Subject: Re: spam (fwd) (edit error on previous)

From: Dean Anderson <[email-masked]>
Date: Mon, 26 May 2003 13:55:00 -0400 (EDT)

Oops editing problems. Please refer to this version instead.

On Sat, 24 May 2003, Bill Cunningham wrote:

> http://story.news.yahoo.com/news?tmpl=story&u=/nm/20030524/wr_nm/tech_spam_d
> c_3
>
>     Is this what we want? The legal system taking over something that should
> be done by IETF. This new legislation isn't supposed to stop e-mail
> marketing, but stop deception. Will it work? :-s

There are 3 types of email that we generally call spam:

Type 1: Bonafide Messaging with a real Commercial or non-profit(ie
political) purpose.  This includes people selling contraband (eg drugs)
illegally, so long as they intend to deliver the illegal goods.

Type 2: Bonafide fraudulent activity. Someone is really trying to get your
money, but has no intentions of honoring their obligations to the purchase
contract.  This includes bonafide attempts at identify theft.

Type 3: Annoyance activity. This has no bonafide intention of getting
money or even personal information, even though at a casual glance it may
appear so.  Type 3 is broken into 2 subtypes:

Type 3A is a relatively harmless disgruntled person, who is not terribly
sophisticated in their abuse, or in hiding their tracks. This type can be
handled by warnings or account termination. Besides spam, this type is
also involved in small DOS attacks and other unsophisticated abuse.

Type 3B is a career criminal using viruses and rooted machines to conduct
annoyance, which is frequently just another type of DOS attack, but
targeted perhaps at an email address, or perhaps at a domain. This type of
attacker is already a career criminal, having broken into many, often
hundreds of computers, illegally. This type cannot be dealt with
effectively by ISPs, because they are reasonable adept at hiding their
tracks. Usually, the ISP only detects the infected computer, but does not
identify or catch the cracker.

Of these types of spam, Type 1 and Type 2 can be dealt with by law, and
through the actions of the FTC and other regulatory agencies. Once
something has been determined to be contraband, then the appropriate
enforcement agency is called in.  Type 3A can be handled by the ISP or
their employer. Type 3B is much more difficult to handle.

What is unclear is how much of the total spam is due to each of these
types.  A lot of the spam that I recieve, and I have kept all this for
some time now, appears to be from type 3B. It is possible that my previous
conflicts with radical anti-spammers may affect the type and proportion of
spam that I get.  My testing and logging of a large block of IP address
space over a period of years, has indicated that much abuse is supported
and promoted by certain open relay blacklists which scan for, and then
advertise open relays and open proxies to abuse.  Relays scanned by such
organizations have shown up on commercial sites selling this information.
such as helllabs.com.ua. The question of whether this activity is merely
exploited or done with active participation seems to be prejudicially
answered by the fact that the "blacklists" advertise input addresses even
though these have no utility to "normal" users of the blacklist.  This
type of abuse (Type 3B) is often done with their ISPs ignoring both their
illegal scanning, and their solicitation of abuse, false advertising,and
other issuses. It is becoming more common for such activities to try to
operately completely anonymously, or to use false out-of-country addresses
to avoid prosecution[1].  It is unclear how much this type of abuse
contributes to the total spam volume.

I note that helllabs.com.ua makes false and misleading claims that relays
and proxies are free.  The anonymity claimed by a customer's product
(www.ghostsender.com) is also false.  And of course, if the spam is of
Type 1 or Type 2, there is no anonymity at all.  Frauds (Type 2) that
obtain money are easy to track via mail fraud or wire fraud.  Only abuse
of Type 3 is hard to track, and requires law enforcement powers to obtain
the required information.

Legislation of the type we have seen is not going to any affect on Type
3B, as this type is already committing federal felonies, and the
equivalent in many countries.  But we don't need additional legislation
for this activity since it is already a federal felony with a 5 year jail
term.  The problem is catching the culprit.  This is partly an issue of
law enforcement interest in catching these "harmless" criminals.

Whether the legislation has any affect on total spam will depend on the
proportion of the various types of spam.

With that in mind, we can consider what the IETF can do: The IETF can
specify protocols. But what protocols can be specified to reduce or
eliminate spam?

Dr. Claude Shannon, one of the founders of the science of Information
Theory, proved that it is impossible to prove the non-existance of a
covert channel. In terms of spam, this means that it is impossible to
construct a protocol that cannot be abused, since one cannot prove that it
is impossible (the channel can't exist) to send abuse (a covert channel).
No protocol can ever be constructed that is spam-free.  Radical
anti-spammers often try to couch their arguments as though the spammers
are "outsiders" who have been let in. This isn't true. All abusers are the
customer of some ISP, somewhere. There are no outsiders.  The spammers are
in fact authorized users of some ISP that are authorized to send email.
They remain authorized to send email until they lose service with that
ISP.  Once this is understood, it is completely obvious even without the
formality of Shannon's theorem that protocols such as SMTP AUTH will have
no effect whatsoever.

So IETF efforts in this area are limited to finding means of identifying
the abuser, once the abuser has been detected. There is also the technical
task of detecting abuse.

The adeptness of Type 3B at hiding is not due to any technical flaw, but
due to crossing organizational boundaries. They use a proxy at one ISP to
abuse another ISP. The first ISP can identify the abuser, but often won't,
unless there is a request from Law Enforcement.  Once law enforcement
becomes involved to make the appropriate requests of different ISPs, it
has not been a technically difficult matter to track down abusers. Though
the technical know-how seems to elude the Law Enforcement Authorities
(e.g. Kevin Mitnick) until a technically knowledgeable person becomes
involved (Shimomura)[2]. There are many examples of persons who have been
arrested for using the internet to make bomb threats, as well as persons
who have released particularly dangerous viruses, and persons who have
cracked computers belonging to financial institutions.  Once there is a
law enforcement interest in finding the identity of the people involved,
there seems to be little technical obstacle other than technical
competence to finding the people. So I think there is little to be done
technically so far as identification goes.

The issue of detecting abuse was the focus of the MIT anti-spam
conference.  There are many paths presently being pursued: Blacklists,
header analysis, and various kinds of content analysis.  I think the
general consensus was that content analysis offers the most promising
means of detecting and blocking abuse.  I think it is too early to tell
how protocols can be helpful in this area, or if new protocols are
necessary. One scheme, used by MSN, gives the user a button to submit a
message as spam. Their system then tracks the number of complaints
involving characteristics of the message, and blocks messages accordingly,
and on per-user control. Of course, this requires no change to any
protocols, just to applications.

		--Dean

[1] SPEWS has attemtped to avoid prosecution and legal responsibility by
remaining completely anonymous. ORBZ.ORG was criminally investigated for
crashing the City of Battle Creek's computer system. The City dropped the
investigation after ORBZ announced it would end operations.  However,
simultaneously or before the City's announcement, ORBZ operator Ian
Gulliver registered DSBL.ORG with a Brazilian address. Quite obviously, he
had no intention of halting operations, but merely to disguise their
jurisdiction.

[2] Even though Kevin Mitnick was on the FBI's most wanted list, the FBI
was unable to track him down. Only after one of his victims became
involved, was Mitnick finally located and arrested.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Tue, 27 May 2003 00:03:29 +0200

Dean writes:

> Of these types of spam, Type 1 and Type 2
> can be dealt with by law ...

Not on a worldwide network.  No organization or government has worldwide
jurisdiction.

> What is unclear is how much of the total spam
> is due to each of these types.  A lot of the spam
> that I recieve, and I have kept all this for
> some time now, appears to be from type 3B.

Almost everything I get seems to be Type 1, although I don't look at it very
closely.

> I note that helllabs.com.ua makes false and
> misleading claims that relays and proxies are free.

What is false about such claims?

> But what protocols can be specified to reduce or
> eliminate spam?

Almost none.  The problem is that spam is in the eye of the beholder.
Catching it with machine intelligence is practically impossible.  It's like
trying to scan messages for sarcasm.

---

From: Dean Anderson <[email-masked]>
Date: Mon, 26 May 2003 19:21:00 -0400 (EDT)

> Not on a worldwide network.  No organization or government has worldwide

They don't need worldwide juridiction.  They have control over products
sold in their jurisdiction, and the transfer of money into and out of
those jurisdictions.  Many countries have extradition treaties.

> Almost everything I get seems to be Type 1, although I don't look at it very

Perhaps you should look more closely.

> What is false about such claims?

That they are free. First, only the owner of the service can make
definitive statements about the price of the service. False statements
made by others are just that, false.  Newspaper stands and sidewalk vendor
carts are also unsecured, but taking their products without permission or
payment is theft. Telling others that they can take those products without
paying is solicition of a crime at worst, and false advertising and
trademark infringement at best.  Telephone systems can also have open
relay services configured, but it is well established that unuathorized
use is toll fraud.

> trying to scan messages for sarcasm.

True.

		--Dean

---

From: "Anthony Atkielski" <[email-masked]>
Date: Tue, 27 May 2003 01:52:35 +0200

Dean writes:

> Many countries have extradition treaties.

For certain crimes.  Spamming is not likely to qualify.

> Perhaps you should look more closely.

Why?  It's spam.

> That they are free.

But they _are_ free.

> Telephone systems can also have open relay services
> configured, but it is well established that unuathorized
> use is toll fraud.

I'm not aware of any similar jurisprudence having been established for the
Internet.

---

From: Dean Anderson <[email-masked]>
Date: Mon, 26 May 2003 20:53:03 -0400 (EDT)

> > Perhaps you should look more closely.

I can see you have a goal of limiting Type 1 spam, using the harms of Type
2 and Type 3 spam. This effort is doomed to fail.

> But they _are_ free.

Sorry. You are wrong.  Only I get to set prices on my services. You don't
get to tell others false prices.

> I'm not aware of any similar jurisprudence having been established for the

Fraud is common law, which applies to the internet.  After $5000, it
becomes a federal felony. State laws have other requirements.

		--Dean

---

From: Peter Deutsch <[email-masked]>
Date: Mon, 26 May 2003 18:53:12 -0700

g'day,

Anthony Atkielski wrote:
...
> I'm not aware of any similar jurisprudence having been established for the

Oh puuleez.

In Canada there is a Criminal Code offense known as something like
"unauthorized access to a computer system" (sorry for not having the
exact term, but it's been a while). A few years ago I helped prosecute a
case of illegal access onto a university machine under this provision,
and during the research phase was told by the RCMP folks I was working
with that having login prompts, warning messages, etc made it easier to
prosecute, but was not a requirement. Basically, it's a crime in Canada
to use somebody else's compute cycles without permission so what we had
to do was document access and attest that it was not authorized, they
then traced phone records to show corresponding use of modems on the
home line at the same time. The RCMP then got a search warrant, picked
up the perpetrators for questioning and searched their machine for
incriminating files. In that case, they pled out, but as Yodo would say
"guilty they were, conviction it was".

The case we prosecuted turned out to be a small group of kids breaking
into compute hosts, but from what I was told I would think you should be
able to use the same provision against spam relayers, since the key
element was the unauthorized use of compute cycles, not what they did
with the cycles. For those willing to invest some time and energy then
this could be a good starting point in that country, and perhaps a
suitable point of departure for various lawmakers looking at what could
be done in their own countries. After all, since we're gathering
analogies, it doesn't matter if I leave the keys in my car, that still
doesn't give you the right to take it for a joyride.

BTW, those who think SPAM is "too cheap to meter" need to look at the
total costs involved in providing services, including cost of staff and
all the hidden opportunity costs. My kids' school pays a part time
sysadmin who in turn makes use of a couple of technically literate
parents to help him with various chores as he's still learning his
craft. We've collectively spent many hours educating him to the issues
and he has spent hours trying to reduce the impact of SPAMers bombarding
the school mail host. I don't have a firm number, but it's a measurable
percentage of the total admin time over this past year, which translates
to other things the school didn't get because they don't have infinite
admin bandwidth. Also, since the school requires a certain amount of
volunteer time from each family (or a corresponding hourly fee) the
school has definitely suffered a loss in other stuff I might have done
for them with the finite amount of time I give them.

Put another way, gas may be cheap or expensive, but it's only one of the
costs involved in operating a motor vehicle...

			- peterd

-- 
---------------------------------------------------------------------
    Peter Deutsch                       [email-masked]
    Gydig Software

             "I'm no stranger to sarcasm, Sir..."

                               - Red versus Blue

---------------------------------------------------------------------

---

From: [email-masked]
Date: Mon, 26 May 2003 22:32:14 -0400

On Mon, 26 May 2003 18:53:12 PDT, Peter Deutsch said:

> with the cycles.

IANAL by any means, but I suspect that the owner of an open relay would have
a hard time demonstrating unauthorized use of cycles to relay mail *through
an open relay*.  Now if the spammer actively *bypassed* a security feature
in order to relay the mail, that would be different, as it would indicate
that they knew it was unauthorized...

---

From: Peter Deutsch <[email-masked]>
Date: Mon, 26 May 2003 22:29:37 -0700

> that they knew it was unauthorized...

Exaxtly, so you don't leave it open. Then, the only folks who would be
using you as a relay would be a) folks you've authorized to do so. By
definition the folks who are doing so without your authorization, would
be breaking the law and we have an existance proof that this stuff is
quite traceable and quite prosecutable. 

As a bonus, the law they would be breaking isn't one that must, in the
U.S. context, stand up to arguments about it supressing free speech and
so on. And I have no trouble with this, since you have a right to say
what you want, but I have a right not to listen, nor am I responsible
for providing you with a soapbox and megaphone...

				- peterd

                        "Bungle..."
               "That's an 'i', you idiot..."
                  "Oh, right. 'Bingle..."

                            - Red versus Blue...

---

From: "Anthony Atkielski" <[email-masked]>
Date: Tue, 27 May 2003 09:05:18 +0200

Dean writes:

> I can see you have a goal of limiting Type 1
> spam, using the harms of Type 2 and Type 3 spam.

I don't understand.

> This effort is doomed to fail.

I seem to manage to get rid of all spam, even the long string of virus
attachments sent to me a couple of hours ago from Japan with a subject line
from this list.

> Sorry. You are wrong.  Only I get to set prices
> on my services.

But nobody has to pay to use an open relay.

> Fraud is common law, which applies to the internet.

Common law requires jurisprudence to define its application.  I'm not aware
of any in this instance, so whether what you describe is fraud or not is an
open question.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Tue, 27 May 2003 09:10:18 +0200

Peter writes:

> Basically, it's a crime in Canada to use somebody
> else's compute cycles without permission ...

So your e-mail to this list committed a felony, since it reached my machine
without my explicit authorization and used compute cycles thereon ... right?
If not, explain why not.

> BTW, those who think SPAM is "too cheap to meter"
> need to look at the total costs involved in providing
> services ...

And those who say that spam is "too costly to tolerate" need to look at the
total cost of downloading advertisements, animations, active content, and
pop-ups when visiting Web sites--none of which are normally authorized by
the person visiting the sites.  Why isn't that illegal?

> My kids' school pays a part time sysadmin who
> in turn makes use of a couple of technically literate
> parents to help him with various chores as he's
> still learning his craft.

Gee, that's reassuring!

---

From: Glenn Chisholm <[email-masked]>
Date: Tue, 27 May 2003 16:01:37 +0800

>without my explicit authorization and used compute cycles thereon ... right?

I would imagine that your membership of the mailing list would constitute 
consent. Of course even if it did not, this would hardly be the first time 
a law has created an absurd situation.

glenn

---

From: "Anthony Atkielski" <[email-masked]>
Date: Tue, 27 May 2003 10:42:03 +0200

Glenn writes:

> I would imagine that your membership of the mailing
> list would constitute consent. Of course even if it
> did not, this would hardly be the first time

Exactly.  My point is that, without jurisprudence and precedent, there's no
telling whether a specific law (common or statutory) will be applicable to a
given situation.  And sometimes courts and judges make bizarre decisions.

---

From: Peter Deutsch <[email-masked]>
Date: Tue, 27 May 2003 07:33:08 -0700

g'day,

> without my explicit authorization and used compute cycles thereon ... right?

Do please pay attention, this will all be on the exam.

First, I didn't say "explicit authorization". It's generally considered
poor debating style to put words into the mouths of others so as to
appear to win a point.

Next, by subscribing to this list, you are granting implicit permission
to the list operator to connect to your machine to deliver list-related
email. If I were to take this example to the RCMP, I would fully expect
to be told that no crime was committed, because implicit authorization
was obviously granted.

Note, in signing up to a mailing list, you have *not* granted permission
to the list operator to send fragments of code intended to run your
implementation of the Distributed Halting Problem, nor are you
authorizing non-subscribers to the list to harvest your email for
unsolicited bulk commercial messaging.

The relevant concept appears to be one of property rights - you have the
right to determine what others can and cannot do with your property. You
can grant explicit or implicit rights to access your resources without
losing those rights.

Got it now?

> the person visiting the sites.  Why isn't that illegal?

Because it's something you can control by, for example, choosing not to
visit the site. Nobody's obliged to operate a website for your
convenience, and if you don't like the service, or the way they finance
it, you don't have to come back. This is fundamentally difference from
logging onto someone else's machine and using it for your purposes with
such an implicit contract.

> > still learning his craft.

What's your point? Small groups with limited resources should have just
as much right to benefit from the Internet, and not be subject to Denial
of Service attacks from Taiwanese servers just because they can't afford
tens of thousands of dollars per year in staff and equipment to defend
themselves. It's in exactly such circumstances that the true cost of
such activities is most evident. Large companies may be able to eat the
added costs, but at the margins it forces folks to do without. Shame on
you for not being able to see that...

				- peterd

                               - Red versus Blue

---

From: Dean Anderson <[email-masked]>
Date: Tue, 27 May 2003 12:47:58 -0400 (EDT)

No, it is easy.  As Chris Neill of Verio abuse found out, after he was
fired for doing this. (He posted his story to spam-l, blaming me for
getting him fired).

It is pretty much just like Peter described.  The hard part is finding a
real person to prosecute. Usually, Type 1 spammers don't abuse open
relays.

AOL has prosecuted spammers for sending _them_ mail, under the CFAA, after
the company was notified not to send them mail. (I'll try to dig up the
cite. You can find it pretty easily on lexis by searching for cases on 18
USC 1030)  Searching for cases involving AOL seems to be a good way to
stay current on computer law. ;-)

		--Dean

---

From: Dean Anderson <[email-masked]>
Date: Tue, 27 May 2003 12:58:33 -0400 (EDT)

On Mon, 26 May 2003, Peter Deutsch wrote:

> using you as a relay would be a) folks you've authorized to do so.

There are customers who are not on our IP address space who are authorized
to use our relays. Thats why they are open.  That's why all ISPs who
operate open relays have them.  SMTP AUTH just doesn't solve the problem,
for a number of reasons.

> By definition the folks who are doing so without your authorization,
> would be breaking the law and we have an existance proof that this stuff
> is quite traceable and quite prosecutable.

Yes. That is correct. It is prosecutable whenever Type 1 or Type 2 abusers
do this. But it is usually Type 3 abusers conducting the abuse, and Type 3
is difficult to identify without Law Enforcement powers.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Tue, 27 May 2003 19:12:49 +0200

> Do please pay attention, this will all be on the exam.

That's one of my problems.  I pay too much attention, and then people get
irritated when I see what they missed.

> First, I didn't say "explicit authorization".

You didn't have to.  See, the applicability of a law is decided in court,
not by Peter Deutsch.  Thus, your notion of whether or not a law applies is
little more than conjecture until it is confirmed or invalidated by a court
of law.  Even explicitly-worded statutes are still subject to interpretation
by the courts.  You cannot really say in advance how a specific case will
go, particularly when no existing jurisprudence for similar cases points the
way.

> It's generally considered poor debating style to put
> words into the mouths of others so as to appear to
> win a point.

I know of even more disreputable practices in debate.

> Next, by subscribing to this list, you are granting
> implicit permission to the list operator to connect
> to your machine to deliver list-related email.

Well, no.  Maybe I am, maybe I'm not.  A court would have to decide.  It
seems logical to me, but I'm not a judge, and judges don't always seem to be
logical.  Juries are even worse.

> If I were to take this example to the RCMP, I would
> fully expect to be told that no crime was committed,
> because implicit authorization was obviously granted.

The RCMP is an enforcement agency, not a judicial agency.  They don't decide
who is or isn't guilty of a crime (as far as I know).

> Note, in signing up to a mailing list, you have
> *not* granted permission to the list operator to send
> fragments of code intended to run your implementation
> of the Distributed Halting Problem ...

Here again, that still has not been decided, and some recent cases have
raised questions along those lines.

> Because it's something you can control by, for
> example, choosing not to visit the site.

But I don't know what the site will do until I visit it (similar to the
problem of shrink-wrapped licenses, which you cannot read without accepting
them).

> This is fundamentally difference from logging onto
> someone else's machine and using it for your purposes with

But that's _exactly_ what I'm doing when I send a Web query to a machine!

> What's your point?

Sysadmins are supposed to be past the learning curve already.