AddToAny

Spam

Updates

6 Mar 2017

River City Media (RCM) known as one of the largest spam operations in the world has exposed its entire operation to the public, allowing a data breach of its backups that included a database of 1.4 billion email accounts. Some of the records were combined with real names, user IP addresses, and often physical address. According to Chris Vickery, MacKeeper’s Security Researcher who discovered the leak, the CRM operation was responsible for up to a billion spam emails daily using sophisticated techniques to avoid anti-spam measures. Leaked documents also included backups of CRM’s internal communication and operational details. The case was handed over to the law enforcement and the most severe harmful code was also provided to affected IT companies and anti-spam organisations.

2 Feb 2017

WhatsApp has faced an increase in spam since April 2016 following the introduction of end-to-end encryption . The company therefore developed behavioural filters that analyse user metadata and mark potential spam. The company’s new anti-spam policy contributed in lowering the volume of spam by 75 %, informs TechCrunch. Although the bulk analysis of metadata brings some controversy, this example of a good success rate could encourage other communication platforms in the deployment of end-to-end encryption. 

1 Feb 2017

The recent Cisco 2017 Annual Cybersecurity Report suggests that spam accounted for 65 percent of the total email volume in 2016. A review of statistical data from the last ten years shows that 2016 spam volume is close to the record levels seen in 2010. The volume is growing due to an increasing number of spam-sending botnets. According to Cisco threat researchers, about 8-10 percent the spam observed in 2016 could be classified as malicious. 

Pages

Spam or unsolicited mail is sent to a wide number of Internet users. Spam is mainly used for commercial promotion. Its other uses include social activism, political campaigning, and the distribution of pornographic materials.

Spam is one of the Internet governance issues that affect almost everyone who connects to the Internet. However, whereas 10 years ago spam was one of the key governance issues, it is today a less prominent issues thanks to highly sophisticated technological filters.

 

According to statistics from 2014, 66% of e-mail traffic is spam. Besides the fact that it is annoying, spam also causes considerable economic loss, both in terms of bandwidth used and lost time spent checking/deleting it.

Spam can be combated through both technical and legal means. On the technical side, many applications for filtering messages and detecting spam are available. Several best practices have been developed by the technical community, include those by the Messaging, Malware, and Mobile Anti-Abuse Working Group (M3AAWG), the Spamhaus Project, GSMA, and the Internet Society.

The issues of spam or unsolicited mail

There are various issues associated with spam. From a technical perspective, one of the main problems with filtering systems is that they are known to delete non-spam messages, too. For instance, Verizon’s anti-spam filtering led to a court case as it also blocked legitimate messages causing inconvenience for users who did not receive their legitimate e-mail. The anti-spam industry is large, and employs increasingly sophisticated applications capable of distinguishing spam from regular messages.

Another issue arises from the different definitions of spam. Different understandings affect the anti-spam campaign. In the USA, a general concern about the protection of the freedom of speech and the First Amendment affect the anti-spam campaign as well. US legislators consider spam to be only ‘unsolicited commercial e-mail’ leaving out other types of spam, including political activism and pornography. In most other countries, spam is considered to be any ‘unsolicited bulk e-mail’ regardless of its content. Since most spam is generated from the USA, this difference in definitions seriously limits any possibility of introducing an effective international anti-spam mechanism.

One of the structural enablers of spam is the possibility of sending e-mail messages with a fake sender’s address. There is a possible technical solution to this problem, which would require changes in existing Internet e-mail standards. The IETF has been considering changes to the e-mail protocol, which would ensure the authentication of e-mail. This is an example of how technical issues (standards) may affect policy. A possible trade-off that the introduction of e-mail authentication would bring is the restriction of anonymity on the Internet.

Most spam originates from outside a given country. It is a global problem requiring a global solution. There are various initiatives that could lead towards improved global cooperation. Some of them, such as bilateral MOUs, are mentioned below. Others measures include capacity building and information exchange. A more comprehensive solution would involve some sort of global anti-spam instrument. So far, developed countries prefer the strengthening of national legislations coupled with bilateral or regional anti-spam campaigns. Given their disadvantaged position of receiving a ‘global public bad’ originating mainly from developed countries, most developing countries are interested in shaping a global response to the spam problem.

The legal response to spam

Technical methods have only a limited effect and require complementary legal measures. On the legal side, many states have reacted by introducing new anti-spam laws. In the USA, the Can-Spam Law involves a delicate balance between allowing e-mail-based promotion and preventing spam. Although the law prescribes severe penalties for distributing spam, including prison terms of up to five years, some of its provisions, according to critics, tolerate or might even encourage spam activity. The starting, default, position set out in the law is that spam is allowed until the receiver of spam messages says ‘stop’ (by using an opt-out clause).

In July 2003, the EU introduced its own anti-spam law as part of its directive on privacy and electronic communications. The EU law encourages self regulation and private sector initiatives that would lead towards a reduction in spam. In November 2006, the European Commission adopted its Communication on Fighting Spam, Spyware and Malicious Software. The Communication identifies a number of actions to promote the implementation and enforcement of the existing legislation outlined above, as the lack of enforcement is seen as the main problem.

Both of the anti-spam laws adopted in the USA and the EU have one weakness: a lack of provision for preventing cross-border spam. The Canadian Industry Minister, Lucienne Robillard, stated that the problem cannot be solved on a ‘country by country’ basis.

A global solution is required, implemented through an international treaty or some similar mechanism. An MoU signed by Australia, Korea, and the UK is one of the first examples of international cooperation in the anti-spam campaign.

The OECD established a task force on spam and prepared an anti-spam toolkit. The ITU was also proactive by organising the Thematic Meeting on Countering Spam (2004) to consider various possibilities of establishing a global Memorandum of Understanding on Combating Spam. At regional level, the EU established the Network of Anti-Spam Enforcement Agencies, and APEC prepared a set of consumer guidelines.

Another initiative is the International Cybersecurity Enforcement Network implementing the London Action Plan. The network, established in 2004, gathers regulatory authorities, the technical community and the business sector to collaborate on cross-border spam enforcement.

More recently, measures against spam were introduced in the International Telecommunication Regulations which were amended in 2012. Among the new articles, two new provisions deal with the ‘security and robustness of networks’ (Article 6), and the prevention of ‘unsolicited bulk electronic communications’ (Article 7). However, the latter provision on spam does not contain binding language; rather, it merely states that states ‘should endeavour to take the necessary measures’ and encourages them to cooperate together. Similarly, Resolution 52 of the World Telecommunication Standardization Assembly ‘invites’ states to take appropriate steps to combat spam, and refers only to national frameworks.

Events

Instruments

Conventions

International Telecommunication Regulations (WCIT-12) (2012)

Resolutions & Declarations

ITU Resolution 52: Countering and combating spam (2012)
IPU Resolution on the Contribution of new information and communication technologies to good governance, the improvement of parliamentary democracy and the management of globalization (2003)

Standards

Recommendation ITU-T X.1240 - ‘Technologies involved in countering e-mail spam’ (2008)

Other Instruments

Resources

Publications

Internet Governance Acronym Glossary (2015)
An Introduction to Internet Governance (2014)

Papers

Fighting Spam by Breaking the Economy of Advertising by Unsolicited Emails (2015)
The Harvester, the Botmaster, and the Spammer: On the Relations Between the Different Actors in the Spam Landscape (2014)

Reports

Kaspersky Security Bulletin. Spam and Phishing in 2015 (2016)
Stocktaking, Analysis and Recommendations on the Protection of CIIs (2016)
The Global Risks Report 2016 (2016)
Best Practice Forum on the Regulation and Mitigation of Unsolicited Communications (2015)
Best Practices to Address Online, Mobile, and Telephony Threats (2015)
Global Cybersecurity Index & Cyberwellness Profiles (2015)
Best Practice Forum on Regulation and Mitigation of Unsolicited Communications (e.g. “spam”) (2014)
Quarterly Spam Reports

Other resources

The Twitter Rules (2016)
Combating Spam and Mobile Threats - Tutorials (2016)
Symantec 2015 Internet Security Threat Report (2015)
Combating Spam: Policy, Technical and Industry Approaches (2012)
The Top 10 Worst
Symantec Monthly Threat Report
M3AAWG Best Practices
Global Spam Map
Global Legal Summaries about Regulatory and Policy Updates Related to Digital Advertising

Processes

WSIS Forum 2016 Report

Spam related challenged faced by emerging economies were discussed in Spam: Understanding and Mitigating the Challenges Faced by Emerging Internet Economies (session 152). It was underlined during the session that spam has become a complex issue, as it is more and more associated with malicious content, and that emerging economies may not have enough technical, human, and financial resources to fight it. Possible modalities to break the vicious cycle of spam generation were discussed (such as spam filtering, intrusion detection, antiviruses and patches, and user education), and reference was made to key areas emerging economies need to work on to combat spam (legislation (with clear rules in place), staff (with technical and legal expertise), and tools).

The GIP Digital Watch observatory is a service provided by

 

in partnership with

 

and members of the GIP Steering Committee

 




 

GIP Digital Watch is operated by