Subject: RE: [Asrg] Opt-out lists and legislation

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 10 Mar 2003 14:06:40 -0800

> Legislation is futile. The spammers will go off-shore if not already.
> The only solution is a technical one that crosses political borders.

Going offshore significantly increases costs and creates a major barrier
to entry.

	Phill  
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Justin Mason <[email-masked]>
Date: Mon, 10 Mar 2003 22:32:36 +0000

> Going offshore significantly increases costs and creates a major barrier

Using offshore contractors -- or USian contractors with offshore
sending hosts -- to send your spam, however, does not.   And that's
already the case in many of the big spamhaus cases (e.g. Alan Ralsky).

--j.

---

From: Kee Hinckley <[email-masked]>
Date: Mon, 10 Mar 2003 18:39:57 -0500

>Going offshore significantly increases costs and creates a major barrier

That depends on whether the company that runs it is offshore. 
Although if it isn't, that offers no legal protections.  And of 
course that also assumes that the majority of U.S. spam is generated 
by U.S. people.  Certainly even if the spam is originating here, 
people are using offshore machines (willing or not) to send spam. 
And for once I can provide numbers :-).

We do path analysis on the messages we filter, and we keep a database 
of what IP ranges match what countries.  We default users to a 
limited set of countries and we flag as spam anything that comes 
from, or passes through, anything out of that set.  (We do let 
through some messages that we consider completely "clean", even if 
from out of country, but that's a different matter.)  There's 
significant checking of the Received: chain, well beyond the "does 
the input of one match the output of the other" which isn't always 
reliable.

I currently have a sample database 22,000 confirmed spam messages 
sent to roughly 200 real email accounts.

40% blocked by the country restriction.
  4% blocked due to obvious viruses.
14% blocked due to system blacklist.
<1% blocked by user blacklists.

There's less than three percent overlap between those factors.  The 
rest are blocked solely on problems we saw with the headers.  There's 
certainly overlap between that and the other factors, but we don't 
currently log it specifically, so I don't know how much.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Mon, 10 Mar 2003 19:22:32 -0500

>already the case in many of the big spamhaus cases (e.g. Alan Ralsky).

Although it makes prosecution more difficult, the recent cases 
against off-shore casinos run by U.S. citizens seems to indicate that 
it doesn't provide any legal protection, even if the company is 
incorporated offshore, they still go after the principals.

Of course the government has a lot more drive to go after illegal 
casinos than illegal spammers--the legal casinos are pushing hard and 
they have big bucks.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: [email-masked]
Date: Tue, 11 Mar 2003 02:49:05 -0500

> There's less than three percent overlap between those factors.  The

Actually, there's a hidden assumption here that means that there's
a lot MORE than 3% overlap. Your 14% system blacklist refers to a
blacklist that was tailored thinking "and this list doesn't include
anything from .XY because we country-restrict them already".

What's *really* there is a system blacklist that accounts for 54%
of catches, where 70% of the rules are country-based and the other 30%
are rules to catch stuff the country rules dont....

Pick a country .XY and analyze it carefully - it's fairly likely that
if you didn't filter the country, you'd blacklist 3-4 spamhauses that
are 95% of the problem in that country.

The important question of course becomes whether or not the *rest* of
that country's population will start using e-mail enough to increase the
risk of false positives and skew your stats... ;)

> currently log it specifically, so I don't know how much.

It would be interesting and informative to have some other numbers.

What percent of mail was tagged with the country restriction but *NOT*
tagged as spam by users? (For instance, it would be quite easy to flag
all mail from .CN as spam - and although my users would probably tag back
100% of the spam from .CN, they'd not tag 100% of the mail from .CN, as
many have relatives there.. The fact that 40% of spam fails the country
test is not at all a reliable predictor unless there is a near-zero rate
of non-spam that fails the country test.

Is the "user blacklist" number the percentage caught by pre-established
user filters, or is that saying that your other checks were 99% effective
in identifying spam and only 1% got through to users for them to report?
Do you have any guesstimates of how much *unreported* spam got through
to the 200 accounts?

Or to turn up the satire, and point out the problem with the analysis:

40% of spammers drank milk at breakfast the day they spammed

I saw an amusing statistic once that 99.97% of all felonies are committed
while breathing air.... ;)

---

From: Kee Hinckley <[email-masked]>
Date: Tue, 11 Mar 2003 11:56:36 -0500

>anything from .XY because we country-restrict them already".

Yes and no.  Country restrictions are per-user, so the blacklist 
needs to be multi-national.  On the other hand, it's generated 
primarily based on spotting spam that is getting through from fixed 
sources, and that comes from user feedback.  So there is a bias 
towards countries that people usually receive email from.

>tagged as spam by users? (For instance, it would be quite easy to flag

Initially the false positive rate starts a little high until the user 
tunes their filters by specifying which countries they regularly get 
email from.  They can also approve a sender even if we are blocking 
the sender system wide--user rules win.

>100% of the spam from .CN, they'd not tag 100% of the mail from .CN, as

They'd okay mail from China, and then possibly have to okay senders 
from some Chinese ISPs on a per-user basis.  (E.g. I'm not sure, but 
I suspect that 163.net is on our blacklist, even though they are 
legit ISP.)

>in identifying spam and only 1% got through to users for them to report?

Although users can pre-establish a blacklist, they tend not to. 
Instead we let them blacklist a sender at the time they report a 
false negative (spam got through).  1% is the number of subsequent 
messages blocked by those blacklists.

I've just spent a week or so changing the interface to that part of 
the system.  The previous interface pretty much set up blocking the 
sender as the default when you reported spam.  Now it's a secondary 
choice, because the fact of the matter is that blacklisting the 
sending address almost never works.  The next email from the spammer 
uses a different address.  So there's no point in filling your 
blacklist with fake addresses.  (Or is it "might have existed by 
don't exist now" addresses :-).  Instead we want to reserve 
blacklists for blocking email from real people (or domains) that you 
*really* don't want.  So the primary action now is to report the 
problem so that we can look at it and figure out why we didn't block 
it.  We've also added "unsubscribe" detection.  If the message looks 
clean, but you think it's spam, we'll try unsubscribing you from it. 
A lot of the non-technical folks can't tell a commercial list that 
they accidentally subscribed to, from a spam message pretending to be 
a list.  If we can get them off the list, we've done everyone a 
favor.  We'll track responses to those of course--if they keep 
getting mail from the mailing list then we can put them on the 
blacklist.

>Do you have any guesstimates of how much *unreported* spam got through

This gets back to the problem I mentioned earlier on the list.  You 
can't trust users to check the email sitting in their blocked queue.

Because we are in (public) beta, our customers have been pretty good 
about trying to report everything, and we try and make reporting real 
easy (click on a URL in the message header).  My (non-scientific) 
observation is that if they let all mail go through to their MUA, and 
filter there, they are better at reporting false negatives (spam in 
their inbox) than false positives (good stuff in their spam box).  If 
they leave the spam on the server then we get the false positive 
report automatically because they can either "send" or "approve" the 
message.  "Sending" it doesn't notify us, and it doesn't change their 
rules.  "Approving" whitelists the sender and sends all messages 
currently held that are from that sender.  *That* we get notification 
of.

Basically, I feel pretty good about our current stats because we know 
most of the beta testers and they know that they are providing us 
with useful information in exchange for free spam blocking.  As we 
get into real users I expect that we'll see the accuracy drop off, 
especially after they've used the system for a while.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Kee Hinckley <[email-masked]>
Date: Tue, 11 Mar 2003 11:41:41 -0500

>anything from .XY because we country-restrict them already".

Not quite, because country blocking is per user.  But I'll take the 
rest of my response off list, since it's really a discussion of our 
system (which makes it more of an ad than anything relevant to this). 
If anyone else wants it, let me know.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: "Chris Lewis" <[email-masked]>
Date: Tue, 11 Mar 2003 14:51:16 -0500

> already the case in many of the big spamhaus cases (e.g. Alan Ralsky).

Ralsky is inside US jurisdiction, right?

It would be particularly difficult to craft legislation that _didn't_ 
cover everyone involved in a spam, whether the spammer itself, or the 
spammed-for person or...  If only by invoking "conspiracy to commit"...

---

From: Michael Ellis <[email-masked]>
Date: Tue, 11 Mar 2003 15:41:39 -0500

> spammed-for person or...  If only by invoking "conspiracy to commit"...

It would be my opinion that any legislation broad enough to cover everyone
even with 'conspiracy to commit' would then be struck down as unconstitutional

by the U.S. supreme Court just like COPA just died

--
Michael Ellis
Privacy Manager
Date.com
  Phone   (416) 306-0022 ext 620
  Fax     (416) 306-0023

Date.com - "The New Way To Date"

---

From: Jason Hihn <[email-masked]>
Date: Tue, 11 Mar 2003 15:54:50 -0500

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of Chris
> Lewis
> Sent: Tuesday, March 11, 2003 2:51 PM
> To: [email-masked]
> Subject: Re: [Asrg] Opt-out lists and legislation
>
>
> Justin Mason wrote:

He is, but his operations need not be. I can pay a New Guinea man to do my
spam for me. Or I can buy a whole internet site outside the U.S. and run my
operations from there and get disbursements.

Still, he is but one man. If he can no longer do it, someone who can will
step up to the plate.

---

From: "Chris Lewis" <[email-masked]>
Date: Tue, 11 Mar 2003 16:29:23 -0500

> by the U.S. supreme Court just like COPA just died

You're thinking way too complicated...

If you pay someone to commit a crime, then you're guilty of that crime too.

If spamming US citizens is a crime, then the person in the US who paid 
the, say, Taiwanese bulker, to spam US citizens, is guilty of it too.

Given that something like 80% of spam is flogging US-based services in 
one way or another, that's a huge bite.

---

From: Michael Ellis <[email-masked]>
Date: Tue, 11 Mar 2003 17:12:07 -0500

> one way or another, that's a huge bite.

Its not that IM thinking too complicated, Im just thinking like a lawyer (IANAL but
work with one now) and if its strict enough to close the loopholes then its likely
to be unconstitutional (like COPA) and if its too broad then there are loopholes
that spammers will exploit.

Far easier to get a regulatory type of legislation.
--
Michael Ellis
Privacy Manager
Date.com
  Phone   (416) 306-0022 ext 620
  Fax     (416) 306-0023

---

From: Jason Hihn <[email-masked]>
Date: Tue, 11 Mar 2003 17:24:55 -0500

> Sent: Tuesday, March 11, 2003 4:29 PM
> To: [email-masked]

You also think that he government has the time and money (or power) to
prosecute these people? You need $5000 in damage just to get the FBI to LOOK
at a domestic cyber crime. Do you think that the FBI, CIA, or Dept. Homeland
Sec. will have the facilities to be effective? And what's in it for a
foreign gov't if you get a foreign government to go after their citizen?

N-o-p-e. Not going to happen.