AddToAny

Printer Friendly and PDF

Spam

Updates

25 Nov 2016

Users that are using Apple’s iCloud are facing a significant increase of spam. Spam emails containing calendar invitations are automatically scanned by Apple’s operating system and the invitations are popped up as a notification on phones or tablets. Users are also receiving spam invitations to edit reminders and view photo groups, reports the Telegraph. While spam emails can easily be ignored, or blocked, problematic invitations are not as easy to deal with. The users should not reject them because even this action notifies the spammer that the iCloud account is active. Apple works on issuing an official fix. Various Internet resources offer a guide with temporary solutions. However either solution has its drawbacks.

9 Nov 2016

In its recent Spam and Phishing report, Kaspersky Lab notes that its products have blocked around 73 million attempts to attack users with malicious e-mail attachments over the third quarter of 2016. This is the largest amount of malicious spam since 2014, and it represents a 37% increase compared to the second quarter of 2016. The percentage of spam within global e-mail traffic has increased with 2% over the last quarter, reaching a 59.19% average. The report also shows that India moved at the top of the list of countries generating spam (replacing the USA), and that Germany remained the target country of choice for spammers. The countries with the largest percentage of users affected by phishing attacks were China, Brazil, and the UAE.

5 Oct 2016

Yahoo! is said to have used a system intended to scan emails for child pornography and spam in order to respond to a secret court order issued in the US and requiring the company to search for messages containing a computer signature tied to the communications of a state-sponsored terrorist organisation. Yahoo!, which was barred from disclosing the matter, customised an existing scanning system for all incoming email traffic, allowing it to store and made available to the FBI a copy of any message it found that contained the specific digital signature. The order is seen as unusual, because it lead to the scanning of all Yahoo! users’ emails rather than individual accounts. The system, however, is said to be no longer in use.

Pages

Spam or unsolicited mail is sent to a wide number of Internet users. Spam is mainly used for commercial promotion. Its other uses include social activism, political campaigning, and the distribution of pornographic materials.

Spam is one of the Internet governance issues that affect almost everyone who connects to the Internet. However, whereas 10 years ago spam was one of the key governance issues, it is today a less prominent issues thanks to highly sophisticated technological filters.

 

According to statistics from 2014, 66% of e-mail traffic is spam. Besides the fact that it is annoying, spam also causes considerable economic loss, both in terms of bandwidth used and lost time spent checking/deleting it.

Spam can be combated through both technical and legal means. On the technical side, many applications for filtering messages and detecting spam are available. Several best practices have been developed by the technical community, include those by the Messaging, Malware, and Mobile Anti-Abuse Working Group (M3AAWG), the Spamhaus Project, GSMA, and the Internet Society.

The issues of spam or unsolicited mail

There are various issues associated with spam. From a technical perspective, one of the main problems with filtering systems is that they are known to delete non-spam messages, too. For instance, Verizon’s anti-spam filtering led to a court case as it also blocked legitimate messages causing inconvenience for users who did not receive their legitimate e-mail. The anti-spam industry is large, and employs increasingly sophisticated applications capable of distinguishing spam from regular messages.

Another issue arises from the different definitions of spam. Different understandings affect the anti-spam campaign. In the USA, a general concern about the protection of the freedom of speech and the First Amendment affect the anti-spam campaign as well. US legislators consider spam to be only ‘unsolicited commercial e-mail’ leaving out other types of spam, including political activism and pornography. In most other countries, spam is considered to be any ‘unsolicited bulk e-mail’ regardless of its content. Since most spam is generated from the USA, this difference in definitions seriously limits any possibility of introducing an effective international anti-spam mechanism.

One of the structural enablers of spam is the possibility of sending e-mail messages with a fake sender’s address. There is a possible technical solution to this problem, which would require changes in existing Internet e-mail standards. The IETF has been considering changes to the e-mail protocol, which would ensure the authentication of e-mail. This is an example of how technical issues (standards) may affect policy. A possible trade-off that the introduction of e-mail authentication would bring is the restriction of anonymity on the Internet.

Most spam originates from outside a given country. It is a global problem requiring a global solution. There are various initiatives that could lead towards improved global cooperation. Some of them, such as bilateral MOUs, are mentioned below. Others measures include capacity building and information exchange. A more comprehensive solution would involve some sort of global anti-spam instrument. So far, developed countries prefer the strengthening of national legislations coupled with bilateral or regional anti-spam campaigns. Given their disadvantaged position of receiving a ‘global public bad’ originating mainly from developed countries, most developing countries are interested in shaping a global response to the spam problem.

The legal response to spam

Technical methods have only a limited effect and require complementary legal measures. On the legal side, many states have reacted by introducing new anti-spam laws. In the USA, the Can-Spam Law involves a delicate balance between allowing e-mail-based promotion and preventing spam. Although the law prescribes severe penalties for distributing spam, including prison terms of up to five years, some of its provisions, according to critics, tolerate or might even encourage spam activity. The starting, default, position set out in the law is that spam is allowed until the receiver of spam messages says ‘stop’ (by using an opt-out clause).

In July 2003, the EU introduced its own anti-spam law as part of its directive on privacy and electronic communications. The EU law encourages self regulation and private sector initiatives that would lead towards a reduction in spam. In November 2006, the European Commission adopted its Communication on Fighting Spam, Spyware and Malicious Software. The Communication identifies a number of actions to promote the implementation and enforcement of the existing legislation outlined above, as the lack of enforcement is seen as the main problem.

Both of the anti-spam laws adopted in the USA and the EU have one weakness: a lack of provision for preventing cross-border spam. The Canadian Industry Minister, Lucienne Robillard, stated that the problem cannot be solved on a ‘country by country’ basis.

A global solution is required, implemented through an international treaty or some similar mechanism. An MoU signed by Australia, Korea, and the UK is one of the first examples of international cooperation in the anti-spam campaign.

The OECD established a task force on spam and prepared an anti-spam toolkit. The ITU was also proactive by organising the Thematic Meeting on Countering Spam (2004) to consider various possibilities of establishing a global Memorandum of Understanding on Combating Spam. At regional level, the EU established the Network of Anti-Spam Enforcement Agencies, and APEC prepared a set of consumer guidelines.

Another initiative is the International Cybersecurity Enforcement Network implementing the London Action Plan. The network, established in 2004, gathers regulatory authorities, the technical community and the business sector to collaborate on cross-border spam enforcement.

More recently, measures against spam were introduced in the International Telecommunication Regulations which were amended in 2012. Among the new articles, two new provisions deal with the ‘security and robustness of networks’ (Article 6), and the prevention of ‘unsolicited bulk electronic communications’ (Article 7). However, the latter provision on spam does not contain binding language; rather, it merely states that states ‘should endeavour to take the necessary measures’ and encourages them to cooperate together. Similarly, Resolution 52 of the World Telecommunication Standardization Assembly ‘invites’ states to take appropriate steps to combat spam, and refers only to national frameworks.

Events

Instruments

Conventions

International Telecommunication Regulations (WCIT-12) (2012)

Resolutions & Declarations

IPU Resolution on the Contribution of new information and communication technologies to good governance, the improvement of parliamentary democracy and the management of globalization (2003)
ITU Resolution 52: Countering and combating spam (2012)

Standards

Recommendation ITU-T X.1240 - ‘Technologies involved in countering e-mail spam’ (2008)

Other Instruments

Resources

Publications

Internet Governance Acronym Glossary (2015)
An Introduction to Internet Governance (2014)

Papers

Fighting Spam by Breaking the Economy of Advertising by Unsolicited Emails (2015)
The Harvester, the Botmaster, and the Spammer: On the Relations Between the Different Actors in the Spam Landscape (2014)

Reports

Kaspersky Security Bulletin. Spam and Phishing in 2015 (2016)
Stocktaking, Analysis and Recommendations on the Protection of CIIs (2016)
The Global Risks Report 2016 (2016)
Best Practice Forum on the Regulation and Mitigation of Unsolicited Communications (2015)
Best Practices to Address Online, Mobile, and Telephony Threats (2015)
Global Cybersecurity Index & Cyberwellness Profiles (2015)
Best Practice Forum on Regulation and Mitigation of Unsolicited Communications (e.g. “spam”) (2014)
Quarterly Spam Reports

Other resources

The Twitter Rules (2016)
Combating Spam and Mobile Threats - Tutorials (2016)
Symantec 2015 Internet Security Threat Report (2015)
Combating Spam: Policy, Technical and Industry Approaches (2012)
The Top 10 Worst
Symantec Monthly Threat Report
M3AAWG Best Practices
Global Spam Map
Global Legal Summaries about Regulatory and Policy Updates Related to Digital Advertising

Processes

WSIS Forum 2016 Report

Spam related challenged faced by emerging economies were discussed in Spam: Understanding and Mitigating the Challenges Faced by Emerging Internet Economies (session 152). It was underlined during the session that spam has become a complex issue, as it is more and more associated with malicious content, and that emerging economies may not have enough technical, human, and financial resources to fight it. Possible modalities to break the vicious cycle of spam generation were discussed (such as spam filtering, intrusion detection, antiviruses and patches, and user education), and reference was made to key areas emerging economies need to work on to combat spam (legislation (with clear rules in place), staff (with technical and legal expertise), and tools).

The GIP Digital Watch observatory is a service provided by

 

in partnership with

 

and members of the GIP Steering Committee

 




 

GIP Digital Watch is operated by