CAUCE

Microsoft, others help take down Rustock Botnet

Microsoft's DCU and some federal agencies took down the Rustock botnet two days ago. A hearty CAUCE congratulations to all those involved, in the forefront, and behind the scenes.

Here's a compilation of various news and data sources:

Krebs on Security: http://krebsonsecurity.com/2011/03/rustock-botnet-flatlined-spam-volumes-plummet/
Wall Street Journal: http://online.wsj.com/article/SB10001424052748703328404576207173861008758.html

Microsoft: http://blogs.technet.com/b/mmpc/archive/2011/03/18/operation-b107-rustock-botnet-takedown.aspx & http://blogs.technet.com/b/microsoft_on_the_issues/archive/2011/03/18/taking-down-botnets-microsoft-and-the-rustock-botnet.aspx

CBL (2nd & 3rd charts) http://cbl.abuseat.org/totalflow.html  & http://cbl.abuseat.org/rustock.html
Spamcop: http://www.spamcop.net/spamgraph.shtml?spamweek
Nixspam: http://img.ly/3eix

The court orders (PDF) http://bit.ly/fg0d0u

Don't be fooled by fake New Zealand earthquake relief spam

All too predictably, after the recent earthquake in Canterbury, New Zealand, spammers are taking advantage of people's natural kind inclinations and sending out spam for fake earthquake relief organizations. If you do want to send something, send it through one of the organizations below, which are known to be genuine:

• Canterbury Earthquake Appeal. Currently no web page, donate via ANZ Bank account number 01-1839-0188939-00, or National Bank account number 06-0869-0548507-00
• NZ Red Cross http://redcross.org.nz/, or Kiwibank account number: 38-9009-0759479-00 or ASB bank account number 12-3192-0015998-02
• Salvation Army http://salvationarmy.org.nz/ or Westpac Bank account number 03-0207-0617331-00
• SPCA- Canterbury http://www.spcacanterbury.org.nz/ , or Westpac account number 03-0802-0586429-00
• Bank donation accounts, run by major NZ banks: 
  • ASB Bank account number 12-3205-0146808-00
  • BNZ Bank account number 02-0500-0982004-000

 

BBC World News Facebook Account Hacked

Sadly, it can happen to anyone. Poor passwords, or clicking on an errant link can end up with something like this on your Facebook account. There is, of course, no such tool, although the landing page at http://valcreepers.tk/ will try to convince you otherwise.

 

Don't be fooled - don't add this rogue app, or any other, to your Facebook account, ever.

C-28 The Law of The Land!

VICTORY!

It’s been a long time coming, but Canada has an anti-spam law, and one, which sets a new world standard, and a tough, but fair, opt-in protocol for everyone in North America who sends commercial email and other  electronic messages.

Yesterday, The Canadian Senate voted to accept Bill C-28, and today, December 15, at 13:00 eastern, it will be given Royal Asset of the Governor General of Canada, His Excellency the Right Honourable David Johnston.

It has been a long, arduous road to get to this point. In 1998, born as an offspring of U.S. anti-spam organization CAUCE, CAUCE Canada came into being.
 
Our mission? To get an anti-spam law passed in Canada.

Over these dozen years, there were fits and spurts along the way, with private member’s bills like that of Dan McTeague, and Senator Oliver, and several others. In 2004-2005 CAUCE played a prominent role in The Federal Task Force on Spam with full hopes of a law being forthcoming.

Years passed, and despite the final report of FASTF being readily accepted, and in fact setting standards world-wide as the seed for other laws, regulations and industry best practices, still no law.

Then, in 2009, a breakthrough – a bill, C-27, was introduced. Over the course of the year, there was testimony by CAUCErs Matt Vernhout & Dennis Dayman to parliamentary committee. There was support. There were naysayers. There was misinformation right up to the last minute, and there was grassroots use of social media.

There was heavy lobbying against the bill, and there was Conservative Minister of Industry Tony Clement who stuck to his guns and resisted attempts to gut the bill. That session of parliament came and went, and in 2010, the bill, slightly amended to deal with some technical issues, was re-introduced. Senders, industry, receivers, politicians from all parties, mandarins, and CAUCE were all in agreement: Canada needed a law, and C-28 wasn’t just good enough – it was great. C-28 now sets a best-of-breed world standard.

To all my colleagues worldwide who have helped this effort in every way possible, I extend my deepest gratitude and most profound thanks, particularly to Scott Hazen Mueller whose visionary thought lead to the creation of CAUCE in 1997.

We have had many board members come and go along the way, but CAUCE founding members Mike ‘der Mouse’ Parker, John Levine, JD Falk, and Chris Lewis stuck with the organization through highs and lows; through it all, with solid support and determination, and they deserve special mention for 12 years of work. Our newest additions, Dr. Joe St. Sauver and Shaun Brown provided sage guidance in the final stretch. Gentlemen, I thank you all, as do all Canadians (whether they know it or not) for your help to get us here.

CAUCE must also share congratulations with many from Industry Canada: André Leduc, Richard Simpson, Michael Binder, Jennifer Kealy, Shari Scott, Andy Kaplan-Myrth, Serge  Presseau, Janet Difrancesco, and many others – please forgive me if your names are forgotten in my excitement to write this - your support and work are decidedly not.

My friend Tom Copland of the Canadian Association of Internet Providers, CAIP, was a stalwart supporter of this bill, and he too merits our thanks. Of course, The Right Honourable Tony Clement who was nothing less than fantastic, for understanding the Internet well enough to have a vision, and a Twitter account, @TonyClement_MP which I abused mercilessly.

CAUCE has an incredibly talented and diverse board, with legal experts, top-notch markers, malware & botnet research elites, all faced with no shortage of work ahead to see that the law is properly implemented, and applied.

Someone recently said C-28 renders CAN SPAM obsolete. Just so, but there is still much work for us to do, to promote a harmonized legal régime throughout North America and the Caribbean, and internationally.  CAUCE will continue to be there, nagging, cajoling, pleading, advocating and demanding that the governments of the world put into place legal protections for all users of the Internet.

Governments, Politicians and Bureaucrats take note: We are your brothers, your mothers, fathers, friends and sisters. We are not consumers, we are Internet users. Respect us for that, do your duty, and protect our right to enjoy our connective technologies unsullied by the harassment of abusive, unwanted communications in all its manifestations. Your job is to draw distinct lines, well overdue, to stop rampant insanity perpetrated upon us all by the rapaciously greedy violators of our fundamental right to privacy.

The net is a place where commerce is done, but it is far more so a place where friends meet, people fall in love, students learn, dissidents agitate for political change, artists create, and folks live an enriching part of their lives. C-28 and laws like it help to protect this invaluable resource, our worldwide shared commons. Today, C-28 made all this a little more possible, and I couldn’t be happier or more proud.

One down, so many more to go! Onwards!

Neil Schwartzman
Executive Director
CAUCE, the Coalition Against Unsolicited Commercial Email

Kidnapping, Theft and Rape Are Not "Cyber" Crimes

Kidnap. Rape. There are no lesser words that can be used to describe what happened to the daughter of an anti-spam investigator in Russia.

His daughter was recently released, according to Joseph Menn’s recent article on Boing Boing, after having been kidnapped from her home five years ago, fed drugs, and made to service men, as a warning to ward off further investigations.

The criminals behind these vicious acts were also responsible for large spamming organization associated with Russian Mob activity.

Note that we say "also."

When someone is mugged, harassed, kidnapped or raped on a sidewalk, we don't call it "sidewalk crime" and call for new laws to regulate sidewalks. It is crime, and those who commit crimes are subject to the full force of the law.

For too long, people have referred to spam in dismissive terms: just hit delete, some say, or let the filters take care of it. Others — most of us, in fact — refer to phishing, which is the first step in theft of real money from real people and institutions, as "cyber crime." It's time for that to stop.

Some of these crimes involve technology. So what? Criminals have used technology before.

Some of these crimes cross borders. So what? Crimes have crossed borders before.

Spam isn't illegal everywhere yet. So what? Spam 2.0 (spam, malware & spyware) is the leading edge of far worse activities, often things that have been illegal as long as we've had laws.

It is high time that governments and law enforcement stop thinking of computer crime as that perpetrated by teenagers in their parent’s basement. It is the Russian Mob and other organized criminals that are doing this.

While we are at it, we should mention ‘cyber-warfare’, something too often conflated with cyber-crime. Cyber-crime is not "cyber-warfare.” There may be state or terrorist agencies copying the tactics and methods of these criminals, but that does not mean that the criminals must be left alone until new cyber-warfare agencies have been created and funded.

As Purdue computer science professor ‘Spaf’ Spafford was recently quoted as saying in a note-worthy piece ‘Cyberwar Vs. Cybercrime’ on the GovInfo Security blog

"Why aren't we seeing the investment and prioritization being made in law enforcement, first? Why is all the publicity, funding and prioritization being given to the military - with efforts such as the build-up of the military cyber command - when so much of the clear and present threat is from the criminal element and not from other nation-states?"

Just so, Prof. Spafford!

As we have said repeatedly on this site, these are criminal gangs who have found an incredible loophole in the justice systems of the world: they can rob banks and people, with little chance of getting caught, let alone going to jail. This is not because they're doing things that aren't illegal; they've just found a new way to hide.

David Black, manager of the RCMP's cyber infrastructure protection section recently said to CAUCE Executive Director Neil Schwartzman “we don’t do spam”. OK, but why not? Spam is no longer, and hasn’t been for some time, about simply sending unwanted emails. Spam is now a delivery mechanism for malware, which in turn threatens infrastructure, and facilitates theft. We have seen precious few cases filed using existing Federal computer intrusions laws in Canada, and none, to our knowledge have been filed under the renovated anti-phishing law, S-4, passed in September 2009.

Governments and law enforcement agencies need to begin to treat online theft with the same seriousness as they do other physical crimes. It is time to bring this up to the diplomatic level, or seriously consider refusing packets from places that treat the Internet, and innocent victims, as their personal ATM.

CAUCE is made up of people who care about email qua email. We understand it, we love it. It is still the ‘killer app’. Furthermore, we understand why some folks in law enforcement or the judiciary might ask, "When there are people stealing millions or hurting people in the commission of violent crimes, why are you wasting our time with 'just' a spam case?” Here's why:

1. Most spam is sent by organized criminal gangs, just like other organized crime.
2. Those gangs intentionally operate trans-nationally, in an effort to frustrate investigation and prosecution.
3. Money laundering of the proceeds from spam is routine, and that money directly fuels official corruption and other social ills.
4. Some spammers are actually selling something. Their favorite product? Counterfeit pharmaceuticals. In many cases these may be scheduled controlled substances, sold in bulk, and available to minors; in other cases, critical medicines needed to properly treat cancer and other serious illnesses may be counterfeit placebos, with potentially tragic results.
5. Spammers operate by compromising tens or hundreds of thousands of end-user PCs, violating those users' privacy and sometimes steal sensitive personally identifiable information such as individuals’ and even corporate access to financial services at the same time they're using their systems to spam. Computer ‘phishing’ is no less a crime than bank robbery, home invasion, and mugging.

Cyber criminals consider cyber crime to be a virtually riskless offense; they're unlikely to be identified; if identified, they're unlikely to be investigated; if investigated, they're unlikely to be charged and prosecuted; if prosecuted, they're unlikely to be convicted; if convicted, they're unlikely to do jail time.

The courts need to make it clear that that's wrong in all respects. If you commit cyber crimes, you will be identified, investigated, charged, prosecuted, convicted and sentenced to serious time and we will seize your assets.

This will not happen so long as crime, which involves the Internet, is dismissed as "cybercrime" and either scoffed at, or used to justify ever-increasing cyberwarfare budgets

This isn't just email. This isn't a war. This isn't "cyber.” This is crime. It is time to call a cop, and expect a response.

 

by CAUCE Executives J.D. Falk & Neil Schwartzman

Who Are Domain Names For?

Last week, the Libyan government seized and disabled Violet Blue's "sex-positive" vb.ly URL shortener. I've discussed URL shorteners before, but what does Libya have to do with it?

Actually, that part's pretty simple. The .LY domain belongs to Libya, so their laws apply -- even if the registrant or their web site isn't physically in Libya. The company which manages registrations in .LY decided to permit registrations by companies or people outside of Libya, but they still own it.

Originally there were only a handful of "global" or "generic" top-level domains, known as gTLDs, available to anyone in any country: .COM, .NET, .ORG, and .EDU. .GOV and .MIL were effectively only for the United States. .INT, reserved for organizations created by international treaty, is rarely seen.

Each country has their own ccTLD, based on the ISO two-letter country codes. Some are fairly obvious to English speakers: .US for the United States, .CA for Canada, .UK for the United Kingdom, .AU for Australia. Some seem a bit more obscure, due to differences in language or conflicts with other names: .TD for Chad, .RS for Serbia, or .ZA for South Africa.

Each ccTLD authority sets their own rules for who is allowed to register one of their names. Island nations Tongo (.TO) and Tuvalu (.TV) have reportedly made some pretty good money by permitting non-local registrations. After splitting from Yugoslavia (.YU) and Serbia, Montenegro opened .ME in hopes of attracting English speakers -- and sold over 320,000 domains between 2008 and 2010. Colombia's .CO, which attracts typos of .COM, sold half a million in two months -- mostly to registrants in the United States.

But none of this addresses the real question: what do actual users care about?

In March the most popular search term on Google, Yahoo!, and Bing was "facebook". Other top searches across all three, according to Experian Hitwise, included youtube, myspace, craigslist, ebay, and gmail. Perhaps ironically, "google" was the second most popular search on Microsoft's Bing.

Does it matter whether Facebook is facebook.com, fb.me, facebook.ca, facebook.co.za, et cetera? Well, unfortunately, it kind of does. If a bad guy registered facebook.ql (which is just an example, there's no .QL ccTLD), then they could put up a site that mimics the real Facebook, and send phishing email which might have a better chance of fooling users than the usual nonsense domains. And, of course, there are the usual trademark issues. So, Facebook has had to register in all of these.

To put it another way: big brands are effectively required to register their trademark in every gTLD and ccTLD they can, because most users are completely unaware of gTLDs and ccTLDs. If the TLDs effectively separated different types of organizations, as was originally imagined, then this wouldn't be necessary.

There's also another type of user to consider. Violet Blue chose to register vb.ly because she wanted something short and easy to remember, and was following the trend set by bit.ly, jl.ly, et cetera. Unlike .ME or .TV the value wasn't that vb.ly has any particular meaning, but rather that it's short and appeared to be easy. URL shorteners are for the people who don't type "facebook" into google, and do want to share links to specific things. Of course, if web designers considered the length of URLs when designing their sites, this wouldn't be as much of an issue.

ICANN, the quasi-non-governmental organization which oversees these top-level domains, has introduced quite a few other gTLDs in recent years. Many of these are restricted in some fashion, which helps to reduce the land rush; for example, .MUSEUM is only for museums, though of course most museums already have domains under .ORG, .EDU, .GOV, or an appropriate ccTLD.

Only two of the newer gTLDs are unrestricted: .INFO, and (for most purposes), .BIZ. When was the last time you saw a company put their primary site in .BIZ or .INFO, rather than having it be a redirect to their site in .COM? Oh hey, it was Return Path -- and we switched a few years ago to returnpath.net, because most of our neighbors in .BIZ were spammers or phishers. .INFO has the same spam problem; some spam filtering software sees the mere presence of .BIZ or .INFO as increasing the likelihood that a message is spam.

Ignoring these concerns, ICANN has decided to open up the namespace further and permit pretty much anyone with $185,000 and a bunch of nameservers to register their own gTLD -- likely before next March. It's unclear if anyone actually wants this except the potential new gTLD registries, who stand to earn a lot of money over trademark concerns. For example, the .CO registry initially offered a "Specially Protected Marks" program, permitting companies to register their trademarks ahead of the general populace. .CO claims "100% Participation by Leading Brands", and any new unrestricted gTLDs can surely expect the same.

Even if a company creates a new gTLD for their own use, such as .IBM, they'll still need to keep ibm.com, lotus.com, et cetera -- everything they have now, plus the same trademarks in every other gTLD.

Once all that dust has settled, and the registries and ICANN have made their money, we'll still be left with an ever-greater threat of phishing or other brand hijacking. Most end users will still expect to find their friends by typing "facebook" into google, while a smaller number will still want shorter URLs.

If domain names are for end users -- if, indeed, the internet is for end users -- then why do we need more TLDs?

(This article was originally published on The Received: Blog, and has been reproduced here with permission from from Return Path.)

How Your Privacy Is Exploited Online and How To Protect Yourself

I spotted a disturbing headline which reminded me to repost a recent series about online privacy in the Wall Street Journal.

Suit alleges Disney, other top sites spied on users - CNET News

A lawsuit filed in federal court last week alleges that a group of well-known Web sites, including those owned by Disney, Warner Bros. Records, and Demand Media, broke the law by secretly tracking the Web movements of their users, including children.

...

Among the laws that were allegedly violated by Clearspring and the other defendants are the Computer Fraud and Abuse Act, California's Computer Crime law, and that state's Invasion of Privacy Act.

(CNET uses trackers themselves. Using the Firefox plugin Ghostery, we see that they monitor using Twitmeme, Comscore Beacon, Revenue Science, Yahoo Buzz, Facebook Connect, Google Analytics, and Chartbeat to monitor your surfing)

The article above references a multi-part series I highly recommend you read if you care about your online privacy (just for the record, the Wall Street Journal uses the following trackers: Facebook Connect, MSN Ads, Chartbeat, Peer39, Fox Audience Metrics,  Google Analytics, Omniture, WoprdPress Stats.

CAUCE uses Google Analytics and Bit.ly, and Typepad, where we are hosted, inserts Quancast tracking into our posts.).

The New Gold Mine: Your Personal Information & Tracking Data Online - WSJ.com

How to Outsmart Tracking Cookies on the Web - WSJ.com

What They Know About You - Personal Information Tracked Online - WSJ.com

Analyzing What You Have Typed - WSJ

Facebook, Privacy, and the Loss of Trust

Image by Compound Eye via Flickr

Facebook sure is getting beaten up recently. There's even a crowd-funded initiative to replace it with something open, called Diaspora -- everyone on Facebook is talking about it.

Yet it wasn't even two full years ago that Facebook was the darling of the ditherati. For a while it seemed as if nearly everything Facebook did was hailed as the future of messaging, perhaps the future of the Internet — or maybe the Internet didn't matter anymore, except for Facebook. Even obvious scams got VC funding, so long as they were on Facebook. But with just a few missteps -- which they appear to believe were nothing more than misunderstandings -- everything's changed.

The first tipping point, it seems, was Facebook founder Mark Zuckerberg's statement that he doesn't believe in privacy, with the obvious connotation that therefore he doesn't have to concern himself with it. But as researcher danah boyd responded, privacy isn't just about whether or not you share stuff -- it's whether or not you have any control over what you share, and who you've shared it with.  And besides, it doesn't matter whether Zuckerberg believes in privacy.  Facebook's users still do.

The problem Facebook has created for themselves is not that nobody wants to share information about themselves; it's quite obvious that there's a lot of sharing going on. It's that with each new feature, Facebook changes the social dynamic. Before, Facebook users felt and believed that they were sharing with their friends, and with particular networks they'd chosen; it was a closed environment, with borders that were clearly defined and understood. And if a few advertisers got to peek in, well, that was the price of admission. But now, after many changes, much of that same information is entirely public -- unless each user individually goes through a set of complex steps to opt out.

It's akin to sending email to a private mailing list, only to have it forwarded to a reporter and published. Sure, it's always possible that that can happen, but we can either trust each other to abide by the social contract to not do such things, or we can't trust each other at all.

Facebook's staff may well have thought to themselves that if they asked users to opt in to having their data shared with a much broader audience, the users would decline -- and they were probably right. But by ignoring that insight and making it opt-out instead, they showed a severe lack of respect for their users. Without that respect, there can be no trust. Without that respect, your users will turn on you -- because they were never really "your" users to begin with.

Once trust is lost, what do you do? Can it ever be regained? Or will trustworthy behavior have to be forced upon them by regulators?

We at CAUCE have pondered this same question over the years in terms of companies who used to send spam, and have since learned not to. Some people will never forgive them, no matter what they do. Others won't see what the big deal is, because the spam never affected them personally. But most will fall somewhere in the middle, never quite trusting the company not to spam them again.

That middle area is the most Facebook can hope for at this point, and the way to gain it is to start viewing everything in terms of "what do users think is going on," rather than "what do we want users to think is going on?" More than anything else, they have to ask themselves: "are we being respectful towards our users?  Are we allowing them the choice and control they believe they already have?"

It sounds like they're already thinking in this direction, or at least they want us to think they are -- but that doesn't mean users' perceptions will change overnight. Facebook won't be forgiven that easily, especially if their PR tactic is essentially "oh, you just didn't understand what a wonderful thing we're doing." They'll have to patiently explain their thinking in an honest way, keeping corporate doublespeak to a minimum -- and stay consistently respectful for a very long time.

Even then, success may not be measured by a decrease in angry blog postings. It also won't be measured by a decrease in the number of people deleting their accounts. Trust is much more nebulous than that. If anything, it'll be measured by whether anyone's willing to try new features when given the opportunity to opt in -- and that, too, could take a long time.

If they stick with it, and they're open and transparent about the change, then they could continue to be the largest and most successful proprietary social network that has ever existed...at least until some other tipping point occurs.

Related articles by Zemanta

• Mark Zuckerberg may have wanted this kept private (trueslant.com)
• The best article ever about Facebook (fakesteve.net)
• Facebook Should Follow Its Own Principles (eff.org)
• Facebook's follies: A brief history (news.cnet.com)
• Taking permission (wordtothewise.com)

ARIN makes a sane decision about IP WHOIS

The recent ARIN XXV meeting in Toronto had two positive developments related to WHOIS privacy and accuracy of data.

A decision was rendered about contentious proposal 2010-3: Customer Confidentiality https://www.arin.net/policy/proposals/2010_3.html which allowed for commercial IP holders to have hidden WHOIS records, ostensibly to prevent client poaching between ISPs. As one commenter said at the meeting 'if you are losing customers, fix your business'.

Both CAUCE and MAAWG were opposed to this proposal, which was withdrawn by the submitter, Aaron Wendel, after some discussions with representatives of the LEA community. The proposal made provision for decloaking WHOIS records upon request, court order, etc. by law enforcement, a hopelessly naive understanding of the current situation with regard to anti-abuse work. It was impressed upon the assemblage that grass-roots anti-spam investigations were behind the majority of takedowns of malicious sites, for example. Tom Grasso, an FBI investigator who was in attendance commented, "95% of our successful cases are as a result of grassroots investigators. Limiting ARIN WHOIS to LEA is not a good idea"

Despite having been withdrawn, a vote was taken, and nonetheless, defeated roundly.

Of the 133 attendees to the meeting, 5 voted in favour, 70 against.

A second bit of good news was related by Leslie Nobile, ARIN Director of Registration Services who noted that ARIN would commence a process of confirming all WHOIS email points of contact, beginning in June, 2010, and that this would become an annual process.

CAUCE Director Matt Sergeant was in attendance at ARIN to represent our position as a signatory and supporter of the MAAWG position statement.

Download MAAWG Comments ARIN Draft Policy 2010-3

Email User Safety At Risk - MAAWG Consumer Survey 2010

The 2010 version of the now-annual Messaging Anti-abuse Working Group (MAAWG) ‘Email Security Awareness and Usage Report’ was released yesterday. While un-belied by the title, the vernacular name might get a bit more attention: ‘The MAAWG Consumer Email Survey”.

The key findings of this comprehensive study can be found here, and the full report downloaded here.

Consumers were surveyed in North America and across Europe with a variety of questions from computer expertise and savvy, to their preferences of email.

Many of the findings are both shocking and disturbing; despite efforts to the educate, consumers are well unaware of the consequences of their actions, and a painful percentage continue to click on spam, knowingly, instead of deleting it immediately. Such actions has, of course, lead to the gargantuan increase in botnet presence on the ‘net and zombie’d computers continue to steal millions of bits of personal and confidential business information as a result.

Clearly, a concerted effort to heighten consumer awareness of the very real dangers on the net is needed; involving all stakeholders, marketers, receiving sites, government, and NGO consumer advocacy groups. The resources are out there, for example StopSpamHere.ca and Onguardonline.gov (more resources below), but do not appear to be used, or sage advice heeded.

Equally striking are the findings about the email consumers actually want and care about. it has long been CAUCE's contention that email is about personal communication. The survey's respondents from across the world agree.

On page 14 of the full report consumers state their preferences for various types of email; clearly one-to-one communications is still the cock of the walk when it comes to the type of email we all like to receive, messages from friends and family were ranked as ‘extremely or very important’ to 82% of respondents.

Strikingly, marketing email was only rated similarly by 15% of those surveyed; however, 32% did view such mail as ‘somewhat important’.

Graphic courtesy of MAAWG.org,reproduced with permission

This seemingly speaks to some fundamental issues that the marketing community must deal with if they are to better themselves in the eyes of consumers, irrelevant content and over-mailing are serious issues that enlightened marketers are working hard to deal with, but much more can be done, industry-wide to address them.

Other End-user oriented Resources (please help promote them!)
StaySafeOnline.org
StopBadware.org