Subject: RE: [Asrg] Accountability - AOL suing spammers

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 16 Apr 2003 09:02:13 -0700

I went to a talk by linda franklin on hacking and law enforcement. She made
the point in a very concise form:

You can increase the effectivness of the dollars you spend on prevention
with a small amount of deterrence through law enforcement.

 -----Original Message-----
From: 	Jim Youll
Sent:	Tue Apr 15 20:18:54 2003
To:	[email-masked]
Subject:	[Asrg] Accountability - AOL suing spammers

The accountability and legal-recourse vamp/solution should not be
forgotten...

definitions...
	Open Relay == attractive nuisance
	Spam that won't stop == trespass and/or harassment
	Guiding principle: The right to be left alone, "Quiet Enjoyment"

=======================

http://media.aoltimewarner.com/media/newmedia/cb_press_view.cfm?release_num=
55253129

America Online, Inc. (NYSE: AOL), as part of its ongoing, 
comprehensive battle against spammers, today announced a sweeping 
series of lawsuits against individuals and companies that it alleges 
have repeatedly sent members high volumes of unwanted junk emails 
using a variety of evasive means to circumvent AOL's spam filters.

AOL is filing five separate lawsuits against over a dozen companies 
and individuals, who the Company alleges are together responsible for 
sending an estimated one billion spam emails to AOL members and 
generating over 8 million individual spam complaints from members. 
The latest lawsuits filed by AOL are the first to leverage the 
complaints received by AOL from its members who are using the popular 
"Report Spam" button in AOL 8.0.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Dave Crocker <[email-masked]>
Date: Thu, 17 Apr 2003 00:11:24 -0700

> with a small amount of deterrence through law enforcement.

Only if the deterrence is effective, rather than distracting or
otherwise providing a false sense of security.

Given the limits of scope to any one jurisdiction's enforcement
authority, it is not at all clear that legislation will do anything but
burden bulk mailers who are already acting responsibly (or, at least,
accountably.)

d/
--
 Dave Crocker <mailto:[email-masked]>
 Brandenburg InternetWorking <http://www.brandenburg.com>
 Sunnyvale, CA  USA <tel:+1.408.246.8253>, <fax:+1.866.358.5301>

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 17 Apr 2003 08:45:19 -0600 (MDT)

> From: Dave Crocker <[email-masked]>

> otherwise providing a false sense of security.

Yes, but the number of distinct streams of spam seen in the Internet
by DCC servers decreased iin the first days after news of the AOL and
Symantec lawsuits broke.  See http://www.dcc-servers.net/dcc/graphs/db-size
Somehow I doubt that dip is due to spammers spending a lot of time
worrying about their U.S. taxes.  I know of no relevant measurment
artifact.  Oddly enough, I think I'm still seeing spam from some of
the outfits that were sued.

> burden bulk mailers who are already acting responsibly (or, at least,

Spam is a major burden for bulk mailers who are already acting
responsibily or accountably.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Dave Crocker <[email-masked]>
Date: Sat, 19 Apr 2003 07:36:22 -0700

Vernon,

>> otherwise providing a false sense of security.

VS> Yes, but the number of distinct streams of spam seen in the Internet
VS> by DCC servers decreased iin the first days after news of the AOL and
VS> Symantec lawsuits broke.

It is easy to have a point effect and difficult to have a strategic
effect.

I believe that legal efforts will have two useful, strategic effects:

1.  They will produce some standardized language; that is, we will come
to have terminology that is reasonably precise and is used reasonably
consistently.

2.  Marginal spammers will behave more consistently and, perhaps, more
acceptably.  Marginal spammers operate within rules, although they might
be irritating.

What will NOT be affected are international spammers and rogue spammers.
My own experience shows this to be a very, very large group.

The negative effect of legislation will probably be excessive
expectations, followed by increased frustration.  More seriously there
is likely to be an unexpected and undesireable spill-over to valid
email.  This is what usually happens when we pass laws about content but
do not have a clear, strong, simple means of distinguishing "acceptable"
from "unacceptable".

d/

---

From: Vernon Schryver <[email-masked]>
Date: Sat, 19 Apr 2003 09:40:40 -0600 (MDT)

> ...

Yes, but strategic effects consist of a lot of point effects.  Previous
point effects such as those from the Flowers.com case are why the vast
majority of spam sender addresses are either obviously legitimate or
point to free mail providers.

> to have terminology that is reasonably precise and is used reasonably

It's ironic to have legislators doing the work of the IETF/IRTF, but
I doubt this mailing list will be able to contribute more than a list
that says "Fraud & Crime" is "Nigerian 419," "eBay password/credit
card theft," and "payPal password/credit card theft."

> My own experience shows this to be a very, very large group.

Could you quantify that?  As far as I can see, international and rogue
spammers are incredibly few.  I suspect fewer than 50 account for
almost all of the spam in the last week that knowingly violates
currently laws or what spammers think are legal norms and fair play.

Most of the nominally international spam in my traps is clearly
U.S. based.  The FTC's new effort against the marriedbutloney
spammer is a classic example of the limits of trying to appear to
be an international rogue while living in the U.S.

There will always be spam from international rogues, but I think
it is reasonable to hope that it will be as much of a problem as
viruses and worms are for people who care enough to do anything to
avoid those problems.  When was the last time one of your systems
was significantly affected by a virus or worm?

> do not have a clear, strong, simple means of distinguishing "acceptable"

Those problems are likely.  This mailing list could make a major
contribution to minimizeing them by defining "spam" and "implicit
consent."  An official IETF definition of "spam" would let legislators
concentrate on writing laws against spam instead of defining mail
protocols.

However, defining implicit consent and spam would require ignoring
special interests and other minority voices.  We all know that contrary
to some claims, the consensus definition of "spam" is UBE.

---

From: Dave Crocker <[email-masked]>
Date: Tue, 22 Apr 2003 13:37:55 -0700

Vernon,

>> My own experience shows this to be a very, very large group.

VS> Could you quantify that?  As far as I can see, international and rogue
VS> spammers are incredibly few.

My sense is that different people experience very different traffic
patterns of spam.

For example, I get a great deal from Asia and South America. I haven't
bothered to calculate a percentage, but it is very substantial, out of
the many thousands of spams I receive each week.

d/

---

From: [email-masked] (Justin Mason)
Date: Wed, 23 Apr 2003 14:06:09 +0100

> the many thousands of spams I receive each week.

How many are "via" and how many "from"?   Many US-based spammers abuse
proxies and relays in those parts of the world.

--j.

---

From: J C Lawrence <[email-masked]>
Date: Tue, 22 Apr 2003 15:25:50 -0700

On Wed, 23 Apr 2003 14:06:09 +0100 

> proxies and relays in those parts of the world.

Currently, and this is a rough and moving average, 20% of my spam load
is non-english.  Within that 20% about half is visibly asian (kangi and
other non-roman alphabets), with the rest being in various non-english
European languages.  These percentages vary widely over fairly short
periods of time.  In December of last year more than three quarters of
my total spam load was asian.  Last month I received almost no asian
spam, with the slack being occupied by Norwegian and Danish spam.

<shrug>

People, they vary.

-- 
J C Lawrence                
---------(*)                Satan, oscillate my metallic sonatas. 
[email-masked]               He lived as a devil, eh?		  
http://www.kanga.nu/~claw/  Evil is a name of a foeman, as I live.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Tue, 22 Apr 2003 22:47:46 -0400

>the many thousands of spams I receive each week.

Out of a sample 50,000 spam messages I just checked, it looks like 
40% from outside of the US.  Of that the breakdown is:

10% CN
  6% KR
Everything else is less than 1%.  With the countries above .5% being
BR, IT, TW, HK, CA, RU, JP, ES, UK, NL, FR, MX, DE, and AU, in 
descending order.

In that sample, coming from outside the US is defined as originating 
or passing through a server in one of those countries.  With the 
exception of the stuff that we get that's actually in Chinese or 
Korean (or the very badly written ads for Chinese industrial 
companies), I have no illusions about where most of it is really 
based.

A quick check for a couple character sets in the subject (which isn't 
really accurate, some arrives in UTF8, some arrives assuming the 
subject will be in the same character set as the body... not).

GB2312		1.20%
ISO-2022-jp	 .06%
ks_c_5601	 .25%
big5		 .11%
8859-3		 .06%
windows-1251	 .01%

I have no doubt that the percentage can vary quite a bit depending on 
your user base.  In particular, I know that my personal percentage of 
GB2312 is way higher than 1%.

-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg