv2.de
id hkkqci0farc7 for <REDACTED>; Wed, 13 Apr 2011 07:29:44 +0200 (envelope-from <return@demo.srv2.de>)
Message-ID: <re-pOaX3BUQnds72BhAcj4J1wrgwTrlqCM5OetY-EHPDGH2-1UZ8D7F-8KIZFU@demo.srv2.de>
Date: Wed, 13 Apr 2011 07:29:44 +0200 (CEST)
From: Skype Support <Skype@demo.srv2.de>
Reply-To: re-EHPDGH2-1UZ8D7F-BX918B1@demo.srv2.de
To: REDACTED
Subject: Download New VOIP Addons For More Skype Free Talks
MIME-Version: 1.0
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
X-ulpe: re-pOaX3BUQnds72BhAcj4J1wrgwTrlqCM5OetY-EHPDGH2-1UZ8D7F-8KIZFU@demo.srv2.de
SKYPE VoIP ADDONS UPDATES
This is to notify that new updates have been released for Skype
. Following are major new features:
- Talk more for free via Voice Over IP (VoIP).
- Lower cost when connecting to landlines (much cheaper than Calling Card).
- Record your conversation (better than telephone quality).
- Instant messaging& file-sharing, video calls.
- Now available on PSP !
To check and upgrade, go to Skype Updates Center
Skype has changed the way we think of telecommunications.
Thank you for choosing us.
With best regards,
Skype Support
Posted by Neil Schwartzman on 20 April 2011 in United States, Warnings, World | Permalink | Comments (0)
Reblog (0) | | Digg This | Save to del.icio.us |
Today's breach is brought to you by Cheetahmail. Their 63.146.96.248/29 range is apparently spewing the same Adobe spam that has plagued the ESP industry since November 2009. This has been confirmed at three receiving sites.
Senderbase indicates that this range is all related to childrensplace.com. rDNS (below) indicates the block is owned by Cheetahmail.
We have to ask: Since Email Service Providers know what the vector into their systems is (spear phishing with a keylogger, either of an ESP staffer or someone with access to a client account) and they know what the criminals spam on the outbounds (fake Skype and Adobe software), how could this possibly still be happening?
This is a perfect example of why telling end-users to be careful about spear-phishing (as virtually ever one of the 100+ breached Epsilon clients did) is inane. If ESPs, presumably on high alert are incapable of preventing spearphishing by being careful, one has to wonder why they expect normal Internet users to be able to do so.
It is high time that the ESP community stepped up and began to treat end-user data with appropriate security measures. Anything less is unacceptable.
CAUCE President John Levine has also blogged about this, with an example of the spam.
$ dig -x 63.146.96.248
; <<>> DiG 9.6.-ESV-R3 <<>> -x 63.146.96.248
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24202
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 12, ADDITIONAL: 6
;; QUESTION SECTION:
;248.96.146.63.in-addr.arpa. IN PTR
;; ANSWER SECTION:
248.96.146.63.in-addr.arpa. 86400 IN PTR mta810.email.childrensplace.com.
;; AUTHORITY SECTION:
96.146.63.in-addr.arpa. 259200 IN NS a.ns.96.146.63.in-addr.arpa.
96.146.63.in-addr.arpa. 259200 IN NS b.ns.96.146.63.in-addr.arpa.
96.146.63.in-addr.arpa. 259200 IN NS c.ns.96.146.63.in-addr.arpa.
96.146.63.in-addr.arpa. 259200 IN NS d.ns.96.146.63.in-addr.arpa.
96.146.63.in-addr.arpa. 259200 IN NS e.ns.96.146.63.in-addr.arpa.
96.146.63.in-addr.arpa. 259200 IN NS f.ns.96.146.63.in-addr.arpa.
96.146.63.in-addr.arpa. 259200 IN NS a.ns.cheetahmail.com.
96.146.63.in-addr.arpa. 259200 IN NS b.ns.cheetahmail.com.
96.146.63.in-addr.arpa. 259200 IN NS c.ns.cheetahmail.com.
96.146.63.in-addr.arpa. 259200 IN NS d.ns.cheetahmail.com.
96.146.63.in-addr.arpa. 259200 IN NS e.ns.cheetahmail.com.
96.146.63.in-addr.arpa. 259200 IN NS f.ns.cheetahmail.com.
Posted by Neil Schwartzman on 18 April 2011 in Warnings, World | Permalink | Comments (0) | TrackBack (0)
Reblog (0) | | Digg This | Save to del.icio.us |
Posted by Neil Schwartzman on 18 April 2011 in Warnings, World | Permalink | Comments (0)
Reblog (0) | | Digg This | Save to del.icio.us |
Two weeks after the data breach, drug company Glaxo Smith Kline finally got around to notifying their clients, people registered at various 'product' websites, that their data was stolen. Along with your email address and name, the criminals now know which prescription drugs you may take. This makes spear-phishing attempts even more serious, falling for one of these may endanger your health should you buy fake drugs.
"The information accessed included email addresses and first and last names. The file from which your name and email address were accessed may have identified the product website on which you registered."
The company suggests you visit their website to see the full list of drugs they sell, but incredibly, a link to the list doesn't exist there, nor does a copy of the email they sent to end-users.
UPDATE: PHIprivacy has posted another copy of the GSK email (sent to someone who has no idea why she received a warning), and a list of drugs they sell.
CAUCE can't overstate the seriousness of this latest turn of events.
In other news, Websense noted late Friday that there is spam going out pretending to be Epsilon notifying consumers of new information about the breach. Clicking through a link on the very professional-looking payload website installs malware (a trojan) called 'Epsilon Secure Connect Tool' (epsilonsecureconnect.exe) on the victim's computer.
There is no indication if this spam campaign was a spear-phishing run, meaning a spam campaign aimed only at those people whose email addresses Epsilon lost in the breach, or if it was more widespread. More details on the attack can be found at The Tech Herald website (the malware is hosted by a company called Pugmarks.com, in Napierville, Illinois).
CAUCE's advice to consumers remains the same: Change your email address immediately! There is more information at:
Facts & Tips for Consumers about the Epsilon Breach
Was your Email lost by Epsilon? Change your Address!
Posted by Neil Schwartzman on 17 April 2011 in Warnings, World | Permalink | Comments (0)
Reblog (0) | | Digg This | Save to del.icio.us |
Operators of several gambling sites, Pokerstars.com, Fulltiltpoker.com and Absolutepoker.com and their online payment processors were charged with money laundering and fraud. Site domains and billions of dollars were siezed. It has long been known that these sites are dodgy, Joseph Menn laid much of it out in his book Fatal System Error (2010), with allegations of organized crime involvement, rigged gaming, and so on, and Journalist Brian Krebs made mention of money-laundering-by-gambling in 2007.
What Krebs alleges had been confirmed to CAUCE by federal investigators in private discussions years prior to that. The scam is easy, the perpetrators take a large amount of cash (usually stolen), and lose it to associates in online gambling games. Online thieves aren't the only people who avail themselves of this, terrorists use the scheme too, which may go some ways to explain the United States' stance on online gambling.
Online fora and Twitter went wild soon after these closures, with many noting that money they had in accounts on these sites was frozen and seemingly lost. The (big) house always wins.
You've probably seen the spam, where you click through a link, and end up with what looks like a news reporter, extolling the virtues of Acai berry as a cure-all.The FTC put an end to some of that, charging 5 different companies behind this ubiquitous scam. Some of the domains the spammer/scammers used were
breakingNewsAt6.com
channel2local.com
channel6reports.com
channel9healthbeat.com
bhannel9NewsReports.com
consumernewspick.com
consumertipsdaily6.com
healthnews10.com
news4daily.com
theconsumerweeklydigest.com
usahealthnewstoday.com
usahealthreportstoday.com
(While CAUCE thinks Acai Bery is a yummy drink, your local supermarket is a cheaper alternative to buying the stuff online from spammers)
Good riddance to bad garbage. We should take a moment to note that just because a site has the word 'consumer' in its domain name doesn't mean it has your best interests at mind. Caveat emptor, always, and especially online.
Posted by Neil Schwartzman on 16 April 2011 in United States, Warnings, World | Permalink | Comments (0) | TrackBack (0)
Reblog (0) | | Digg This | Save to del.icio.us |
CAUCE North America
PO Box 727
Trumansburg NY 14886
E-Mail: secretary@cauce.org
13. Apr. 2011
ICANN
by electronic mail
We appreciate the chance to comment on the ICANN WHOIS Review Team Plan as announced at http://www.icann.org/en/announcements/announcement-04mar11-en.htm
CAUCE NA, as an all-volunteer Internet end-user advocacy organization established in 1998 has moved beyond its original narrow mission of encouraging the creation and adoption of anti-spam laws to a broader stance of defending the interests of individual Internet users. CAUCE NA is led by a combined Board with a cumulative century of experience in the field of Internet advocacy and technology.
Based on that experience, including experience directly engaging with ICANN in a variety of capacities, we would like to offer the following comments on your proposed whois policy review activities.
Combatting Internet abuse without access to whois data would, in most cases, be difficult if not impossible. To paraphrase a common cliché, IP addresses and domains don't attack Internet assets, people attack Internet assets. We cannot pierce the veil and map IP addresses and domain names to those people without routine access to the crucial information whois data contains.
If whois were to cease to be routinely available, targets of serious Internet abuse will have no alternative but to employ lengthy legal process to compel disclosure of resource assignment and allocation information. This process is cumbersome, time-consuming and expensive, and benefits no one except the attorneys who will be involved in pressing or defending these actions, and the miscreants who will enjoy weeks, months, sometimes even years of anonymity in which to continue to conduct their abuse with impunity. This abuse happens at internet speed; a slow response is effectively no response at all.
Currently whois is offered on something of a "hobbyist" basis, particularly in TLDs that use the “thin” whois model. At one provider it will use one format, while at other times and at other providers, it will use another. This lack of consistent formatting, along with restrictive access policies, makes whois access something that's only suitable for small scale interactive "craft" access rather than being a production-ready and robust service that's appropriate for the volume of domains and other resources involved in today's domain name ecosystem.
If Internet abusers can script the creation of domains at arbitrary scale, but security teams and anti-abuse researchers are limited to some small number of manual whois queries per day, the abusers can obviously simply out-automate and out-scale us. This enforced handicap represents bad public policy.
Other technical ways that whois data access can and should be improved include:
While law enforcement officers play a critical role in mitigating online crime, they are too few in number and too poorly funded to mitigate all online abuse. Much online abuse is handled by other entities, ranging from non-sworn government administrative agencies (such as the Federal Trade Commission here in the United States), to non-governmental organizations such as CAUCE NA or Spamhaus, to agents of aggrieved private parties seeking to protect their company's assets (including facilities, trademarks and intellectual property being used online in illegal ways).
If whois access were narrowly restricted to sworn law enforcement officers only, the "thin blue line" of law enforcement, important though it may be, will not be sufficient to maintain the status quo. The security and stability of the Internet will be negatively impacted, with an associated loss of public trust and transparency.
That said, we would not object if sworn law enforcement officers or civil investigators were offered expanded access to whois data, such as a routine ability to view an unfiltered version of whois data that is not encumbered by obfuscating private or proxy registration mechanisms — provided such access is authenticated, logged and audited to protect against arbitrary abuse and misuse.
We have seen examples of whois data services that are present in name, but effectively of no value. For example, consider the data for chase-online-banking.com:
Domain: chase-online-banking.com
Registrar: Eurodns S.A.
Registrant:
Company:
Name: I P Freely
Address: 123 blowme lane
City: tacoma
Country: UNITED STATES
Postal Code: 98409
Administrative Contact:
Company:
Name: I P Freely
Address: 123 blowme lane
City: tacoma
Country: UNITED STATES
Postal Code: 98409
Phone: +012589636541
Fax:
Email: maiybs@gma.com
Technical Contact:
Company:
Name: I P Freely
Address: 123 blowme lane
City: tacoma
Country: UNITED STATES
Postal Code: 98409
Phone: +012589636541
Fax:
Email: maiybs@gma.com
Original Creation Date: 2011-04-04
Expiration Date: 2012-04-03
Status:
clientTransferProhibited
This entire WHOIS entry is transparently fraudulent. There is no “blowme lane” in Tacoma WA, no North American phone number starts with 01, and even if the zero were corrected as a typo, there is no 258 area code. The e-mail address is invalid, and even the simplest attempt to send a confirmation message would have revealed that mail to it is rejected.
If we see abuse involving that domain, which we have, there is no way to find an appropriate security or abuse contact.
It is nominally whois data, but it provides no information whatsoever about who or what that domain actually is. This shows what whois can devolve to, if we as a community allow it to degrade without objection.
We acknowledge that whois data, like any data, can potentially be abused. Not all whois data is equally at risk, however. For instance, we do not believe that an entity engaged in Internet commerce should have the same right to anonymity online that a political or religious dissident might require, and in fact, the customers of the Internet have a compelling right to know with whom they're doing business. We therefore urge ICANN to eliminate whois anonymity as an option for corporations and other non-natural persons controlling Internet resources.
When missing or inaccurate whois information is detected, users have the option of reporting that inaccuracy via the Whois Data Problem Reporting System (http://wdprs.internic.net/).
Unfortunately that system is operationally cumbersome, requiring domain-by-domain reporting via a web form, followed by email confirmations, even in cases where hundreds or thousands of domains share the same inaccuracies and the same registrar.
We understand that ICANN has a bulk WDPRS submission facility currently used by only a small number of high-volume reporters. That service should be made available, with suitable registration or other safeguards to deter abuse, to any entity submitting multiple WDPRS reports.
We also believe that the information WDPRS receives is not being appropriately leveraged to identify and address ongoing abuse. While WDPRS complaints may result in the correction of individual erroneous whois records, ICANN does not use that data to identify systematic problems, including potentially rogue ("bulletproof") registrars who make no effort at maintaining accurate whois data whatsoever — and may even treat whois inaccuracy and other violations of ICANN's rules as a competitive advantage.
Moreover, why is ICANN not sharing the substance of the community WDPRS reports it receives with community stakeholders? If there was more transparency about the reports received, consumer confidence in whois data accuracy would improve and we could even imagine a "PhishTank"-like model where community members could help to verify the reports that have been made via WDPRS.
We also believe that the costs associated with correcting erroneous whois data, particularly in the case of grossly and obviously inaccurate whois data, should be passed along to the registrar that has allowed that data to be accepted. Even the simplest of automated screening would easily allow many bogus point of contact data elements to be flagged at the time of domain registration; other types of online businesses have been doing this for years. Currently some registrars do not care if they accept bogus whois point of contact data, but if there were financial consequences to large amounts of invalid WHOIS, that could change.
Registrars that exhibit a clear and ongoing pattern of routinely accepting or failing to correct obviously bogus whois information should be subject to notice and breach proceedings under the registration agreement.
The Review Team also asked for feedback on the adequacy of the definitions it proposed at http://www.icann.org/en/announcements/announcement-04mar11-en.htm
In our opinion, the following adjustments would strengthen those definitions.
As written, definition 4.1 (Law Enforcement) does not distinguish between sworn law enforcement officers with criminal law enforcement powers (such as sworn federal law enforcement officers, sworn state police officers, sworn county sheriffs, and sworn municipal police officers here in the United States), and other entities incidentally included in an overly broad definition, including judges, lawyers, prosecutors, private security officers, administrative investigators and even parking enforcement officers (so-called "meter maids") whose responsibilities include "maintenance, co-ordination, or enforcement of laws, multi-national treaty or government-imposed legal obligations."
We believe "law enforcement officers" should be defined more narrowly to be only those individuals who have:
In adjusting this definition, we do not mean to imply that ICANN should exclude non-sworn government officials from the scope of its work -- even though those government officials are non-sworn, they play an important role in enforcing applicable law via civil processes. They simply require a different label (such as "civil enforcement officer" or "administrative enforcement agent").
For example, here in the United States, while FTC investigators are not sworn law enforcement officers, they play an important role in compelling fair business practices using the civil enforcement powers at their disposal. They're just "investigators" and not "law enforcement officers" within the customary meaning of that term of art.
We also believe that ICANN should explicitly consider whether "law enforcement" includes those who may be members of national intelligence services, or a country or multinational organization's military services, recognizing that in some countries (such as the United States), there may be as many as seventeen agencies and organizations involved in collecting and processing national security-related intelligence information (see http://www.intelligence.gov/about-the-intelligence-community/ ).
Definition 4.2 (Applicable Laws) appears to concentrate primarily on laws related to "the collection, use, access, and disclosure of personally identifiable information." That focus would be appropriate if whois policy issues turned solely on matters related to registrant privacy.
CAUCE NA believes that any whois study must recognize the applicability of all criminal and civil laws on whois policy, and the impact of whois policy on those laws in turn.
Such laws would include, but not be limited to:
Only when personal privacy rights are weighed against the full set of criminal and civil laws designed to protect a jurisdiction's citizens, can we achieve an appropriate balance between protecting privacy and protecting citizen's property and persons from all applicable risks.
In many cases the protection of property and persons from malicious actors is best served by access to whois information, rather than by withholding that information from interested parties.
Thus, that balancing process requires a more inclusive definition of "applicable laws" in CAUCE's opinion.
Defintion 4.3 ("Producers and Maintainers of WHOIS DATA") comingles a variety of parties and roles in ways that fail to adequately recognize important differences in perspectives and interests. For example, 4.3.A, "Producers" is defined as "The individuals or organizations supplying contact data for inclusion into WHOIS data." While that's seemingly a simple entity -- typically the person registering a domain -- in reality, things are less clear.
For example, whois data producers may include:
These roles may change over time as well. For example, an engineer who may have initially registered a domain on behalf of an employer may change roles or change employers, yet still be carried on a registration as the point of contact for that domain, simply because the relevant data has never been verified and updated.
We might attempt to clarify all this by referring to an "initial producer" of whois data, or a "primary producer" of whois data, or a whois data "producer of record," depending on our emphasis, but any of those titles are only an approximation given the actual underlying practice.
We are also confused by the definition of "Data Controllers," particularly the trailing sentence fragment: "May or may not be directly involved in these functions." While that tautologically covers all possible cases, and in fact all persons, it does little to illuminate what's intended in this case, and is so overly inclusive as to render the definition of "Data Controllers" effectively meaningless.
More substantively, the sundry roles lumped into the "definition" of "Data Controllers" should be explicitly teased apart unless there is some compelling reason to throw them all into the same vague stew. Those who may work in the IETF to define the whois protocol (thus defining what data may be collected), have little to do with those who may work in ICANN to "govern" how that data may be used, or the judges who may "require its release." Don't lump them all together.
Finally, we are not persuaded that the articulated program of work will substantively meet the defined purposes of:
If you have a grand program of work, but it doesn't meet those goals, you're wasting your time.
If ICANN wants to know these things, we recommend that it collect hard data on these topics using generally accepted technical market research and statistical methods. Simply asking for comments from the "usual suspects" (particularly when scant feedback is often provided) will not give a true understanding of what's happening in the real world.
Given the technical nature of the questions involved, ICANN should formally poll experts knowledgeable in the areas involved, as well as law enforcement agencies with officers who specialize in cyber crime, and organizations that represent consumer interests. This engagement needs to be proactive on ICANN's part, and not merely represent a willingness to listen to comments that may happen to trickle in from particularly motivated respondents who happen to comment.
Thank you for the opportunity to comment on this work, and we stand ready to address any points about which you may have questions or need further information.
Sincerely,
CAUCE North America
Posted by Neil Schwartzman on 15 April 2011 in Canada, Press Releases, United States, Warnings, World | Permalink | Comments (0)
Reblog (0) | | Digg This | Save to del.icio.us |
Welcome
Welcome to the thirteenth year of CAUCE News. CAUCE was involved in an unprecedented number of important initiatives in 2010, which we would like to take a moment to tell you about.
CAUCE participated in the Digital Phishnet meetings in Montreal, Canada, was represented at the Anti-Phishing Working Group meetings in Dallas, the Team Cymru Cybercrime meetings in Lyon, France, attended all meetings of the Messaging Anti-abuse Working Group, was present at Toronto's ARIN (American Registry for Internet Numbers) meeting, several IETF (Internet Engineering Task Force) meetings, and countless hours advocating for the passage of Canada's Anti-spam Law, C-28, now known as CASL.
CAUCE was instrumental in the development by the U.S. FCC's Communications Security, Reliability and Interoperability Council (CSRIC) its ISP Network Protect BCP document, providing substantial input to the final product.
We thank all our CAUCE supporting and organizational members, whose yearly membership fees allow CAUCE to function, to attend these conferences, and to advocate on behalf of computer users who want to see the fight against malicious online abuse come to a succesful end. All CAUCE directors and officers are volunteers who give generously of their time.
Facts and Tips for Consumers about the Epsilon Breach
Epsilon Interactive, who sends commercial email on behalf of hundreds of companies, admitted to a security breach that they detected some time in March. Journalists covering the story have collected notifications sent by about 70 companies, including many financial institutions.
If you received a notification from one of Epsilon's clients, the thieves know your name and email address. Depending on which company had your information, the thieves may also be know the hotels you may stay at, which credit cards you may use, or where you buy stuff online. If your email address shows up on several of these lists, the criminals can draw together a pretty accurate profile of who you are, and what you typically do, and can guess your income level. Ironically, that is what companies like Epsilon do with the data, too.
There has been a lot of talk, blogging, tweeting and press reportage about the Epsilon breach, but little in the way of concrete information to consumers as to where they stand, if their personal information (PII) such as their name and email address has been lost to criminals. The CAUCE Board of Directors have developed the following FAQ that provides facts and guidance for those affected by the breach
Read more
Impenetrable Processes and Fool's Gold at ICANN
By: J.D. Falk, Director-at-large
A couple of weeks ago, I attended part of the ICANN meeting in San Francisco. I've been watching ICANN and been peripherally aware of their issues since the organization began, but this was my first chance to attend a meeting.
What I learned is that ICANN is a crazy behemoth of a bureaucracy, steeped in impenetrable acronyms and processes that make it nearly impossible for someone new to get up to speed.
The best example of this is the recent approval of the .XXX top-level domain. There are already top-level domains for specific types of companies or organizations: .MUSEUM for museums, .COOP for co-ops. None of them have been very successful ? there are only a few hundred museums in .MUSEUM and 6000 co-ops in .COOP ? but they've been mostly harmless. So okay, the adult entertainment industry wants a top-level domain, why not let them have it?
Read more
C-28 Anti-Spam Law Receives Royal Assent
By: Shaun Brown, Counsel & Director-at-large
It's been a long time coming, but Canada finally has an anti-spam law. Bill C-28, the law with no name, was passed in December, 2010
First introduced in April 2009 as C-27, the Electronic Commerce Protection Act, it died when parliament was prorogued in December 2009, only to be resurrected in May of 2010.
Having been involved since the beginning, and eagerly awaiting its passage, CAUCE is excited and relieved to see Bill C-28 become law; it provides Canada with the tools to do its part in the global fight against spam and related threats.
Read more
Yes, People Still Care About Email Spam
Just over a month ago, we posted an article entitled "Do People Still Care About Email Spam Anymore?". Part of the reason why people might not care anymore, according to this article, is that email has become pass?. With so many other new ways to communicate, why even bother with email?
Not only did a few readers take the time to post some compelling counter-arguments to our article, even muckraking marketing columnist Ken Magill has weighed in on the debate. Citing a few recent studies ? including a finding by the Pew Internet & American Life Project that email is still the No. 1 online activity across all age groups of internet users ? Magill goes so far as to advocate a pretty hefty dose of harassment for the next person who states in public that email is dead.
According to The Radicati Group, there are currently 1.4 billion email users. A study by Nielsen found that 25 minutes out of every hour spent on a mobile device is on email. And so on.
Read more
Consider supporting CAUCE by becoming a free or supporting individual Member or an organizational Sponsor: Join Here. Organizations can support CAUCE at several levels, starting at $5,000 per year. Sponsors may enjoy a range of benefits, including logo placement and recognition in our periodic newsletter. Please contact us via e-mail at support@cauce.org for additional information.
We encourage redistribution of this message, as long as they are not spammed anywhere, are on-topic for any forum to which you send them, and include our copyright notice. When in doubt, post the URL of our site (http://www.cauce.org) instead, or put it in your signature. Press, broadcast, and Internet media may treat this material as they would a press release.
Posted by Neil Schwartzman on 13 April 2011 in Canada, United States, World | Permalink | Comments (0) | TrackBack (0)
Reblog (0) | | Digg This | Save to del.icio.us |
CAUCE North America is financially supported by our organizational and individual members.
